Text 62511, 52 rader
Skriven 2010-09-26 01:49:37 av mark lewis (1:3634/12.0)
  Kommentar till text 62509 av Holger Granholm (2:20/228)
Ärende: Windows 7 Help Please
=============================
SD>You know you've got a built-in firewall if you're running Warp 4 or
SD>higher, right?  I always have my systems firewalled since I just
SD>don't like people "knocking on my door" all the time.

 HG> Yeah but when I'll connect to my ISP via broadband and have the
 HG> 'puter hanging there all day I'll some FW on the incoming line.

 HG> The only question is, what can I use that doesn't need Windows? I
 HG> don't like the idea of running a separate computer just to run a
 HG> firewall and/or AV program.

security is properly done in layers... layers on layers on layers... i firmly
espouse the use of a dedicated machine for a dedicated firewall... like many of
the commercial brick boxes, there can be DNS proxy, web proxy, pop3 proxy, and
other services running on it but they should be strictly firewall type services
aimed at protecting internal machines from external baddies...

i also firmly espouse that internal machines should have, if possible, their
own individual firewall to protect them in case something does get loose inside
the network and starts trying to infest them from internal addresses which may
be allowed access to certain ports and services...

it pays to have dedicated sniffers to detect and alert on certain traffic but
this also depends on the network and what goes on in it... my setup has three
internal networks... GREEN is my protected main LAN... PURPLE is where
"unknown", visiting and general access wireless machines go... ORANGE is
similar to commercial SOHO routers' DMZ except that my DMZ is still protected
from the WAN (aka RED in my setup) instead of being a wide open free-for-all
zone that most all others are... having a dedicated "hidden" sniffer on each
network (or possibly even one dedicated machine sniffing all three internal
networks) can go a long way to protecting one's setup as well as showing them
what traffic is really flowing on the wires... my current setup only has one
sniffer and it is watching the perimeter looking at all traffic flowing in/out
of my RED interface to/from the WAN... i do have plans for at least one on my
GREEN LAN and possibly my ORANGE LAN... PURPLE i don't really worry about as it
is intended for "everything else"...

one might also note the colors i used in the above and their relationship to
the networks they are assigned to...

RED = WAN = most dangerous
ORANGE = "DMZ" = servers go here = slightly less dangerous than RED
PURPLE = "other machines and wireless" = less dangerous than ORANGE
GREEN = main LAN = everything in here is trusted

each one can talk to the one above it but they cannot talk to the one below
them without special holes being punched to allow such... however, doing such
could negate the purpose and reason for the separation of each internal LAN...

)\/(ark

 * Origin:  (1:3634/12)