Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I have the router firewall enabled, is it really necessary to setup iptables in my system? Isn't it a little redundant?

For example I add a rule in the router where the PC can't use the port 12345 for outgoing connections. Why should I add this very rule in the firewall of the PC?

share|improve this question

3 Answers 3

up vote 7 down vote accepted

You have asked two different questions, the one in the title isn't the same in the body of your question. Having a firewall software directly installed on your machine isn't the same as setting up iptables.

Is it necessary? No

Will it give you an extra layer of security? Yes

Why?

Having a firewall solution installed on your PC isn't just about blocking bad IPs and closing ports. Many firewall software employ attack signatures that are able to detect many automated (as well as targeted) attacks on legitimate ports that you might be using.

For example you may want to enable SSH access to your PC to tunnel your traffic from an untrusted network. In this case you want to open the port 22, most primitive routers can't do anything other than closing/blocking access to that port. You want something to detect attacks, automatically blacklist offending IPs (although I prefer the concept of whitelisting).

One more important point, your source of attacks might not be only from outside networks. One of the machines inside your network could be compromised and used to launch attacks on the other unsuspecting machines.

share|improve this answer
    
This is slightly different with IPv6 as your router will not do port-forwarding nor stand in between the connection as a gatekeeper. At least, not by default in consumer level equipment. –  Aeyoun Feb 2 '13 at 13:29

There are advantages to both a hardware firewall and a PC firewall. The hardware firewall is isolated from your computer, which you run potentially bad code on that could compromise the integrity of the firewall. The hardware firewall may still have problems with it, but it is likely far harder to compromise. The disadvantage however is that a hardware firewall knows very little if anything about what program is making an outgoing connection. It is best at keeping out intruders as opposed to keeping bad things from getting out to the Internet since that would take far more complex configuration of denying any connection that isn't explicitly configured as allowed.

A software firewall on the other hand runs on your computer and is aware of the application that is trying to access the network. You can allow things at a much more granular level and it will do more to prevent a bad program (or even a good program) from accessing the network in a way you don't want it to, but the down side is that a smart bad program may be able to disable the functionality of the firewall and get past it.

share|improve this answer
    
So basically the point is: use hardware firewall for incoming rules and use software firewall for outgoing rules, isn't it? –  yzT Jan 21 '13 at 16:09
1  
@yzT - There are some other things that could be useful. For example, application specific incoming rules could be beneficial in some cases, but for an average home user, yes, the software firewall is outgoing while the hardware is incoming. –  AJ Henderson Jan 21 '13 at 17:03

It may not be necessary, but having both offers protection in case something slips by the other one. Basic principle of defense-in-depth.

I think of it like this:

enter image description here

I'd rather force a lockpick to pick two locks to get in. Slows them down, and might make them just pass me up for an easier house to break into.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.