In other words, if there's a network firewall running, can that prevent any connections on that network (the way a host-based firewall would), or can it only stop computers on other networks from attacking?
2
-
3It's very clear what he is asking actually. does a network based firewall protect computers from internal threats like a host os's firewall would. The answer is no, not unless you have internal vlans setup with a firewall in-between lan segments. And even then someone in the same lan segment would be able to try and hack another computer in that local lan.– Tim_StewartFeb 28, 2018 at 18:04
-
1Yes, the answer is almost always “no”. I have seen a product that sat in the middle of a network and mediated all intra-network connections — picture a switch with access control rules. It was meant primarily as a gatekeeper, to restrict information flow within the network (in, perhaps, a more nuanced way than VLANs alone would allow). It was not thought of as a firewall, per se (if only because of the topology), but it could have been enhanced to detect and block malware as well. But this was a highly specialized application; not something one would be likely to see in the wild.– G-Man Says 'Reinstate Monica'Feb 28, 2018 at 21:30
Add a comment
|
1 Answer
Does a network based firewall protect computers from internal threats like a host os's firewall would?
The simple answer is no.
If you sectioned off each user with their own /30 subnet giving each end station it's own vlan to work with. Then added a trunk going to the router/firewall, and a virtual interface for each end station. Then the answer would be yes.
I would think a multiple layer approach would be best. Firewall/IDS at the gateway. And each host OS with it's own software firewall installed. But keep in mind there is always an extra layer for troubleshooting problems when you add layers to the complexity.
answered Mar 1, 2018 at 2:46
