Similar to these questions:
What Firewall Rules Should Be Used For A Home-Based System and
Firewall on VPS Use Windows Built In
But more specifically I'm guessing that using both the Windows Firewall and a router's built in firewall are redundant? Which is generally considered the better option for general computer/internet use?(For an example, I personally have a D-Link Router) What would you recommend to non-tech savvy folk?

4 Answers 4


I have always heard that a router/hardware firewall is better than a software firewall. And yes they are redundant. But one thing you will hear a lot from security people is the phrase "defense in depth".

So even though they are redundant, you may find that doubling up on a firewall probably won't hurt and it is nice to have a backup just in case.


Be aware that in Windows XP the built-in firewall (Windows Firewall) provides inbound protection only. A program running on your computer that attempts to access the internet will not be stopped or checked by the built-in Windows Firewall.

On Vista I believe the built-in firewall does do outbound checking, but it is disabled by default. Why this is, I can only guess.

The key security benefit my router provides is Network Address Translation (NAT). As others have said, this translates my external (ISP assigned) ip address to an internal private IP address. I could be wrong but this is what I mean when I talk about a hardware firewall.

So, on XP, I use the router (hardware) firewall and run another software firewall to provide an extra level of inbound protection, as well as much needed outbound protection.

As I'm sure you know, a router can be configured to open various ports. The software firewall will also watch for inbound access through any opened ports. So, for example, if you open a temporary port but then forget to close it, its useful to have the software firewall as a backup.

I also turn the built-in Windows firewall off. This is actually recommended by Microsoft and other vendors, ie. run only one software Firewall at a time.


They are redundant, but the Windows Firewall can still be useful - for example if your child's computer gets infected and attacks other systems on the LAN, it won't be able to get past the Windows firewall. If you have a docked laptop, it is often convenient to leave the firewall enabled even while on the LAN so that you won't forget to re-enable it when the laptop travels.


In most cases at home, whatever router you are behind is perfectly acceptable to protect you and your PC's from any sort of intrusion, especially if remote management is turned off. What you need to look out for is applications which might open ports in your router using UPnP. This is not generally bad, depending on how paranoid you are.

Windows Firewall, on the other hand, is not exactly redundant. All your router does is put your computer on a private network, with a different IP address than your publicly facing one, and when desired, forwards connections on specific ports to your machine on the private network. Windows firewall can protect and notify you about outgoing connections your machine attempts to initiate, as well as provide an additional layer of protection against incoming connections you did not explicitly allow.

  • The Windows Firewall in XP does not provide any sort of protection for outbound connections. The Vista version does support outbound protection, but it was disabled by default and needs to be enabled (may have changed recently).
    – Ash
    May 14, 2009 at 2:15
  • Generally you don't need outbound protection NEARLY as much as you do inbound protection anyway.
    – Mark Allen
    May 14, 2009 at 5:52
  • @Mark while it's true that outboud is not as needed as inbound there is always the chance you've already foobared your PC and now need to block outbound stuff too!
    – Tim Meers
    Mar 5, 2010 at 17:17
  • 1
    @Tim Meers: I said Nearly. :) Also, I like the Windows Firewall in addition to the router because my wife and children aren't always as careful as I am, so if they cause their machines to become infected, my PC is still protected. So I like having both. Back in the old days I would run BlackICE, which rocked.
    – Mark Allen
    Mar 8, 2010 at 22:24

Not the answer you're looking for? Browse other questions tagged .