Firewalls: Your first line of defence

As a systems administrator for an ISP , my primary function is to support several thousand customers by ensuring that equipment and services are operating correctly. Depending on the customer, this job can include maintaining on-site routing and firewall equipment, which can vary depending on the specific needs of the customer.

When it comes to supplying Internet access, ISPs provision a single IP address or a subnet for their customers. Either way, I always suggest that anyone accessing the Internet protect systems with either a hardware or software firewall.

Of course, IT pros know that a firewall is anything that protects a computer or network from the ravages of the Internet. But when talking to end users, I try to describe the level of questionable activity on the Internet in terms of worldwide accessibility.

Because public Internet addresses are readily accessible from anywhere in the world, even a simple dial-up Internet connection with a public IP address exposes your computer to the rest of the world while you're connected. This means anyone on the Internet can identify your computer—and perhaps scan it to see whether it's running vulnerable software or services. That's why you need to implement a firewall to try to protect it.

Hardware vs. software firewalls
As I tell my customers, deciding which type of firewall to use depends on what you're trying to protect. If you're just worried about a single computer system with Internet access, ZoneAlarm software works well enough for most people.

ZoneAlarm not only alerts you when someone tries to access your computer, but it alerts you when a program on your computer attempts unauthorised access to the Internet. If the access is valid, you can instruct ZoneAlarm to remember the program and allow access in the future without alerts. Although it's not an antivirus program, ZoneAlarm can also detect Trojan horse and spyware programs.

However, sometimes a software firewall just won't cut it. I suggest using a hardware firewall in these situations:

• A customer needs Internet access on more than one computer.
• A customer needs a secure connection to a main office.
• The client is a branch office.
• A company needs to host email and Web servers.

Even though it's possible to share an Internet connection and firewall software using one computer as the router, I think it's a bad idea to use a workstation in this manner. Everyone on the network becomes dependent on the reliability of someone else's computer.

If a computer locks up or reboots, it cuts off Internet access. Then people call the ISP to complain, even when it's not the source of the problem.

Hardware firewalls don't have to be expensive. For instance, Netgear and Linksys models sport sufficient features for a reasonable cost.

Do you need advanced firewall features?
If clients telecommute or are setting up a branch office of a larger corporation, they probably need to use VPN features. Clients may also need NAT when there are multiple internal computers and only one public IP address.

If customers need a subnet to support public Internet servers, I recommend using port forwarding and "hiding" the real service behind the firewall. No matter which advanced features your clients need, they should choose a hardware firewall that supports these advanced features.

Another thing to keep in mind when dealing with telecommuters or branch offices is to always check with the company's IT department before buying anything. I can't tell you how many times I've needed to replace equipment and fix VPN settings because branch offices and telecommuters didn't check with their IT department before buying equipment.

Regardless of your clients' specific needs, using a firewall does improve security. Anything they can do to "hide" their computer systems and services from the public Internet reduces risk.

My personal preference is to always use hardware firewalls, but software programs such as ZoneAlarm are better than nothing at all. However, firewalls can't prevent a virus or worm from taking over your computer—that's typically the job of antivirus software.

That's why it's important to remember that effective Internet security involves several layers. Consider a firewall system to be the first layer of your clients' security needs.