Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Similar to these questions:
What Firewall Rules Should Be Used For A Home-Based System and
Firewall on VPS Use Windows Built In
But more specifically I'm guessing that using both the Windows Firewall and a router's built in firewall are redundant? Which is generally considered the better option for general computer/internet use?(For an example, I personally have a D-Link Router) What would you recommend to non-tech savvy folk?

share

locked by HopelessN00b Dec 5 at 9:31

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off topic by MDMarra, sysadmin1138 Nov 11 '11 at 17:45

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers 4

up vote 4 down vote accepted

I have always heard that a router/hardware firewall is better than a software firewall. And yes they are redundant. But one thing you will hear a lot from security people is the phrase "defense in depth".

So even though they are redundant, you may find that doubling up on a firewall probably won't hurt and it is nice to have a backup just in case.

share

Be aware that in Windows XP the built-in firewall (Windows Firewall) provides inbound protection only. A program running on your computer that attempts to access the internet will not be stopped or checked by the built-in Windows Firewall.

On Vista I believe the built-in firewall does do outbound checking, but it is disabled by default. Why this is, I can only guess.

The key security benefit my router provides is Network Address Translation (NAT). As others have said, this translates my external (ISP assigned) ip address to an internal private IP address. I could be wrong but this is what I mean when I talk about a hardware firewall.

So, on XP, I use the router (hardware) firewall and run another software firewall to provide an extra level of inbound protection, as well as much needed outbound protection.

As I'm sure you know, a router can be configured to open various ports. The software firewall will also watch for inbound access through any opened ports. So, for example, if you open a temporary port but then forget to close it, its useful to have the software firewall as a backup.

I also turn the built-in Windows firewall off. This is actually recommended by Microsoft and other vendors, ie. run only one software Firewall at a time.

share

They are redundant, but the Windows Firewall can still be useful - for example if your child's computer gets infected and attacks other systems on the LAN, it won't be able to get past the Windows firewall. If you have a docked laptop, it is often convenient to leave the firewall enabled even while on the LAN so that you won't forget to re-enable it when the laptop travels.

share

In most cases at home, whatever router you are behind is perfectly acceptable to protect you and your PC's from any sort of intrusion, especially if remote management is turned off. What you need to look out for is applications which might open ports in your router using UPnP. This is not generally bad, depending on how paranoid you are.

Windows Firewall, on the other hand, is not exactly redundant. All your router does is put your computer on a private network, with a different IP address than your publicly facing one, and when desired, forwards connections on specific ports to your machine on the private network. Windows firewall can protect and notify you about outgoing connections your machine attempts to initiate, as well as provide an additional layer of protection against incoming connections you did not explicitly allow.

share
    
The Windows Firewall in XP does not provide any sort of protection for outbound connections. The Vista version does support outbound protection, but it was disabled by default and needs to be enabled (may have changed recently). –  Ash May 14 '09 at 2:15
    
Generally you don't need outbound protection NEARLY as much as you do inbound protection anyway. –  Mark Allen May 14 '09 at 5:52
    
@Mark while it's true that outboud is not as needed as inbound there is always the chance you've already foobared your PC and now need to block outbound stuff too! –  Tim Meers Mar 5 '10 at 17:17
1  
@Tim Meers: I said Nearly. :) Also, I like the Windows Firewall in addition to the router because my wife and children aren't always as careful as I am, so if they cause their machines to become infected, my PC is still protected. So I like having both. Back in the old days I would run BlackICE, which rocked. –  Mark Allen Mar 8 '10 at 22:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.