A good software firewall for home users should have the following attributes:
But not all firewalls are created equal. Let's look at a few.
Windows Firewall: Built-in Defense
The easiest software firewall you can use is the built-in Windows Firewall. It is a feature of windows XP Service Pack 2 (SP2), a great big security fix that was issued in the summer of 2004.
When you install SP2, it turns on the Windows Firewall. It's not a very complex piece of software and it's often criticized for its simplicity. I think it's a decent security tool because
Now, the Windows Firewall (see Figure 3.2) is not without its critics . It only polices traffic one-way. Inbound traffic is inspected by the software, but data traffic coming from the computer and flowing out to the Internet is not examined. That can be a problem because if there is a virus, spyware, or other malware on your computer trying to communicate with the outside world, Windows Firewall does not catch it on the way out.
Figure 3.2. The Windows Firewall is included with Service Pack 2 and is easily accessible in the Security Center in the Windows XP Control Panel.
Third-Party Software Firewalls
For the best firewall protection possible, install a third-party software firewall. These programs defend a computer in both directions. They inspect data coming into a computer from the outside world and they look at data leaving the computer to ensure it's valid traffic and not coming from spyware, a Trojan horse, or a worm.
These programs also use a question and answer process to learn your habits. They are particularly bothersome when they are first installed because every time a program attempts to move data across the firewall, an alert is generated by the firewall that requires the computer user to respond.
Here are some of the features that third-party firewalls offer over the built-in Windows Firewall:
Recommended Firewall Freebies
A couple of very good free firewall programs you might consider installing include
Hardware firewalls are devices that physically sit between your computer and the wire that goes out to the Internet. Although businesses usually use a device that is physically separated from their other network gear, at home you'll find a firewall built into home network routers.
Some of the many advantages to hardware firewalls are
Easy Defense with a NAT Firewall
Home network routers have a firewall feature built in that uses a technology called network address translation (NAT) .
It's not a firewall technology itself, but it offers a firewall-like feature that provides natural protection from Internet nasties, such as hackers and worms.
Figure 3.4. The Windows XP Security Center monitors the presence of a software firewall (in this case ZoneAlarm) and, on detection, turns off the Windows Firewalls to avoid redundancy.
NAT was invented because of a shortage of IP addresses available to the ever-growing Internet population. Sounds complicated but it's not really. An IP address is like a phone number for each device connected to the Internet. Every device on the Internet has an IP number. An IP address is a set of four three digit numbers that can't be any lower than 0.0.0.0 or higher than 255.255.255.255.
If you can surf the Internet on your computer right now, it has an IP address. Because there's a shortage of IP addresses, not everyone can have her own. So NAT devices were invented to help (see Figure 3.5).
Figure 3.5. This Netgear router uses network address translation (NAT) that hides the identity of computers connected to it.
NAT routers work like this: Every large company has a switchboard. Everyone dials one central public phone number to talk to the company operator. When they reach the operator, they ask for an extension and they are put through.
NAT works like that. The router has an IP address that everyone on the Internet can call (it's like the switchboard). Behind the router is a home network. Each computer on the network has a private IP address (like a phone extension).
When data from the Internet arrives for one of those computers, it is sent to the NAT router and the NAT router looks up the computer on its network (in a handy little directory it keeps) and checks to see which one made the request.
The router hands the data off to that computer. This is built-in security because no one on the Internet can send data to a computer behind a router directly. They always have to go through the router first.
Stateful Inspection: The Meticulous Traffic Cop
There's one more level of security built into a NAT router that offers great and easy security. Let's say your child's computer, your computer, and your spouse's laptop are all behind a router. Suddenly, in comes communication from a server on the Internet that hosts bumfluff.com.
The router looks at a list it keeps of all computers attached to it to see who initiated a request with bumfluff.com. When it discovers that none of the computers did, it realizes that bumfluff.com is a bad website that is actually a front for hackersncrackers.com. So it discards the request, and all is right with the world again.
You see, in order to communicate with a computer behind a NAT router, that computer has to first communicate with you (see Figure 3.6).
Figure 3.6. In stateful packet inspection, a router only allows information through to a computer if the computer requested it.
So if I use my computer to contact bumfluff.com to see the latest news about mallomars (which are tasty marshmallow and chocolate cookies), the router notes that I am making contact. When bumfluff.com comes back to the router with information about mallomars, the router says, "Oh yeah, Andy's computer has been communicating with bumfluff.com, so I'll let it through."
This is called stateful inspection or sometimes stateful packet inspection. All NAT routers engage in stateful inspection.