Similar to these questions:
What Firewall Rules Should Be Used For A Home-Based System and
Firewall on VPS Use Windows Built In
But more specifically I'm guessing that using both the Windows Firewall and a router's built in firewall are redundant? Which is generally considered the better option for general computer/internet use?(For an example, I personally have a D-Link Router) What would you recommend to non-tech savvy folk?
Similar to these questions:
closed as off topic by MDMarra, sysadmin1138♦ Nov 11 '11 at 17:45
Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.
locked by HopelessN00b Dec 5 '14 at 9:31
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.
Read more about locked posts here.
I have always heard that a router/hardware firewall is better than a software firewall. And yes they are redundant. But one thing you will hear a lot from security people is the phrase "defense in depth".
So even though they are redundant, you may find that doubling up on a firewall probably won't hurt and it is nice to have a backup just in case.
Be aware that in Windows XP the built-in firewall (Windows Firewall) provides inbound protection only. A program running on your computer that attempts to access the internet will not be stopped or checked by the built-in Windows Firewall.
On Vista I believe the built-in firewall does do outbound checking, but it is disabled by default. Why this is, I can only guess.
The key security benefit my router provides is Network Address Translation (NAT). As others have said, this translates my external (ISP assigned) ip address to an internal private IP address. I could be wrong but this is what I mean when I talk about a hardware firewall.
So, on XP, I use the router (hardware) firewall and run another software firewall to provide an extra level of inbound protection, as well as much needed outbound protection.
As I'm sure you know, a router can be configured to open various ports. The software firewall will also watch for inbound access through any opened ports. So, for example, if you open a temporary port but then forget to close it, its useful to have the software firewall as a backup.
I also turn the built-in Windows firewall off. This is actually recommended by Microsoft and other vendors, ie. run only one software Firewall at a time.
They are redundant, but the Windows Firewall can still be useful - for example if your child's computer gets infected and attacks other systems on the LAN, it won't be able to get past the Windows firewall. If you have a docked laptop, it is often convenient to leave the firewall enabled even while on the LAN so that you won't forget to re-enable it when the laptop travels.
In most cases at home, whatever router you are behind is perfectly acceptable to protect you and your PC's from any sort of intrusion, especially if remote management is turned off. What you need to look out for is applications which might open ports in your router using UPnP. This is not generally bad, depending on how paranoid you are.
Windows Firewall, on the other hand, is not exactly redundant. All your router does is put your computer on a private network, with a different IP address than your publicly facing one, and when desired, forwards connections on specific ports to your machine on the private network. Windows firewall can protect and notify you about outgoing connections your machine attempts to initiate, as well as provide an additional layer of protection against incoming connections you did not explicitly allow.