Main Area and Open Discussion > General Software Discussion

common router firewall outbound settings?

(1/3) > >>

nudone:
(this is more of a hardware question, but as i'm trying to avoid 'software' firewalls i've posted it in this section.)

i've spent today removing and installing several firewalls. they are the free versions recommended everywhere. none work perfectly on my system it seems. so, i wish to abandon them completely and stop wasting time hoping they'll work correctly.

right. i have an adsl router. it has a firewall built in. brilliant. well, it would be if i had the slightest idea of what to put into the outbound rules - at the moment it's set to let everything out. kind of pointless isn't it. i've seen plenty of complaints about the windows inbuilt firewall letting everything out, but i get the impression that's exactly what all the adsl router firewalls are doing around the world too.

so, is there a list of common settings to allow through such a router firewall - settings that will cover the usual programs that are run on an xp machine?

it looks like i'm going to have to specify exact ports or port ranges (and tcp and udp). how on earth am i supposed to know that - just what is the point of having a firewall built into a router when there's no way of knowing what to put into it.

okay, i'm sure there will be information for certain apps i can find, but what about all those mysterious 'svchost' things and all that rubbish. suddenly i've just realised how absolutely pathetic internet security is.

anyway, if there is a list of common settings to use then i'll be very grateful if you let me know. thanks.

tinjaw:
It is the thing that should be covered in a longer article and not a reply posting, but I'll summarize now and can maybe do a follow up piece later.

Firewalls no longer serve the purpose they once did. The used to be useful because:
 1) They blocked sockets connecting from the outside in to your computer. - This used to be a problem because software developers didn't plan for computers being exposed to hostile network traffic. Now days, they have mostly taken this into consideration and no longer open they door unless they are expecting somebody. So firewalls no longer need to stop them from reaching the door.
 2) They blocked malicious software from getting from the inside out. - Malicious software developers assumed that you would let anybody leave that wanted to. So they would freely connect to other computers and do bad things. (see 1 above) So firewalls started blocking things from getting out unless you let them. But then these malicious software developers countered by searching you computers to find out how you get out to surf the net and download your email, and they now pretend to be those types of software and so firewalls let them out.

So firewalls don't really do much these days except allow you to easily illuminate some of the malicious traffic.

If you want to make this easier to handle, set up a SOCKS 5 proxy, put everything you do through it and only let the proxy speak directly to the Net. Then all you need to do is configure the firewall to let only traffic from the proxy out, and only let in the traffic that they proxy has requested.

And that is about it for firewalls. However, these days, firewalls are only a small part of the picture. You need to have a strong HIPS running on each host. And that is the subject best left for another post.

f0dder:
I stopped using personal firewalls a while ago - they were too much bother compared to the security they give, and there's ways to penetrate their outbound filtering as well.

Don't get me wrong, it's nice to catch apps that phone home, it's nice to have cryptographic hashing to check that an executable that you've allowed outbound access haven't changed, etc... but that just wasn't worth it for me.

Instead, I rely on my router. Not even on firewalling in there, but simply NAT and port forwarding (which can be seen as a form of firewall, I guess). I think the only static rule I have is forwarding of the IDENT port, and uPNP for things like µTorrent, MSN, etc.

While I wouldn't enable uPNP at a company, it'ss quite fine for home use, and makes things a lot less painful. Really. On a home network, if malware gets a chance to run, you're pretty much dead and the ability of malware to do some port mapping is without consequence. Which leads me to...

Outbound filtering on a home network is also pretty useless, as nothing stops a piece of malware from using port 80 (ie, HTTP) for it's malicious deeds. If you want effective outbound filtering, you need protocol filtering as well, ports by itself doesn't help much.

I do have Windows Firewall turned on, though - to avoid the scenario where a friend visits me with an infected laptop.

So, to summarize my setup: by default, all outgoing ports are allowed, and all incoming ports are silently dropped. A few ports have static mappings, and uPNP is turned on to allow dynamic mappings. No firewalling except the most basic windows firewall. Good antivirus to keep malware from running (I like KAV, since it also does some behavioral blocking beyond the traditional antivirus heuristics).

nudone:
thanks, tinjaw and f0dder.

i've just woken up this morning and the first thought that popped into my head was how will my router firewall know which programs are good or bad if all it does it use port numbers in the rules. well, obviously, like you've said - it won't.

my current setup is almost identical to what you've have running, f0dder. the firewall has a few rules for specific incoming ports (utorrent, emule) and absolutely everything is allowed out. also, the xp firewall is running and i've gone for that aol (kaspersky) free firewall to look after the virus side of things.

i'm not sure if i'm happy with this or not. it was reassuring to see the popups from zone alarm for out going requests but i guess most of (if not all of it) was from harmless apps just wanting to call home.

i shall try and learn to accept this current situation rather than keep installing firewalls in the hope that they are stable enough for my system.

tinjaw, when you have time, it will be nice to hear what you were going to say about HIPS. i did install comodo firewall as this is something it is renowned for - but it always seems to crash after a few hours use (i've tried twice on two separate installs of xp so i've given up with it).

i thought there would be a simple piece of software out there that does this HIPS thing and little else. i'm not really interested in defining port numbers and tcp/udp. i just want to be able to say yes/no to "can this program access the outside world". that seems like a simple thing to expect to me and i'd have thought it a simple thing to implement, i.e. monitor util watches open programs for attempts to connect and lets them through or blocks them completely. how hard is that.

i obviously don't understand the complexity of what's involved (can't autohotkey do this kind of thing  :D ).

f0dder:
i've just woken up this morning and the first thought that popped into my head was how will my router firewall know which programs are good or bad if all it does it use port numbers in the rules. well, obviously, like you've said - it won't.
-nudone
--- End quote ---
Unless you spend a decent amount of cash and get something that filters by content rather than just ports... but that costs, and isn't really necessary for a home network IMHO.

Btw, uTorrent supports UPNP, so you don't need a static mapping for that - but okay, some people feel UPNP is über-insecure and evil, etc... :)

it was reassuring to see the popups from zone alarm for out going requests but i guess most of (if not all of it) was from harmless apps just wanting to call home.
-nudone
--- End quote ---
And that's basically all you were going to see - at least last time I looked, the PFW leak tests weren't very uplifting. Okay, while PFW wouldn't stop intentional data smuggling they still make it harder to use your box to directly infect other boxes on the net (since that requires specific ports), but IMHO it's more important focusing on not getting malware on your computer than trying to stop it from spreading :)

I do miss the "hey, this app is trying to phone home!" false sense of security, but I don't miss PFW popping up while starting a game, which turns out to be badly coded and unable to handle being switched out of :)

I also don't miss how some PFWs seem unable to handle a massive amount of connections (ie., torrents or other p2p traffic). Nvidia's NAM for their NForce chipset is renowned for BSODs and memory leaks.

Navigation

[0] Message Index

[#] Next page