Block incoming traffic to specific computer

Question

I have a router that is connected to the internet.
To that router we connect via LAN and WAN.
WAN settings are up, router user/pass, router access is secured with WPA/WPA-2.
I want to make some computers, to be connected to the router (lan or wan) and will be protected from the outside world.

What is the best way doing so ?

the computers firewall must be turned off.
the router firewall is on, it is a cheap typical TP Link router - TL-WR741N / TL-WR741ND.
Are these setting enough ? to set the firewall On on router, or maybe i can block incoming traffic to certain ips - the ips of computers i want to use interally on network so computer from outside would not be able to hack them.

Answer 1

Your firewall/router by default will block incoming traffic and only allow traffic outbound that is initiated by the internal LAN side. Make sure the firewall is turned on, yes. Especially if this is the final route out to the internet.

So incoming connections initiated by the outside should be dropped by default but you can do a full port scan of your WAN public IP address(es) here: http://www.hackerwatch.org/probe/

That should help you gauge if anything is open or not open.

There are other steps such as ensuring your WAN IP for management purposes on your router isn't accessible (to prevent external access to it by hacking attempts), along with secure passwords instead of the defaults on it. Make sure it's on the latest firmware and ask TP Link if there's any known exploits against that router.

This isn't fullproof by any means, and you'll need to be thorough about your security if you ever change anything or do allow inbound port access for things like VPN, hosted apps (like websites/email), etc.

If you are super concerned or it is a big deal to management, consider hiring a small firm to do a penetration test and security assessment from time to time.

Finally, relax....you are probably a small shop, so don't go crazy trying to create all kinds of layers and customization. Put in place what makes you and management comfortable without being so draconian that people cannot work.

Answer 2

By default, firewalls block all incoming traffic that originates on the external side of the firewall. I've never seen a firewall that didn't do this by default. I'd be very surprised if your firewall didn't do this by default. That being said, I don't think you need to do anything else but enable the firewall. If it's already enabled then you should be all set. To confirm this you can run an external port scan against the public ip address of your firewall to test for open ports.

Answer 3

It looks like your router uses NAT. That already provides you a little security by making your network closed to external connections without any need of a firewall. A port scan would indeed confirm that, as others have suggested. If you don't host servers in your network, or more precisely any service that needs to be accessed from the outside, you can assume that the firewall-like feature provided by NAT is enough for basic security.

Other treats are more related to the behavior of your users. According to the websites they visit and their internet activities in general, your network could be more or less secure. If you don't trust the users in your network, you may consider to set up more restrictions. That would imply the use of the firewall to block their access to specific protocols or sites. In that case, you may want to have a look at this page: http://www.tp-link.com/en/support/faq/?pcid=201&problem=6&m=TL-WR941ND&keywords=&faqid=