Author Topic: Best free firewall for Windows? (Read 428,557 times)

f0dder · « **Reply #225 on:** October 25, 2009, 07:10 AM »

Tuxman: saying that there's no "firewall for windows" is nonsense - but I do agree that running outgoing traffic blocking on the machine you're trying to firewall is pretty much useless.

Tuxman · « **Reply #226 on:** October 25, 2009, 12:45 PM »

What do you think a "firewall for Windows" is then?

f0dder · « **Reply #227 on:** October 25, 2009, 01:05 PM »

Gee, dunno - ISA / ForeFront?

Also, while I haven't used PFWs for many years because I don't really believe in blocking outgoing traffic, they should be just fine for actually blocking based on ports (as long as it's a non-retarded PFW and you're not running under an admin account). And, while possible to subvert to some extent, PFWs have an advantage over external FWs in that connections can be linked to applications... whereas an external FW will always let outoing port80 traffic through, and doesn't care that it's being done from RogueApp.exe. (Of course RogueApp.exe can try to inject itself into iexplore.exe and there's various tricks and nasty things that can be done, so it's not 100% failsafe...)

If you really want it locked down, you're going to combine border gateway firewall (with SPI) with per-machine PFWs.

Tuxman · « **Reply #228 on:** October 25, 2009, 01:07 PM »

A PFW is not a firewall. A firewall is p.d. a system that protects your network from outside.
But you can surely tell me what would be the use of it?

f0dder · « **Reply #229 on:** October 25, 2009, 01:10 PM »

PFWs do filter incoming data too, so they are firewalls. And gateway firewalls very often block outgoing traffic as well (for whatever reason; my school has a pretty restrictive policy and only allows a few things like ftp, http, ssh, svn outgoing - probably based on port numbers rather than SPI, though).

As I've already said, I'm not much of a believer in blocking outgoing traffic for most people, since the damage is already done if you've got malware on your system. It does add an extra level of defense against getting your data leaked, though, and that can be valuable.

Tuxman · « **Reply #230 on:** October 25, 2009, 02:17 PM »

Quote from: f0dder on October 25, 2009, 01:10 PM

PFWs do filter incoming data too, so they are firewalls.

That's not the point of a firewall.

And a PFW can't filter incoming data, as it runs on the system you actually want to protect. Any packet from outside can reach your computer before the PFW actually notices it, right?

Bamse · « **Reply #231 on:** October 25, 2009, 02:25 PM »

Or preventing damage from being done f0dder. Think Rapidshare, p2p, illegal software - some of incomings can be tricky to deal with. Like wanting to "phone home", check serial numbers and such. For this "firewall" can be useful and that is also a reason they are regarded as a "must" by some

I would estimate 50/50 between that usergroup and the extremely cautious/paranoid/interested one. Kind of funny? Not all who are into illegal stuff trust keygen.exe. I almost don't use such things any more, but when I did arming computer with "firewall" was considered common sense among those who did not just click, click.

Had to mention that since it is important

Tuxman · « **Reply #232 on:** October 25, 2009, 02:27 PM »

Quote from: Bamse on October 25, 2009, 02:25 PM

Think Rapidshare, p2p, illegal software - some of incomings can be tricky to deal with. Like wanting to "phone home", check serial numbers and such.

Seriously: If you tend to install software from suspicious sources, not even a firewall of any kind can prevent you from serious damage.

Bamse · « **Reply #233 on:** October 25, 2009, 02:41 PM »

Not a subject to dive into I think but how do you evaluate software around here? In sandboxes, VMs, research, Sysinternals magic tools spitting out graphs and relations, thinking og wondering and so on right? Same goes for illegal software, if done right - and if even possible to avoid risk that way. Not saying it is but those who are careful have same reservations like you. Majority just click and why infections breed like rats. Hopeless, could start with an exe-file allowing to run whatever security suite to get "safe"

Simple application blocking is only part of this type of "security" but pretty sure most consider it a must.

Tuxman · « **Reply #234 on:** October 25, 2009, 02:49 PM »

Quote from: Bamse on October 25, 2009, 02:41 PM

Same goes for illegal software, if done right - and if even possible to avoid risk that way.

Why should anyone try illegal software at all?

Lashiec · « **Reply #235 on:** October 25, 2009, 02:57 PM »

Quote from: kartal on October 24, 2009, 01:51 AM

Lashiec I hope you are not making fun of me by offering WF as asolution, because I said that my budget is tight this year. I see no shame involved with being under funded nowadays.

Making fun of you? Absolutely not. I just recommended what I feel is an excellent firewall, since it's what I use, I have not been infected while using it and its usability is quite above anything other firewalls offer. It just happens to be included with Windows, thus being free, hence my "It totally fits your budget" comment. My apologies if I offended you.

f0dder · « **Reply #236 on:** October 25, 2009, 03:10 PM »

Quote from: Tuxman on October 25, 2009, 02:17 PM

Quote from: f0dder on October 25, 2009, 01:10 PM
PFWs do filter incoming data too, so they are firewalls.
That's not the point of a firewall.

And a PFW can't filter incoming data, as it runs on the system you actually want to protect. Any packet from outside can reach your computer before the PFW actually notices it, right?

The point of a firewall is protecting machine(s) from network-based attacks, and PFWs (and Windows' builtin firewall) do that just fine - as long as the TCP/IP stack isn't seriously flawed, it doesn't matter much if you drop packets at the gateway or the individual machines, really. The focus is not exposing ports you don't want exposed, and possibly some SPI as well. Also, keep in mind that a gateway firewall only protects against WAN-originating attacks, not LAN-originating... even with a powerful gateway firewall with SPI and whatnot, I'd still be running Windows firewall (or iptables/ipfw/whateveryourOSofchoicehas) on the client machines.

Quote from: Bamse on October 25, 2009, 02:25 PM

Not all who are into illegal stuff trust keygen.exe. I almost don't use such things any more, but when I did arming computer with "firewall" was considered common sense among those who did not just click, click.

If you don't trust keygen.exe, you're a moron for running it on your machine - a VM beats outgoing filtering any time any day.

Quote from: Tuxman on October 25, 2009, 02:49 PM

Quote from: Bamse on October 25, 2009, 02:41 PM
Same goes for illegal software, if done right - and if even possible to avoid risk that way.
Why should anyone try illegal software at all?

Not everybody is stinking rich or idealist.

Bamse · « **Reply #237 on:** October 25, 2009, 03:13 PM »

The cool stuff is typically expensive Tuxman. Games, Adobe, MS. Fast internet make it easy. Most do not know much about free or fairly priced alternatives either. Most do not think more of software industry than music/film industry. Everything goes territory, no feeling of harming anyone = easy to justify. Irresponsible youth? There must be some sociological books about this you can read

Fact is it is very common. I know some people who have no idea of p2p, but they do have illegal Windows, Office etc. Got it from the guy they bought computer from. Office is even on a dvd. 1 download can spread out.

There are different levels of trust f0dder, we are talking of how likely it is X cause problems. To not use it at all is safe but alternative is not necessarily to go click, click - ooops, I never saw that coming!

Tuxman · « **Reply #238 on:** October 25, 2009, 03:26 PM »

Quote from: f0dder on October 25, 2009, 03:10 PM

Not everybody is stinking rich or idealist.

Most "pirated" software is something you don't need. You see, people say "hm, I want to edit my holiday pictures, so I'll pirate Photoshop". You use three or four editing functions, nothing else. So why the hell do you want to pirate it? Because you can? Come on...

The same applies to other apps. Can you tell me one application which is urgently important for you and too expensive to buy?

Quote from: Bamse on October 25, 2009, 03:13 PM

The cool stuff is typically expensive Tuxman. Games, Adobe, MS.

Adobe is not cool, Adobe is bloated crap. I don't know any home user who really needs their stuff.
MS? 100 bucks, not really much, is it?
Games? Which kind of games costs too much for you?

Quote from: Bamse on October 25, 2009, 03:13 PM

Most do not know much about free or fairly priced alternatives either.

Of course they do, it's just that they don't want to use them. It's more "cool" to say "lol I own Photoshop y00!" instead of "hi I use GIMP" or something. However, I can't get it why anyone has to pirate these apps. I am a proud Open Source and Freeware user and even own some legally bought licenses for a couple of applications (I even spent some money for the Vim developer).

f0dder · « **Reply #239 on:** October 25, 2009, 03:33 PM »

Let's get the focus back on firewalls, shall we? The software-pricing-whatever thing might be an interesting discussion, but it's pretty OT... and it's been done a zillion times before, anyway.

Bamse · « **Reply #240 on:** October 25, 2009, 03:41 PM »

Yes but there is a big difference between actual need and what not so informed people want and dont forget - are told to use Tuxman. Photoshop is highly recommended for resizing pics, Dreamweaver is the one to use for webbuilding. How it has been for years. Accelerates unless circle is broken. General level of know-how is not as high as you think, reasons are many though.

Tuxman · « **Reply #241 on:** October 25, 2009, 03:48 PM »

Quote from: Bamse on October 25, 2009, 03:41 PM

Photoshop is highly recommended for resizing pics

WTF? For resizing?!
OK, that was new to me.

Break a fly on the wheel, eh? Like using Word for keeping notes...

Alright, back to topic.

Innuendo · « **Reply #242 on:** October 25, 2009, 03:50 PM »

In an effort to get things back on topic....

Quote from: f0dder

If you really want it locked down, you're going to combine border gateway firewall (with SPI) with per-machine PFWs.

A layered defense is always the best defense. Having a gateway firewall (whether it be an appliance or a computer) is the single most important thing you can do to protect your network. Any software one installs on the PCs behind that firewall (firewall software, anti-malware, etc.) is mostly to address the human element of computing which includes, but is not limited to, human error clicking on something one is not supposed to, someone bringing software in contact with the network via a source that does not go through your gateway firewall (DVDs, flash drives, that cool game or app a friend gave them that phones home data you'd rather it didn't, etc.).

If you are a smart cookie & are the only one who uses the computers at your location then a lot of security measures are optional. In my situation, however, I have numerous computers in my home & when out-of-town relatives visit they use the PCs and aren't always as safe when surfing as I am. Compound this by the fact that some of those visitors are under 18. Who knows what all they click on....but so far my chosen security measures have kept the PCs on my network safe.

None of this is directed towards you, f0dder. I know you know this stuff, but your post was a perfect point to springboard this thread back in the proper direction.

Bamse · « **Reply #243 on:** October 30, 2009, 09:16 PM »

You failed with that effort

Why no one mention Privatefirewall? Is free for private and business use though not listed at such by Matousec site. http://www.privacyware.com/personal_firewall.html program as ugly as website, but I think only firewall I have tried where I did not notice it was running. HIPS stuff dont work with 64bit but some might just want a good old firewall.

tomos · « **Reply #244 on:** October 30, 2009, 11:00 PM »

Quote from: Bamse on October 30, 2009, 09:16 PM

You failed with that effort

what's eating you

Bamse · « **Reply #245 on:** October 30, 2009, 11:39 PM »

Is there a point to your post?

tomos · « **Reply #246 on:** October 31, 2009, 12:02 AM »

Quote from: Bamse on October 30, 2009, 11:39 PM

Is there a point to your post?

yes

I think I've made it already but in case you didnt understand it:
the point is that your response (to Innuendo) was bitchy & I was wondering why

Bamse · « **Reply #247 on:** October 31, 2009, 01:39 AM »

You are wrong Mrs. If you turn down sensitivity level a tad you will see and get over it. Regardless, this thread is about firewall not your concerns for other members well being.

Curt · « **Reply #248 on:** October 31, 2009, 10:58 AM »

Quote from: jgpaiva on October 03, 2009, 05:50 PM

Quote from: 40hz on October 03, 2009, 05:39 PM
Quote from: Curt on October 03, 2009, 03:13 PM
- oops, SORRY, 40Hz! I was not aware how bad my wording came out. Not intended!
Sorry I misunderstood you. My apologies in return.
Thanks guys..
* jgpaiva loves DC spirit

ohh... only now I realize this is another thread! Sorry!

sajman99 · « **Reply #249 on:** November 09, 2009, 06:38 PM »

FWIW I'm really liking Online Armor's new pricing structure with $19.95 for a single user license for OA Premium.