Routers using NAT, software firewalls behind them.....

Post by **YeOldeStonecat** » Tue May 01, 2001 8:27 am

I'm sure peeps using Tiny or ZA, etc, on a stand alone computer straight connected to their Cable/DSL modem get tons of reports of probes, pings, etc.

But say you're behind a router using NAT, somebody here has to still be using a software firewall in addition, so is it picking up much activity?

I'm just curious how safe the boxes are behind a NAT router. I bind NetBEUI to networking, and unbind TCP/IP to networking.

Post by **YeOldeStonecat** » Tue May 01, 2001 6:16 pm

Thanks for that info Ken. Cool sig BTW, pretty funny.

I'm mostly looking at how useful software firewalls are in addition to all the basic NAT routers out there for broad bandwidth, such as the Linksys, NetGear, Netopia, etc.

I'm just guessing experienced hackers, since it's such an exploading problems, can easily hack through a Linksys or comparable router into a network. Or if you have some ports open in the NAT, such as for a public game server, or PcAnywhere, upper end ports like those.

cyberskye · Post by **cyberskye** » Tue May 01, 2001 6:44 pm

I agree with Fredra - the software firewall should be focused on the outbound traffic. NAT is great. Defeating it requires a hell'o'sophistication'n'timing or trojan infiltration (which having an outbound filter can help mitigate). Both is DEFINITELY the best answer.

PS - you are right about providing services to the net. This should be done carefully and only forward those ports when the service is required - and only for that long. Given enough time and resources, nothing connected is totally secure...

Cheers

[ 05-01-2001: Message edited by: cyberskye ]

64bit · Post by **64bit** » Tue May 01, 2001 8:15 pm

I run the linky and sysgate PF and use to run ZoneAlarm. I rarely see anything in the Security Logs at all. If I do see anything it is usually like ICMP time exceeded and that garbage from my ISP(AT&T rr). By the way I love sysgate much more than ZA. To me the 2 just don't compare.

Dakota · Post by **Dakota** » Wed May 02, 2001 12:26 am

As a router-newbie I agree with fredra. I get zero hits on ZA since installing it (RT314) and DrTCP's filters. I also show up total STEALTH on GRC.com.

I only use ZA for controlling outbound traffic and I'm about to the point where I'm going to shut it off and just do spot checks for calling-home software.

fredra · Post by **fredra** » Wed May 02, 2001 12:33 am

Hi Yeold
I am using a hardware firewall and Tiny.

It depends on the hardware firewall, if it is using "packet Identification" or "Nat".

Tiny for me is there to pick up "outgoing" only, as most NAT's the hardware only does "incoming".

So it is likely that you will not see any action from your software firewall (assuming nothing is calling home)....lol

If you are using automatic updates, you have to tell the software firewall to let it through...e.g. InoculateIT. In the case of Tiny, you have to create a rule to allow that action, as it is considered "outgoing".

One of the moderators (KEN) is not here at the moment, however, when he returns, you can get a lot more information from him, as he has researched this combination and has numerous links.

Also others in here may also supply you with their feedback.

Hope that helps to address your question.

Croc · Post by **Croc** » Wed May 02, 2001 12:44 am

Checking for outbound traffic is important, particularly if you do collect bits and pieces from disks and load them.
Using the firewall this way will also tell you if any update manager is trying to get out.
It depends on your 1 to 10 level of paranoia. Mine is set at 11.

And I am going to agree with 64bit about Sygate. It seems to handle everything well.
That's hard for me to say after being involved with ZA for so long. Where is Storm90??

Dakota · Post by **Dakota** » Wed May 02, 2001 2:36 am

Originally posted by TheCroc:
It depends on your 1 to 10 level of paranoia. Mine is set at 11.

ROFL! Good point. I went to turn it off tonight and knew I'd be just there thinking what was going on the whole time if I did turn it off.

So...it's on.

LinkLogger · Post by **LinkLogger** » Wed May 02, 2001 3:07 am

I use logging software with my Linksys. It shows me not only what is blocked by my Linksys, but what traffic is outbound as well and from what machine, etc. Alerts, Alarms, traffic history (both IP and Port), usage charts and reports, etc (Link Logger from [url=http://www.linklogger.com).]http://www.linklogger.com).[/url]

One of the best things about using the logging software is I can watch my whole network from one machine rather then installing ZA on each machine.

Blake

fredra · Post by **fredra** » Wed May 02, 2001 8:56 am

Hey Croc
I agree...where is Storm!!!!!!!!!!!
STORM...pls join in this thread and supply your expertise....

Post by **YeOldeStonecat** » Wed May 02, 2001 4:11 pm

Appreciate everyone's input.

Still laughing at Fredra's sig!

Cat

fredra · Post by **fredra** » Wed May 02, 2001 7:16 pm

Hi yeold
LOL....thanks, but I got it from Norm, a regular in these forums. The mascots name is Phil....glad you like it....hehehehehehe

Croc · Post by **Croc** » Thu May 03, 2001 7:20 am

Linklogger.... Does your linklogger block outgoings until you, as your system's administrator give the ok

Post by **YeOldeStonecat** » Thu May 03, 2001 8:01 am

That LinkLogger looks pretty good...seems to just give reports of what's going on. Good for the at home user. I'm looking for something more for my smaller clients that I've setup their office LAN on a Linksys or NetGear router. Talking about LANs of 3,4,6,10..computers...have a couple of networks exceeding 20.

Brought up the software firewall question initially wondering if anything extra was deemed necessary on top of the routers NAT for security. I'm taking it something like Tiny or ZA gets applied to each and every computer? Or perhaps only needed on the computers with file and print sharing enabled? The NT servers? I just hate to pop a software firewall on the NT server then have the networked app not work, or exchange server start failing.

Anyone have experience with other mid range routers that would provide better protection from the outside world hackers than say a Linksys.

I've never had to deal with the security of a network before, I'm a peer to peer/small to mid NT Domain person, not really up on routers and firewalls, although now's sure the time to learn. Just with all this hacking junk getting to be so ever present and a daily thing, I'm wondering how safe my current networks are behind just a Linksys, what to do to them, and how to build future ones better.

The learning curve never stops!

LinkLogger · Post by **LinkLogger** » Thu May 03, 2001 11:32 am

Link Logger doesn't block traffic, but it does let you know about suspicious traffic (including in/out and traffic blocked at the Linksys) and gives you the ability to quickly analyze it. Link Logger watches over 425 known trojan or other attack ports and can raise various levels of alerts and since Link Logger logs all traffic through the Router and stores it in real time, you can retrieve historical traffic to/from an IP address, or a port, or over a date range in order to determine the true nature of the traffic your seeing. Link Logger also has a number of usage reports and graphs that allow you to understand how your system is being used (both as a whole and on a system by system basis, including common destinations, usage times, attacks, etc). You can also set user configurable alarms within Link Logger which allow you to know the instant that traffic occurs over some port or to/from some IP address, so you can see what system, user, or application is causing said traffic.

Link Logger has more features then I have mention here. It is marketed as shareware ($21.95) and offers a free fully functional thirty-day trial. You can download Link Logger at http://www.linklogger.com and it works with all Linksys EtherFast Cable / DSL Routers (given the later firmware versions).

Blake

Post by **YeOldeStonecat** » Fri May 04, 2001 6:43 am

Wonder is there is a similar product to LinkLogger that will work on other routers, like a Netopia R910.