Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is having local firewalls enabled on machines actually necessary if you run hardware based firewalls like pfsense or a netgear fvs338 and use that to control in/out bound connections?

I personally do not see how a firewall locally adds any type of protection (assuming no infections happen) other then just another layer of ACL.

share|improve this question
    
    
It's not worth an answer, but if you would like to have network access control inside a subnet then local firewalls are the way to go. –  k to the z Aug 9 '13 at 14:10
    
Is this for a desktop/server platform, or something more mobile like a laptop? In the latter case, you should definitely prefer host-based technologies since your home router/firewall can't protect you on the go. –  Iszi Dec 1 at 17:38

3 Answers 3

Host based firewalls aren't necessary if you have a dedicated network firewall.

However, defence in depth is always a good thing to practice. Host based firewalls allows you a more fine grained control on a machine to machine basis as well as allowing you to filter traffic coming from internal networks. This can be a great asset in preventing a single compromised machine on your network from compromising the rest of your network.

share|improve this answer
2  
Process awareness also allows for better filtering of the use of allowed protocols. You don't want ImAVirus.exe to be able to use some allowed network protocol to communicate out. –  AJ Henderson Aug 9 '13 at 13:48
    
@Terry, but isn't it true that network firewalls have no way of blocking fradulent outgoing connections? –  Pacerier Aug 15 '13 at 20:41

In a well-designed operating system with adequate maintenance, there is no process which runs and offers services and implies various activities except those that are strictly necessary for what the system administrator and user intend the machine to do.

Unfortunately, desktop OS have grown way past the point where such an efficient simplicity could be realistically achieved. You have to cope with OS including a lot of undocumented elements and activities, some of which implying network activity, in particular listening to incoming requests on some port and thus offering a service to outsiders. It is a good idea to make an inventory of what is running on your machine and try to track such unwanted elements (look at the list of process, also see the open ports with netstat -a, and so on).

However, it is also a good idea to enforce a strict in/out policy for everything related to networking, in case you did not make a full cleansing. A firewall is something which enforces this in/out policy. Your external hardware firewall will trap all activity which goes through it but it may not see activity related to the local network (and Windows systems do that a lot, with all the NetBIOS stuff). A local firewall, being local, can see every single byte that enters of exit the machine, so it is more thorough for detecting unwanted activity.

On the other hand, an external firewall will be more efficient at blocking attacks which target the implementation of low-level network protocols directly; the local firewall gets to act only after the IP packet has been received and some processing already occurred in the OS kernel, so it is a bit too late for the kind of attack which exploits buffer overflows in the kernel. In that sense, the external firewall and the local firewall complement each other. They both can do things that the other cannot, even though there is some partial overlap in their respective functionalities.

share|improve this answer

Host based firewalls are the only firewalls that have access to what process is trying to access the network. It does depend on how restrictive you can be with the hardware firewall, but unless it is really restrictive, malware within the network could likely pretend to be a legitimate service or even use a legitimate service's protocol to communicate out. In these cases, a host based firewall will have a much better chance of stopping the threat.

It won't help any if the malware uses the actual process for a service that is authorized, but if the malware starts trying to send it's own e-mail or Skype messages or something, then a host based firewall will prevent it unless the process is authorized.

So, while a good hardware firewall may reduce the benefit of host based firewalls, it doesn't remove it entirely.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.