Text 12687, 94 rader
Skriven 2010-11-29 11:12:07 av Michiel van der Vlist (2:280/5555)
  Kommentar till text 12669 av mark lewis (1:3634/12.0)
Ärende: Firewalls and routers
=============================
Hello mark,

On Sunday November 28 2010 19:46, you wrote to me:

 MvdV>>> What is the point of a home router if the only thing connected
 MvdV>>> to it is that one computer?

 ml>> 1. perimeter firewall

 MvdV>> If a firewall is what you need, install a firewall. No need for
 MvdV>> a router.

 ml> multiple layers are better than one...

That depends. See my messages to Peter Knapper.

Even so, if you want multiple layes, it is not a must that one of those layers
is in a router.

 ml> the firewall is built into most routers or visa versa...

Windows XP and up comes with a firewall. In a single computer environment one
may as well use that one and dispense with the router..

 ml>> 2. egress protection

 MvdV>> In a single user environment a router does not provide egress
 MvdV>> protection.

 ml> maybe i meant ingress?

Why ask me? I am not clearvoyant. If you do not know what you meant, how should
I know?

 ml> unsolicited inbound connections is what i was thinking of...

A firewall does that. If a firewall is what you want, install a firewall. See
#1.

 ml>> 3. network address translation

 MvdV>> No need for that, in a single computer connection, NAT is just
 MvdV>> a hindrance, not a feature.

 ml> maybe for you it is a hindrance but not for many that use this very
 ml> setup ;)

Most people who use NAT, take it for granted because that is the way most SOHO
routers work and all they ever see are SOHO routers. NAT is a kludge to let
more than one device share a public IP address. When configured that way, it
has the side effect of dropping unsollicited incoming packets for the simple
reason that it does not know where to forward them to. It does th same as a
stateful firewall.

Connecting end users via NAT was not the way the InterNet was designed however
and many things become a lot simpler - and as a side effect safer - if NAT
could be dispensed with. If there is just one computer connectedm there is no
need for NAT and - if you know what you are doing - yoy are better off without
it. Most people do mnot know what they are doing. That is why they think NAT is
a safety feature.

 ml>> i'm sure there are more but these are the first three that come
 ml>> to mind... others would be possible services like telephony and
 ml>> television...

 MvdV>> If other devices, such as telephones or televisons are
 MvdV>> connected, the condition of "if the only thing connected to it
 MvdV>> is that one computer?" is not staisfied.

 ml> would that not depend on where and how they are connected?

These other devices are either connected to the router or they are not. When
they are connected to the router the condition "only thing connected is that
one computer" is not satisfied. If they are not connected (directly or
indirecly) to the router, you do not need the router if the only thing
connected to it is than one computer.

 ml> i also have to wonder at the prolific use of the term "router" when
 ml> what is generally meant is "all-in-one firewall, router, other
 ml> services device"... we have yet another "beautiful thing" to thank
 ml> marketers and marketing for :? :(

There you have a point. The routers that are sold for small office and home use
often are much more than just a router. Most of them come with an integrated
four port switch and some with a wireless access point. They include a
firewall, DHCP server and DNS filter functionality. And some more...

Well, I found out long ago that peeing against the wind, just gets your pants
wet...

Cheers, Michiel

--- GoldED+/W32-MINGW 1.1.5-b20070503
 * Origin: http://www.vlist.org (2:280/5555)