[Mijzelf]

 

Quote

If you go to page 70 of the 6100's guide, you'll find a screenshot of the general firewall settings. It matches exactly the screen that I got when I clicked on the Westell menu to access the firewall settings. I was surprised to see that the default (and current) value is "No Security," because all of my PC's did well on the Gibson tests (except for the ping test). Could that be the computers' software firewalls in action?

No, it's the nature of a NAT router. An open port is a port where some service is running, on which can be connected. The router doesn't run any services on the outside, so all ports are closed. And because it costs less CPU power to ignore the 'knocking on the door' than yelling 'nobody home', the closed ports are stealth too.

When you want an open port, you'll have to forward it manually in the router's setup (or use uPnP, but that's another story), to point to a service which is running on one of your computers.

Because the NAT router already blocks all incoming traffic by nature, the purpose of a firewall on a NAT router is limited. The following options could be implemented:

- Detect a portscan and close all open ports temporary

- Block outgoing traffic to certain ip-addresses/URL's

- Block ingoing traffic to open ports from certain ip-addresses

- Deep packet inspection to filter active-X components and stuff like that

- ...

Quote

On the other hand, since the software firewalls are already in place, one could say that there's very little additional time and effort involved in keeping them running. So isn't it possible that the question boils down to whether you want to dedicate resources on a Win98 machine to a firewall?

A good firewall hardly uses any resources (as long as it doesn't do deep packet inspections) compared to antivirus software, and can provide you a lot of information about which processes are talking to whom. So it can be useful to keep a software firewall running.

Quote

One last thing (for now, anyway). I assume that none of this affects the wisdom of running antivirus/antimalware applications, as opposed to a firewall?

Indeed. It are unrelated areas.
 

This post has been edited by Mijzelf: 06 June 2010 - 06:01 AM

[herbalist]

Hardware and software firewalls serve different but overlapping purposes. Hardware firewalls block inbound from the entire network behind them. They block or allow traffic on a per PC basis. Being separate from the PC, they're not vulnerable to infections of that PC (as long as UPnP is disabled). But as a result of being separate, hardware firewalls are not application aware. They can't tell if it's your browser or a trojan that's connecting out.

Software firewalls control traffic in and out of individual PCs. On networks with more than one PC behind a router or hardware firewall, a software firewall can prevent one compromised PC from infecting another on the same network. Software firewalls are application aware and can block or restrict traffic from one application while allowing another to connect out freely. That makes a software firewall useful as a parental or employee control tool. Kerio 2 for instance lets you makes time sensitive rules, such as blocking the browsers access after 11:00PM while allowing updaters to work normally. I've done that for a few clients. Now their kids won't talk to me! That same software firewall stopped their P2P program from working. An installed software firewall gives you flexibility not possible with hardware firewalls.

Quote

As I predicted, firewall advocates ultimately fall back to the idea that firewalls are useful (perhaps more useful) for control vs security.

I have to disagree with that statement. Control and security are directly connected. A secure system is one you control. A compromised system is one someone else controls. That's the goal of most malware, to take partial or full control of your system. A software firewall controls the communication channel the malware would have to use. Only a small percentage of PCs are compromised by unsolicited inbound traffic. Most are compromised by the users, willingly or otherwise. It doesn't matter how good or careful you are. Unless you have 100% control over all who use that PC, friends, family, kids, and can guarantee that all of them will use the same level of care, things will happen.

Other factors also need to be considered.

• AV support is all but done for 9X systems. We no longer have a semi-reliable way to detect malicious code in real time, not that they were very good at it to begin with. The conventional approach to security is not available to 9X users any more. This gives us 2 choices, default-deny, or trusting that 9X usn't popular enough to be targeted. IMO, the 2nd is not an option. It's trusting in blind luck.
  
• Kernel EX is making it possible to run more "modern" software on 9X systems. It's also likely that it is also making it possible for more malicious code to work as well. By making 9X more functional, we may be making it more vulnerable. This is uncharted territory for 9X that needs to be explored, or at the very least, to remain aware of the possibility.
  
• Legitimate sites get hacked and serve up malware. Financial institutions, facebook ads, etc. You don't have to go looking for it. The internet is much more dangerous than it ever has been before. Even the DNS system has proven to be vulnerable. There's no guarantee that where you want to go is where you'll end up. IMO, all of the web has to be treated as untrusted and potentially hostile. The common sense approach of "don't visit dangerous sites" isn't sufficient.
  
• The "enemy" has changed. It's not script kiddies any more. It's professional coders and thieves. Their agendas have changed. Instead of recognition or glory, it's profit and control. In todays political climate, it can even be your own government or authorities or those of another nation. It's not just your data or your desktop they want anymore. Often it's your PC to be used as a pawn in someone elses war.
  
• 98 itself might not be directly targeted as much as it used to be, but the applications running on it are, starting with PDFs and flash. If I remember correctly, Flash was used as the vector to target routers from the PC. Yes, it was fixed, but will you bet on it being a one time occurrence? Malware isn't strictly for 9X systems or NT systems. Much of it works on both. It's no different than any other user applications. I've got malware obtained from members here and elsewhere that behaves very much like a rootkit on a 9X system. It's one thing to claim that todays malware is written for NT systems. Who is even checking how much of it works on 9X, or with Kernel EX? Is anyone looking at all? IMO, that's an unverified assumption.

I'll never understand why some dismiss apps or a system "calling home" as a problem. Most trojans do this. Would you allow people you barely know to use you phone whenever they want to without asking you? How is this different, especially when you consider the personal info the app calling home has access to and the fact that you don't know what it's sending?

Resource usage is not an issue with a good software firewall. Even my old HP with a 366mhz Celeron experienced no slowdown with Kerio 2.1.5 and SSM. Yes, the combined security suites were resource hogs, but they were never designed for 9X systems to begin with. 9X compatibility was an afterthought. NIS for instance added over 90 seconds to the boot time of my old HP and reduced it's usable time to half of what it was without it. AVs are the real resource hogs, not firewalls.

Quote

Configuring firewall rules is usually a painful process, completely worthless in my opinion.

Can't agree. There is something of a learning curve involved but that same knowledge gained will also help with configuring hardware firewalls, setting up home networks, etc. Once the basics are learned, it's not that hard. We're working with an unsupported OS, which means we have to provide our own support. To one degree or another, all of it is a bit of a pain, whether it's fixing compatibility issues or testing newly found vulnerabilities. Learning the basics of the internet we want to use these 9X systems on should be part of that process. With firewall rules, when they're done, it's over. Unless you change your system, they don't change. Until recently, we've always had 2 options, pay someone to take care of our systems and security (system and AV updates) or do it ourselves. We now have one choice if we want to use 9X. If this place has proven anything, it's that we can make 9X better and safer than MS or any AV vendor ever has.

I agree with many of the suggestions, but not necessarily with the way they're implemented. Getting rid of the old software is important. I'd add IE6 to that list if your setup allows it. It's always been the biggest weakness in 9X. Instead of NoScript, I'd use Proxomitron which works with all browsers and is much more powerful (and has a much steeper learning curve). I suggest a security policy based on default-deny and enforced with the system policy editor or SSM, free version. For registry protection, no need for real time protection. A batch file running at bootup can give you a clean, optimized registry at each reboot. The link in my signature explains how to write your own.

The hosts file doesn't help much with protecting your system. It's not possible for them to keep up with malicious sites. They change way too fast. It is useful as a junk remover, such as the common ad sites, a lot of Google garbage, etc. It can also be useful for its intended purpose, a real address book for sites you need to be sure of, instead of relying on a potentially vulnerable DNS system.

[Tripredacus]

As noted, the Westell 6100F does not come with any firewall settings turned on. I am using this modem as well. I currently have it configured in Bridge Mode (like the old DSL Modems) and it is connected to a wireless router. No DHCP enabled (but WPA2) on either side, using static IPs and DNS Servers.

If you switch it to bridge mode, the light pattern will be different. You won't see an orange light anymore if you lose the network connection. Also, you will need to configure your router (or PC) to connect with the PPPoE settings in the modem. If you lose these you can get the numbers from support.

Basically what they did was make it so the modem could start the PPPoE handshake on its own instead of relying on a single computer to do it.

As far as OS requirements on networking hardware, with exception to IPv6 or other OS dependent technologies, the requirements are bound to two things only:
1. The software that comes with the product
2. The OSes that the technical support department will help you with.

[Tripredacus]

wsxedcrfv, on 07 June 2010 - 07:03 AM, said:

Tripredacus, on 06 June 2010 - 11:58 AM, said:

As noted, the Westell 6100F does not come with any firewall settings turned on. I am using this modem as well. I currently have it configured in Bridge Mode.

Please explain how that modem, when used in it's default configuration, will not be acting or performing as a NAT-router, and as such will be blocking all unsolicited in-bound packets, and therefore will be operating as a 100% effective in-bound firewall.

It depends on how the ISP configured it. Different ISPs or regions may configure the settings differently based on what kind of system it is going to be used on. Since mine is not in the default modes, I cannot say what all the settings were. I did know that the firewall was not turned on. These things are just 1 port routers, or mine only has 1 private side port. They did have DHCP enabled on it, however.

[JorgeA]

Mijzelf,

Thanks for all the information, I appreciate it. I'm still surprised to learn that I've had a (kind of a) router all along. This whole discussion has saved me the effort of researching a router purchase, and the expense of making it.

Would there be any purpose in changing the default setting as seen on page 70 of the Westell's manual, or is it better to leave it alone despite the fact that it says that is "No security"?

--JorgeA

[JorgeA]

wsxedcrfv,

Thanks very much for the detailed recommendations and procedure for replacing Java Runtime. I'll start implementing them. From this thread it looks like I'm already doing #7. I guess that #10 wouldn't apply to the Win98 machines (I haven't gotten into multibooting).

I've had Spybot on the Win98 tower for several years. The first thread I started on this forum had to do with Spybot crashing on that PC every time I did a manual scan. I still keep it for the two purposes you indicate, but may switch to SuperAntiSpyware because -- speaking of resource hogs -- Spybot is a really big one.

--JorgeA

[herbalist]

Quote

For those that religiously run a software firewall on their win-98 system(s) - not your dual-boot system(s) - your WINDOWS 98 system(s) - when was the last time, or how often did your firewall ever alert you to unauthorized out-bound activity that was ultimately traced back to a malicious process or program running on your system (ie - a virus, trojan or worm) ?

Except for systems I have set up for malware testing, I haven't had any type of infection on any OS in over 6 years. My PCs are all default-deny secured. Unless I specifically allow it, they are almost impossible to infect. On the 98 test unit, the firewall has alerted me to outbound traffic initiated by malware on 3 or 4 occasions. Each time it was missed by the AVs. The last time this happened was about a year ago. IMO, how often it happens is not the issue. If it happened even once, the firewall has earned its keep.

Quote

Memory management and system resources (heaps) are two areas where win-9x performs poorly compared to NT.
I'm sorry, but any background process that's running on my win-98 system(s) better have a dam good excuse for existing and it better perform an extremely useful and necessary function if it's always going to be running. Software firewalls simply don't quality. Period.

We're just not going to agree on this one. On any OS I use, the first thing I install is the firewall, then the rest of the security package. Except for test setups, all my Windows systems get the same security package, Kerio 2.1.5, SSM, and Proxomitron. I consider a security package necessary and have been using this one for the last 5 years. Security apps don't have to be heavy resource and memory loads. On mine, the combined package is using half of what the browser is with 2 open tabs on this forum. If you want to run your OS on the assumption that there's nothing left on the web to infect it, that's your choice. I won't take that risk, especially when there's no cost or performance loss for protecting it other than the initial setup time. Even though 98 itself isn't directly targeted anymore, the software running on it is, the browser, the media player, the PDF software, flash player, office software. Malicious code doesn't have to compromise the OS itself to be dangerous or costly.

Most of 98's resource problems come from apps that don't use them properly or have memory leaks. Internet Explorer is one of the worst for draining a system. If you choose apps that manage their system usage well, 98 will run stable for a long time without rebooting, even with several background apps. 98 might not manage resources and memory as well as an NT system, but you make it sound like it's outright fragile. Once I stopped running an AV and got rid of Internet Explorer, my usable time on 98 between reboots went from hours to days. The improvements developed on this forum have improved that even more. If 98 is too unstable to run a few background apps, there'd be no point in using it, let alone improving it. But as long as the user makes efficient use of memory and resources one of the primary considerations when choosing software, 98 will run pretty much whatever you want it to.

[Mijzelf]

JorgeA, on 07 June 2010 - 11:18 AM, said:

I'm still surprised to learn that I've had a (kind of a) router all along.

You can skip that 'kind of'. A router is a router.

Quote

Would there be any purpose in changing the default setting as seen on page 70 of the Westell's manual, or is it better to leave it alone despite the fact that it says that is "No security"?

When you only do some surfing it's hardly useful to have a hardware firewall. As soon as you start exposing some services (by portforwarding) to the internet a portscan detector could be useful, but I don't know if it's provided. I found that manual for you, but I didn't want to register to be able to download it. So I don't know which functionality the firewall has.

I never bothered to configure the firewall in my router. I just trust my exposed services to be bullet-proof.

[Mijzelf]

wsxedcrfv, on 08 June 2010 - 07:11 AM, said:

Please explain what sort of "fire-walling" a router can do above and beyond dropping unsolicited in-bound packets when it's running in NAT mode.

If a router is performing NAT on it's lan side, what extra do you get when you turn on it's security or it's "firewall" features?  (I'm specifically talking about these consumer-grade, ISP-provided combo modem-routers).

Mijzelf, on 06 June 2010 - 05:52 AM, said:

Because the NAT router already blocks all incoming traffic by nature, the purpose of a firewall on a NAT router is limited. The following options could be implemented:
- Detect a portscan and close all open ports temporary
- Block outgoing traffic to certain ip-addresses/URL's
- Block ingoing traffic to open ports from certain ip-addresses
- Deep packet inspection to filter active-X components and stuff like that
- ...

This post has been edited by Mijzelf: 08 June 2010 - 07:50 AM

[Mijzelf]

wsxedcrfv, on 08 June 2010 - 08:34 AM, said:

Does this particular modem, or any consumer-grade, ISP-provided modem/router, perform any of the above-listed functions?

Can't say anything about this particular box, as I haven't seen the manual and/or specs. And yes, I have had a ISP provided modem/router which supported (some of) these functions. That was a Copperjet 801 when I remember well. (BTW, it had a single UTP port, and the box was configured in bridge mode).

Quote

Even if these devices can detect a port-scan in real time, what good would that do?

Well, let's say I have forwarded some port, and the firewall detects a portscan, and closes all ports for a few minutes. Your service is unreachable for the same amount of time, but the scriptkiddie on the other site has not found your open port.

Quote

The default mode (I'm sure) for the typical ISP-supplied modem is (a) NAT = turned on and (B) no ports are forwarded. To me, that is equivalent to in-bound firewalling. The typical user isin't going to open any ports anyways.

When your typical user doesn't open any ports, he probably won't notice the extra firewall functionality. But I think lots of people *do* open ports. It is needed for many games and for torrents. Googling on 'port forwarding problems' gives 2,290,000 hits.

[JorgeA]

Mijzelf, on 08 June 2010 - 05:54 AM, said:

JorgeA, on 07 June 2010 - 11:18 AM, said:

I'm still surprised to learn that I've had a (kind of a) router all along.

You can skip that 'kind of'. A router is a router.

Quote

Would there be any purpose in changing the default setting as seen on page 70 of the Westell's manual, or is it better to leave it alone despite the fact that it says that is "No security"?

When you only do some surfing it's hardly useful to have a hardware firewall. As soon as you start exposing some services (by portforwarding) to the internet a portscan detector could be useful, but I don't know if it's provided. I found that manual for you, but I didn't want to register to be able to download it. So I don't know which functionality the firewall has.

I never bothered to configure the firewall in my router. I just trust my exposed services to be bullet-proof.

Mijzelf,

I have uploaded a screenshot of that page 70 so that you can see the various possible settings. I tried to upload the top half of page 71, where the choices are explained, but that put me over the capacity limit, so here they are:

General Firewall Settings
Maximum Security (High)
High security level only allows basic Internet functionality. Only Mail, News, Web, FTP, and IPSEC are allowed. All other traffic is prohibited.
Typical Security (Medium)
Like High security, Medium security only allows basic Internet functionality by default. However, Medium security allows customization through NAT configuration so that you can enable the traffic that you want to pass.
Minimum Security (Low)
Low security setting will allow all traffic except for known attacks. With Low security, your ProLine is visible to other computers on the Internet.
No Security (None)
No Security (None) is ProLine’s factory default security setting.
Firewall is disabled. (All traffic is passed)
Custom Security (Custom)
Custom is a security option that allows you to edit the firewall configuration directly. Note: Only the most advanced users should try this.

O.K., so given what we know that the default "No Security" setting will do (that is, my PCs are already almost completely invisible), under what conditions would it be useful/necessary to change to a different setting?

Second question. Let me see if I got this right. Your exposed services can be bullet-proof even in the default setting, thanks to the level of protection that the router gives in that setting?

--JorgeA

Attached File(s)

•  Westell p70 Shot 2.pdf (185.52K)
  Number of downloads: 2
•  Westell p70 Shot 1.pdf (111.87K)
  Number of downloads: 6

[Mijzelf]

 This firewall seems pretty useless to me. High and Medium will block all outbound traffic, except the most basic services. You can surf the internet as long as the webpages are on default (http,https) ports, but for instance streaming video won't work.

Minimum is the same as No, except that is protects against 'known attacks', whatever that may be.

The only possibly useful option is Custom, depending on how configurable it is, but seeing the rest of the "firewall", I'm not very hopeful.

Quote

Second question. Let me see if I got this right. Your exposed services can be bullet-proof even in the default setting, thanks to the level of protection that the router gives in that setting?

Wrong. The services are bullet-proof because they are not vulnerable to attacks. Even if a hacker knows which services I run on which ports (which is partly not difficult to find, a simple portscan will show I'm running a webserver, the other services are using non-default ports), he can't do anything with it. 

For the weaker services I trust my router not to expose them, because I didn't forward any ports to them.

[JorgeA]

Mijzelf, on 08 June 2010 - 11:42 AM, said:

Quote

Second question. Let me see if I got this right. Your exposed services can be bullet-proof even in the default setting, thanks to the level of protection that the router gives in that setting?

Wrong. The services are bullet-proof because they are not vulnerable to attacks. Even if a hacker knows which services I run on which ports (which is partly not difficult to find, a simple portscan will show I'm running a webserver, the other services are using non-default ports), he can't do anything with it. 

For the weaker services I trust my router not to expose them, because I didn't forward any ports to them.

Mijzelf,

O.K., I see an opportunity to learn here.

Help me to understand. You wrote that your ports are not vulnerable to attack even if a hacker knows which services you're running on which ports. What function/application would it be, then, that is protecting your services, and wouldn't that be called the "firewall"? Maybe there is a distinction between the protection that a "router" offers, vs. the protection given by a "hardware firewall" -- am I getting closer to the mark?

Finally, and to go back to the question that started this thread -- in your view, and knowing everything we've discovered about this Westell 6100F, would I need another device in order to adequately protect the various PCs (including or especially the Win98 systems), or is the 6100F enough? And if another device is needed, would that be instead of the Westell, or in addition to it? Remember that I don't intend to network the various PCs to each other, necessarily.

Thanks again for sharing your knowledge.

--JorgeA