up vote 1 down vote favorite
share [g+] share [fb]

What are the limitations/disadvantages of enabling windows firewall?

link|improve this question
32% accept rate
You have to create your filtering rules when needed, that's all AFAIK. – Maxwell Jun 14 '10 at 14:21
I know a definitive advantage: It usually plays by the rules and doesn't do anything outright weird. I'm regularly helping people with their internet connection here and most of the time it's one of the weirder firewall products (Symantec, &c.) that is at fault. – Joey Jun 14 '10 at 17:34
feedback

migrated from serverfault.com Jun 14 '10 at 15:04

This question came from our site for system administrators and desktop support professionals.

4 Answers

up vote 2 down vote accepted

Advantage: A false feeling of security.

Disadvantage: Not being at all secure, as it's one of the worst free firewalls in the world.

That said, if you are behind a router, you normally do not need a firewall at all, as the router itself is a much better firewall.

Otherwise, if you wish to install a firewall, you are better off choosing a product that does both firewall and anti-intrusion (HIPS). Some examples are:

Online Armor Free
Comodo firewall

Although free, both are very good products.

EDIT

As I was asked to justify my remarks regarding the Windows firewall, here are some references:

Proactive Security Challenge
Please note here the ratings for Microsoft's security products

Win 7 firewall fails leak test
Top Ten Firewalls 2010
Comodo Firewall 2.3 Rated Top Overall Personal Firewall

link|improve this answer
why do you call windows builtin firewal the worst? – user33788 Jun 15 '10 at 15:17
@smoknheap: I edited into my answer some links, but there are many more. The Windows firewall is certainly much better than nothing at all, but one can for free do better (even much better). – harrymc Jun 15 '10 at 17:17
thanks for the feedback, if this is a home workstation then maybe these products are better but I doubt it. My gut feeling is that in a corporate environment they are less likely to offer any advantages to the internal fw. – user33788 Jun 15 '10 at 18:45
@smoknheap: There is not much difference between corporate and home, except that the office environment may not be fully under your control. A corporate firewall may be useless for protecting the internal network : for that you will need IPSEC-type protection and be at the mercy of its administrator. My experience with security administrators in large companies is quite negative (many times they are simply clueless). – harrymc Jun 15 '10 at 19:02
here ya on the ipsec stuff! Its like my answer below all the ports that you'd block need to be open just to do any work, thus ipsec is the solution. – user33788 Jun 15 '10 at 19:10
show 2 more comments
feedback
up vote 2 down vote

Context is everything for this. If you're talking about a home PC directly connected to the Internet - this is wildly, drastically important. In that situation, Windows Firewall should be turned on before that PC is put online or you'll be virus-riddled within a couple of minutes.

Home user with a physical firewall/router - not as vital, but still a good idea. No real reason to turn this off.

Corporate use - should still be enabled through Group Policy. Any apps that it could block would be documented & configured (also in GP).

As you can see, I'm a huge fan of redundant protection.

link|improve this answer
feedback
up vote 0 down vote

As in what? Enabling it can make some things inconvenient if you access remote services and have to poke holes in the firewall, it's somewhat redundant in some cases, depending on your network, and logging is pretty lousy to measure its effectiveness. That's pretty much it that I've run into.

link|improve this answer
feedback
up vote 0 down vote

Windows host based firewalls are mostly useful for internal defense, as in a worm that propagates internally etc. The problem with that is that most ports/services that are being attacked are the same one(s) that you need to leave open anyway so then what do you do? It is another layer in the defense in depth thought process so its hard to dismiss it completely.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.