Is it a bad idea using two firewalls on the same PC?

Question

If i'm using windows default firewall and a third-party firewall, is it represents a security issue or I have to worry just with possible conflicts? And what type of conflicts could exists?

Answer 1

Keep in mind that firewalls generally use one of two approaches to filter network traffic in Windows:

1. Classic way by installing own driver (used by, for example, Kaspersky).
2. By using OS mechanisms, specificaly "Windows Filtering Platform" - an internal, kernel-level packet filtering (similar concept to Linux NetFilter), which is available via API since Windows Vista (used by, for example, F-Secure).

In the first case, when you have two drivers installed, there could be a potential problems with prioritization and order of processing. Also, those drivers can install own hooks and do some other hacks which could result in incompatibility or system instability.

In the second case, when two firewalls use API, it will result in messing around the same, built-in mechanism.

In the third case, there will be an driver and Windows Filtering Platform.

It is good that you want to add another level of protection, but I suggest to do it on the edge of your network (or inside the network). Today everything is much more complicated than in the old times, so I wouldn't install two firewall's or antivirus programs on one system, because they are too critical system level applications which interfere with OS very much.

The best solution is to use Linux NetFilter or BSD's pf, but it generally requires another machine running. Take a look on MikroTik devices - they are essentially Linux boxes enclosed in small devices. They wouldn't be as good as native Linux, but are better than most other routers.

Answer 2

Issues on running two firewalls:

1. It will be difficult to manage the consistency of rules.
2. A significant delay in traffic flow.
3. If one firewall (or antivirus bundled with firewall) tries to disable other and vice-versa, the result is that both fail.

In general, one perimeter firewall + one host-based firewall will suffice.

Generally, in software-based firewalls installed in standard operating systems which are out of the box, the following points may be considered.

1. Host-based Firewall software can have a zero-day exploit, that will end up in system compromise(comparatively).

source:https://techtalk.gfi.com/2015s-mvps-the-most-vulnerable-players/

2. Malware has the capability to disable the host firewall.

On the other side, hardware-based boxes are mostly hardened Linux servers. Hence it is a little more difficult to compromise those firewalls.

Answer 3

Running two host firewalls means you haven't identified the threat.

What is a host firewall?

The basic definition of a host firewall is to allow/deny traffic in/out of your system. Adding a second program to perform this function increases complexity that will likely result in misconfigurations. Further it doesn't necessarily inspect your traffic for malware/viruses/etc. (though some vendors package these functions together more on that later).

What is the threat?

Below are some of the most common threats and how to address them. None of them recommend running multiple host firewalls.

Typical Web Browsing

Don't run web browsers with elevated privileges. Use browser plugins such as NoScript/Ghostery/etc. Have a solid Antivirus product to scan downloads. There are plenty of guides on this topic if you really want to lock down your browsing experience.

US Cert provides great information.

Host Services & Configuration

There are OS hardening guidelines for locking down services and tightening configurations.

A good starting point is Decent Security with more detailed guides available at CISecurity.

Intrusion Detection/Prevention

As mentioned earlier, a host firewall doesn't perform this function though some vendors package their detection capabilities with the firewall. The native Windows Firewall doesn't operate in this capacity for that functionality is left to Windows Defender. If you find preference with a 3rd party product that integrates these two functions, consider disabling both the Windows Firewall and Windows Defender.

Updates

This is arguably the most crucial. Make sure updates are installed for the Operating System as well as any other programs on it. This includes 3rd party browsers such as Chrome and/or Firefox. Also, if you elect to use a 3rd party firewall vendor be diligent that the most recent version is installed.

Answer 4

It depends, mainly on the third party firewall. I have seen cases where trying to install two software firewalls will make them both freak out or force the uninstallation of the other one. Of course, it would add a lot more management and complexity, which would result in potential security risks. So I would have to say yes , depending on how the two firewalls interact and the specific firewall.

I’m general, use a host and network firewall instead