Basic Firewall Question

I apologize if this has been covered in (a) previous thread(s). Should a software firewall be run as a service? If so, why? The reason why I ask is that someone told me that if you log off and you are on an "always connected" system that your system is vulnerable unless your software firewall is run as a service. Is this true? Of course, I am behind a hardware firewall/router so I am not really concerned, just curious. Thanks in advance.

 

Most personal firewalls install a kernel driver (a .sys) for packet filtering, and those are loaded before any service starts. Some firewalls can shut down all network traffic while the computer is booting. In some cased you could shut down the firewall user interface but the firewall still does its thing in the background.
A very good overview article:
http://www.matousec.com/projects/wi...l-analysis/design-ideal-personal-firewall.php

 

Thank you. Very informative!