Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently changed jobs and I've been set up with a new workstation. On all previous places where I've been working they've had some sort of local firewall installed on each and every workstation - but here I've been told not to activate it because it is not necessary since we're already behind a HW Firewall.

To me this seem a bit naïve, but I cannot emphasise it. I always thought a local firewall was good practice, ie. if something managed to come through the hw firewall there might be a slight chance other computers on the lan would block the internal threath.

We got free access to internet and we got a virus checker installed.

share|improve this question
up vote 2 down vote accepted

It pracitcally makes no difference. I keep the per workstation firewall up on all systems because it gives a jota more security (really small amount). All relevant ports are opened by grroup policy, so ping etc. works. This includes file sharing for the "c$" admin access.

At the end, I think the difference is really neglegible, unless you have a central control system like from TrendMicro OfficeScan (where you can turn on "outbreak mode" and th e local system blocks a lot more because something is supposedly running wild).

share|improve this answer

The biggest threats are internal, not external. A criminal trying to break into/through the corporate firewall has only a vague idea of what is on the other side. A disgruntled employee probably knows much, much better, and is already on the inside. Keep the software firewall up.

share|improve this answer
But then he also knows how to bypass the firewall. – TomTom Jun 16 '10 at 13:13
Any software firewall is already going to be configured to allow internal applications to work, and not be able to stop an employee who wants to leak information. – afrazier Jun 16 '10 at 13:23
A disgruntled employee isn't going to try to bypass your user-level firewall: he'll attack the weaker point in your setup and that's not the TCP stack. – Stephane Jun 16 '10 at 13:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.