Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My home network connects to the Internet via a cable modem which is connected to a router. This router is what connects my different network appliances together (printer, switch, computers etc).

I believe this is enough to protect me from network probes/sniffing etc.

Do I still need a firewall with this setup? If you think so, please explain why.

share|improve this question
up vote 2 down vote accepted

Your router will be acting as a NAT gateway, which means that nothing can come in unless your specifically allow it, so in this respect, you don't need a firewall. However, as mentioned, it's worth protecting the machines from each other. Personally, I like Comodo, but it's down to personal taste.

share|improve this answer
NAT by itself does not deny malicious packets. The router will require its firewall to be enabled, which is usually default these days. – hyperslug Aug 17 '09 at 20:30
Unless a port forward rule has been setup, the router won't know which host it should route the traffic to, so will drop it; meaning that there can be no inbound connections. – Dentrasi Aug 17 '09 at 20:35

Yes you do.

One example that comes to mind is if one of your computers gets infected from e.g. USB drive, there is nothing stopping it to propagate through network.

Also, if it happens that router's firewall has some flow, you have additional protection.

It is called defense in depth.

And it does not cost you anything to have at least basic firewall on all computers.

share|improve this answer

I use a software firewall for outbound protection. I want to know when an application (malicious or not) is trying to call home or has some other reason to access my Internet connection.

I continue to use Zone Alarm Free for that reason alone. It notifies me when an application is trying to access the Internet. Then I can select whether to allow or disallow that access. I can also tell Zone Alarm whether to warn me each time that application tries to access the Internet to just to always block/allow access for that application each time.

share|improve this answer

As mentioned in other posts, assuming your "router" is a NAT router, you should be relatively safe from any attacks from probing from the internet. However, as also mentioned, the machines on your LAN are still vulnerable to attacking each other if one of them gets infected by a virus.

I don't feel that there is any need for a 3rd party firewall. Most modern operating systems (Windows XP SP2, Windows Vista, Windows 7, most Linux distros, Mac OS X) ship with firewall which is on by default. That alone should be enough to protect you from any attacks from infected machines on your LAN. I wouldn't worry about installing a 3rd party firewall unless you requires special features such as filtering outbound traffic.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .