A couple Firewall Questions

Hi All,

Wanted to check a couple things with you guys.

1. Programs in windows can crash. What if your running a 3rd party Firewall and the Firewall crashes?

2. If you install a 3rd party firewall in admin, then switch to your regular standard/limited account, you can't make changes to the firewall unless you switch back into admin account?

Thx guys

 

I am not really sure what it is you are asking or trying to find out with such vague questions (maybe it is just me)?? Did something happen or can you provide some details?

1) I would think that you would want to find out why the firewall crashed in the first place and check with the firewall vendor and send a bug report!

2) I can make changes to mine?

 

trying to find out of their is something to protect you should a firewall program crash? It seems like you would be wide open.

I also want to see if permissions, or other configuration needed for a 3rd party firewall can be set in a limited account or do you need to be logged in as admin before altering settings in zonealarm for instance?

 

It's a very good and valid question. I personally have never had a FW crash on me. But I guess it if did, you could tell and then reload it.

I cannot answer your second question sorry.

 

The best thing to have for inbound protection is a simple and cheap NAT router. Then you don't have to ever worry about your software firewall crashing or otherwise not covering you. The router also takes the processing load off the PC.

 

PC Tools firewall plus crashed on me once, once crashed you can not access the internet.

 

thx Brad, so the PC Tools firewall does have a feature that shuts down the internet should the firewall crash or be disabled it looks like.

@Kerodo, this was mostly theoretical, like most of you I'm always trying to find weaknesses in certain setups and I thought these things might be a potential weakness in a software firewall. On my setup I do use both Win firewall and a router firewall, most of what I've read recommends you have both seems to run smoothly, do you use both or just a hardware firewall?

 

Are you referring to NDIS/TDI driver crash or simply a GUI crash? Many firewalls have self-protection and will continue filtering (or block network comms altogether) after a GUI crash. If a driver crashes, most likely you will need to restart the OS (case of XP). If the NDIS driver crashes and the system remains stable (Win7 i.e.), yes you will be "open". But what exactly are your concerns with this?

If a firewall doesn't have self-protection, you can install a HIPS to protect the process(es) from deliberate shutdown.
If a firewall crashes all by itself (a conflict on the system i.e.), certainly contact the vendor and debug your system. Or dump such firewall, whatever suits you.

If you didn't force a password protection (on the firewall itself, most give this ability), you can access it and make changes from a limited account. But different firewalls will enforce different kind of protection. CHX-I i.e. will use MMC as it's GUI, so you can prevent limited users from accessing the MMC and therefore the firewall management itself.

 

thx seer, re your question in your first paragraph, my concern is to be knowledgeable and proactive in preventing such openings, like a firewall crash for example.

 

A firewall can crash.

That has happened to me at least twice with the Avira security suite !
I had to reactivate the services.

It's a good practice to use a router, in combination with a software firewall you should be safe.

 

Yes, software can become corrupt and/or crash.
Malware can be (and history proves...has been) designed to specifically disable/knock out some software firewall services.

That's why I put my firewall duties at the gateway, using routers. NAT is NAT, it won't corrupt, your PC remains hidden from the internet.