How can I protect a PC that will be directly connected to the Internet? There won't be a router — with it's semi-protective NAT — between my PC and any script kiddie on the Internet. What do I need to do to protect my PC, which runs both Windows and Linux, from various attacks?

I assume that it's sufficient to make sure my firewalls are set to reject un-requested connection attempts.

For those who are interested, I want to set it up so I can Wake on LAN (over the Internet) and then SSH into the PC. My university does not allow port forwarding, so I can only enable or disable it for my connection.

  • @Lord Torgamus That's what I get for editing & re-editing... – Lanissum Mar 29 '11 at 19:05
  • Can you send WOL (broadcast) over the internet? Thought it gets filtered by the first router. – Blackbeagle Mar 30 '11 at 1:22
  • The WOL data (the MAC address 16 times repeated IIRC) can be sent over any type of packet, TCP/UDP any port that won't be blocked by intermediate routers, and it doesn't have to be a broadcast packet. – LawrenceC Mar 7 '12 at 16:51

The simple answer is a firewall, of course.

On Windows (Vista or later), the built-in Windows Firewall is actually pretty good; for older versions of Windows (or the newer ones too if you dislike the Windows Firewall for any reason), I recommend either ZoneAlarm or Comodo (I've had good experiences with both).

On Linux, I use Shorewall as a configuration interface to iptables/iproute, but that's pretty hairy for someone inexperienced with low-level firewall operation and a working understanding of networking. Unfortunately, I've never used anything else on Linux, so I don't have any recommendations here.

Your other option is to go out and buy a cheap router -- a basic one can be had for as little as $20. Now, NAT is not really a "true" line of defense, but I certainly acknowledge that it's good at filtering out a lot of the garbage out there.

  • I should also add that I recommend DROPing inbound connections you don't want, as opposed to REJECTing. It's not really any more secure, but it does make you semi-invisible which will keep a lot of the script kiddies out of your hair entirely. – Kromey Mar 29 '11 at 22:06
  • DROPing? Is that in a config file for iptables or something? I'll look up your interface for iptables, I've only used a different one myself and it was rather low end. – Lanissum Mar 30 '11 at 7:55
  • 1
    What I mean is that most firewalls give you the option to REJECT (aka "refuse" or other similar verbs) or to DROP (aka "ignore") incoming connections. The difference is that your computer will immediately send a TCP NACK response (or the UDP equivalent, I think) if it is REJECTing, as opposed to simple ignoring ("dropping on the floor") a packet it's told to DROP; the latter means that there's no indication to the send that any computer even exists there to have received the packet. Some firewalls call this "invisible mode" or something similar, and while it's not "true" security, it's good. – Kromey Mar 30 '11 at 17:04

Also: no default accounts, and no default passwords. Use very complex passwords. Limit attack surface by disabling all unneeded features and services. Uninstall unneeded software. Keep up-to-date on any Windows hotfixes that apply to your configuration.

I'd run a packet sniffer for awhile when you first get set up to establish a baseline, so you'll know what normal looks like if things go wonky. Also do some performance monitoring at first for the same reason.


I personally (as the first thing I do on a computer) download Microsoft Security Essentials.
I am not very into Linux, and wouldn't be able to advise on this part.

I just have 1 more question: How come they do NOT allow port-forwarding, but DO allow connecting it directly to the Internet? Which is another thing I don't understand, don't they already have a modem, router (and likely a switch) there? Cause in that case, it does not matter wether you port-forward on a router that you are connected to, it will still be blocked by the main router.

  • No, it's basically all or nothing with the uni system. Believe me, if I could forward a single port I would. – Lanissum Mar 30 '11 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.