How is XP's (SP2) firewall compared to other firewalls?

[BigToque]

I've never used one before and want to know if I should just use XP's firewall or another companies software.

 

[spyordie007]

XP's firewall in service pack 2 is a very good inbound firewall; however it does no outbound protection whatsoever.

If you want outbound protection you would have to run something else.

-Erik

 

[MrChad]

Originally posted by: spyordie007
XP's firewall in service pack 2 is a very good inbound firewall; however it does no outbound protection whatsoever.

If you want outbound protection you would have to run something else.

-Erik

If that is the case then I presume users who are running a NAT router/firewall will gain very little by running the SP2 firewall. Is this true?

 

[spyordie007]

Originally posted by: MrChad

Originally posted by: spyordie007
XP's firewall in service pack 2 is a very good inbound firewall; however it does no outbound protection whatsoever.

If you want outbound protection you would have to run something else.

-Erik

If that is the case then I presume users who are running a NAT router/firewall will gain very little by running the SP2 firewall. Is this true?

That is correct, there isnt much to gain by running it in these situations.

 

[corkyg]

I am running SP2's Firewall in conjunction with Z/A Pro - they are coexisting very well - like the old bagel shop in Berkeley.

 

[Psych]

HUH??? I thought one of the main issues that Microsoft wanted to address was that their built-in firewall didn't have outbound protection. I seriously believed that they included this feature in the new one. That was the main complaint about the original anyway.

 

[HardWarrior]

Originally posted by: corky-g
I am running SP2's Firewall in conjunction with Z/A Pro - they are coexisting very well - like the old bagel shop in Berkeley.

Why run two SW FW's when just one will do?

 

[bwanaaa]

why run any sw firewalls if you have a nat-firewall router (linksys or netgear fv318)

 

[HardWarrior]

Originally posted by: bwanaaa
why run any sw firewalls if you have a nat-firewall router (linksys or netgear fv318)

That's easy to understand, at least in my case. My linky (befsr81) doesn't restrict or filter outbound traffic. Also, my SW FW generates complete logs and acts as a far more discering incoming FW. In short, they compliment each other.

 

[BD231]

Originally posted by: bwanaaa
why run any sw firewalls if you have a nat-firewall router (linksys or netgear fv318)

Port forwarding, I made the mistake of leaving port 21 open once, it was NOT pretty.

Fuggin pop up adds, people shutting my computer off, it was lame.

 

[corkyg]

Originally posted by: HardWarrior

Originally posted by: corky-g
I am running SP2's Firewall in conjunction with Z/A Pro - they are coexisting very well - like the old bagel shop in Berkeley.

Why run two SW FW's when just one will do?

It was there, and I don't really trust Microsoft.

 

[HardWarrior]

Originally posted by: corky-g

Originally posted by: HardWarrior

Originally posted by: corky-g
I am running SP2's Firewall in conjunction with Z/A Pro - they are coexisting very well - like the old bagel shop in Berkeley.

Why run two SW FW's when just one will do?

It was there, and I don't really trust Microsoft.

That's why I turned it off from the start. I mean come on, who would bother writing a SW FW without outbound filtering in this day and age??? I don't really have high hopes for the SP2 version either.

 

[VirtualLarry]

Originally posted by: spyordie007
XP's firewall in service pack 2 is a very good inbound firewall; however it does no outbound protection whatsoever.

If you want outbound protection you would have to run something else.

-Erik

That's interesting... as I test-installed XP SP1, and then added SP2 rc1 on top, and the included software firewall in SP2 rc1 prompted me several times about applications attempting to contact the internet.
So, based on both what I've read, and what I've seen during my test-install, SP2 rc1's ICF does do at least some outbound blocking.

Btw, it is known to be a good idea NOT to run two software firewalls on the same machine at once. I don't know how strongly this applies to the built-in firewall support in XP though, because both ICS and ICF are somehow releated, and I do know that you can use ICS with other 3rd-party software firewalls at the same time, if they support it (Kerio 2.1.x, Kerio 4.0.x "pro", ZA "pro" do). One other nice feature that I found in SP2 rc1, is that you can map ports now. So you can use ICS and RDP to remote a desktop and still use things like mIRC, by mapping the incoming IDENT port requests, etc. Very useful, and much-improved over XP SP1. (I used to have to install WinGate proxy server on Win98se when using ICS to re-map TCP port 113.)

 

[gsellis]

Originally posted by: VirtualLarry

Originally posted by: spyordie007
XP's firewall in service pack 2 is a very good inbound firewall; however it does no outbound protection whatsoever.

If you want outbound protection you would have to run something else.

-Erik

That's interesting... as I test-installed XP SP1, and then added SP2 rc1 on top, and the included software firewall in SP2 rc1 prompted me several times about applications attempting to contact the internet.
So, based on both what I've read, and what I've seen during my test-install, SP2 rc1's ICF does do at least some outbound blocking.

SP2 does not block outbound. It does detect a listen on a port during installation/setup and ask you if you want to unblock it. But, if you got malware that sent outbound, it would not stop it. Ports can also be configured via GPO, an API call during install, and via two unattended setup files (unattend.txt and net... something).

Of course, this all could change with RC2. It does look like some form of IP range will be supported apps and port allow/disallow.

 

[VirtualLarry]

Originally posted by: gsellis
SP2 does not block outbound. It does detect a listen on a port during installation/setup and ask you if you want to unblock it. But, if you got malware that sent outbound, it would not stop it. Ports can also be configured via GPO, an API call during install, and via two unattended setup files (unattend.txt and net... something).

Of course, this all could change with RC2. It does look like some form of IP range will be supported apps and port allow/disallow.

Sorry, guess I was wrong then. I thought I remembered that I got prompted that so-and-so app wanted to access the internet. I assumed that meant outbound. I may have not remembered correctly, as I installed Kerio 4.0.14 a few days later, as I still wasn't quite happy with XP SP2 rc1's built-in firewall. Kerio works great, although I wish that they had stuck to the easy-to-use UI of their 2.1.15 version.