1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Router, NAT, Firewall discussion *Clarified*

Discussion in 'Networking (Hardware & Software)' started by TonyT, 2004/02/09.

Thread Status:
Not open for further replies.
  1. 2004/02/09
    TonyT

    TonyT SuperGeek Staff Thread Starter

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    There are a few errors in Newt's thread stuck atop this forum. I will attempt to clarify some of them and perhaps Newt can edit his thread to reflect the corrections.


    re NAT Section of thread:
    Not all devices using NAT store or maintain a database of packets that pass through the device. Some devices operate on the premise that if the packet originates locally then there is no need to 'keep tabs' on it.

    re Firewalls Section of thread
    The post states:
    So if your PC is 192.168.0.10 and outbound HTTP packet will be from 192.168.0.10:80 and the entire address including port number is necessary.

    The above is incorrect. The outbound packent from your computer will never be on port 80 or port 21. Those are the open ports on the server. Client computers originating outbound connections generally grab any free port above 1023 as their "source port" and specify the destination machine's IP address and the destination port for the service they wish to solicit from the remote machine.

    example:
    You want to view a page here at win-help. You open your browser and click a bookmark that takes you here. Your browser sends packets FROM your computer port 1023 TO port 80 here at the win-help server. Port 80 is the standars port used for www servers. The win-help server does not send packeys back to you on it's port 80 and you do not receive packets on your port 80.


    re Routers Section of thread:
    A router is not a firewall. A cable'dsl router/gateway with NAT IS a firewall. These devices vary in features.

    Hardware Firewalls:
    A hardware firewall is a separate dedicated device used for detecting and stopping unauthorized access to computers it is set up to protect. A cable/dsl router/gateway with NAT is a hardware firewall.

    Some hardware firewalls also include additional firewall features such as SPI (Stateful Packet Inspection), reverse lookup & logging, antivirus etc etc, all the bells and whistles seen in common software firewalls such as Zone Alarm and others. These features generally are not available in products for the home user and are used commercially as they are expensive. Some home user devices have built in features to integrate with a home user software firewall.

    In short, a hardware firewall is basically nothing more than a tiny computer, using a hard drive or RAM or ROM, and is dedicated to a small amount of tasks such as protecting the computers connected to it. Any home computer can be made into a hardware firewall by installing certain software applications and network cards and configuring it to protect the network. It can even be made to perform exactly like a cable/dsl router and do the job just as well, if not better.
     
    TonyT,
    #1
  2. 2004/02/10
    Dennis L Lifetime Subscription

    Dennis L Inactive Alumni

    Joined:
    2002/06/07
    Messages:
    2,557
    Likes Received:
    2
    Thank you TonyT and Newt for sharing your knowledge.

    One can assume over time, home use routers will provide full firewall features. Currently most routers have NAT, which gets along with software firewalls very well. As more firewall features are provide via the router, could they start interfering with features provided by there software cousin?
     
    Dennis L,
    #2


  3. to hide this advert.

  4. 2004/02/10
    TonyT

    TonyT SuperGeek Staff Thread Starter

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    There's no need for a software firewall when using a hardware firewall. Some folks still use both because majority of home routers w/ NAT do not monitor outbound traffic, and this is of concern to those worried about email worms and spyware.

    However, there's still no need for the outbound monitoring unless one may be on a network and does not readily have the needed control over what other clients are doing. And if one's hardwall does have the bells & whistles (additional firewall features like SPI, gthen there's no need for a softwall at all and possible conflicts can result, speed degradation as mentioned in Newts post etc etc.
     
    TonyT,
    #3
  5. 2004/02/10
    Dennis L Lifetime Subscription

    Dennis L Inactive Alumni

    Joined:
    2002/06/07
    Messages:
    2,557
    Likes Received:
    2
    It is this transition period (example D-Links 604 firewall options page) which blurs the average users understanding of what is or is not included in "additional features ". I relied on NAT/router when first upgrading to broadband. Web based port testing assured me my ports were in "stealth mode ". Then "call home" activity became a issue, so I installed software firewall. This is a typical migration for many of us. As new featured routers are released, how will average users determine if software firewalls should be "installed or uninstalled "?
     
    Dennis L,
    #4
  6. 2004/02/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    This is why, even though I do have a router with NAT and SPI, I will continue to use a software firewall and have control over what does and doesn't connect to the internet. Call home programs will appear to the router as valid requests and therefore be allowed.
     
    noahdfear,
    #5
  7. 2004/02/10
    BillyBob Lifetime Subscription

    BillyBob Inactive

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Just plain discussion.

    I am guessing ( assumming ) that this may well be the difference between my old Linksys Router and the New D-Link Router.

    Refering to Links 2003. The Linksys says Hey OK. This guy started the link so it is OK to let it go.

    The D-Link just plain says NO WAY. It is also doing the same to a couple of LAN games.

    I just got a new Linksys Router/4 port Switch today so I will be testing it today or tomorrow.

    That my Friend is a VERY GOOD question.

    And I myself do not think there is any way to find out other than on the spot testing. Readin log files etc.

    I myself like to have a Software Firewall. That way if it is behaving proper I will ( or at least should ) know more what may be trying to get outta here.

    One of the Kids was on the Internet the other day. She asked if she cold try a certain Web Site. I said yes but I was watching all the way. I did see the words ( DOWNLOADING ) whlie the site was coming up. No sooner had the site come up on the screen something from it wanted to go right back out. ( something to do with Kazaa I think ) After close inspection I told Kerio to say NO WAY.

    BUT. If a LAN is involved such as I have I think a Software Firewall may be good to have. No machine can get to my machine unless I grant it permission via Firewall Rule settings. One machine may let the request go out. But I can say NO on this end.

    So could it be that whether to or not to may depend on the individual setup and how it is used ?

    And most certainly user preferences.

    From what I have learned so far I believe I perfer a Router without a Firewall as I believe I have more control with a Software FW. Don't know 100% for sure. Gotta do some more work.

    BillyBob
     
    BillyBob,
    #6
  8. 2004/02/10
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    TonyT - thanks for the information. I will certainly correct goofs in the original post. It does look like I was confused on a couple of points. Have to give some thought about how to best rephrase the 'firewall' part so it is accurate but will make the differences clear to networking novices.

    One item that puzzles me though. You said, "Not all devices using NAT store or maintain a database of packets that pass through the device. Some devices operate on the premise that if the packet originates locally then there is no need to 'keep tabs' on it. ".

    How would a return packet in this situation get back to the originating PC? I could understand if it were a single user NAT feature (and there may even be some of those - I have no idea) but if there are multiple devices behind your NAT device and no good way to track the originating PC, I can't think of any option other than all returns being broadcast to see who wants them and that doesn't sound reasonable even if possible.
     
    Newt,
    #7
  9. 2004/02/10
    BillyBob Lifetime Subscription

    BillyBob Inactive

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    :)-I could not wait any longer.-:)

    I shut everything down and hooked everyting back up according to the instructions ( that is some thing new for me )-:)

    As of this point in time it seems the new Linksys BEFSR41 Router/Switch is more suited for my use.

    Once I got all machines back on ALL LAN GAMES work PERFECTLY. and FASTER immmediately.

    The log file seems to report nothing about the LAN but it sure does about the Internet. It shows the address to this BBS and the port. It also show the return info and what ports.

    I can now play links 2001 with either machine acting as host. ANd even much faster then the old Linksys.

    I will not have a chance to test LS 2003 online till this evening.

    BillyBob
     
    BillyBob,
    #8
  10. 2004/02/10
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    BB - sounds like a great start. Good on ya.
     
    Newt,
    #9
  11. 2004/02/10
    TonyT

    TonyT SuperGeek Staff Thread Starter

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Well most home use router/gateways use a simpole configuration table, nothing more than a few lines of text written to the router's internal memory. This table defines what to do with data that is sent and received by the various clients.

    Now, a commercial grade router, may or may not have a huge database of data (configurations-settings). These types of routers have features galore. And generally there are settings to tell the router how long to store data, types of data, data limits, spi, ids, etc.

    As you know, home routers are not that robust and all that is stored are the configs made in the control center via the browser. In fact, all the config options are stored and get overwritten when changes are made. In short, a home router's config is nothing more than a secure web site complete with cgi-bin burned to it's memory.

    Yes, technically a table such as these could be classed as a database, but it's pushing it slightly because there may be only one table for all router configs. (one csv txt file or tabbed txt file)

    BillyBob-
    Looks like you have a solution now. I suggest keeping with it and ignore the other testing cause it will only lead to possible frustration and issues. Were it me, I would want to spend more time on the greens, but in your case, one who is used to the sand, you may wish to play around more with the other routers!!!!
     
    TonyT,
    #10
  12. 2004/02/10
    BillyBob Lifetime Subscription

    BillyBob Inactive

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Looks like you have a solution now.

    It is looking in that direction.

    I suggest keeping with it and ignore the other testing cause it will only lead to possible frustration and issues.

    I do plan on keeping it. ( unless I get bored again :( -( But then I have had enough frustraion for the time being.

    Were it me, I would want to spend more time on the greens, but in your case, one who is used to the sand, you may wish to play around more with the other routers!!!!

    I sure agree about more time on the greens.

    Instead of always teasing me about the sand etc. why do you not get Links 2003 so we can see you spends more time in the sand.

    PLUS. You may be able to help me out if I need to forward ports. Or what ever the new ones does. It is different.

    GRC and Symantec report all ports to be stealthed except 113.

    Also now the game of SORRY will play via the LAN.

    BillyBob
     
    Last edited: 2004/02/10
    BillyBob,
    #11
  13. 2004/02/10
    BillyBob Lifetime Subscription

    BillyBob Inactive

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    :):)--To whom it may concern :):)

    Links 2003 connected immediately to our Friend in Canada.

    Game seemed to go much faster and smoother.

    But I do not have a Firewall loaded either.

    So that tells me that hardware DOES play a BIG part in how things go. Newer OS and software needs newer hardware.

    And unless some unforeseen item comes up I believe things will stay as they are. It was broke. I tried to fix and made it worse. Tried one more time and it seems to be fixed AGAIN.

    Now I will go check the log and see what it tells me.

    BTW TonyT
    I did not get in the sand tonight. :p

    A happy PC Operator ( for the moment anyway )
    BillyBob
     
    BillyBob,
    #12
  14. 2004/02/10
    TonyT

    TonyT SuperGeek Staff Thread Starter

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    I DO play in sand alot. (cause I fish a lot and set alot of ceramic tile!

    How to stealth port 113 using Linksys routers:

    1. Access teh control center
    2. In Advanced section under Port Forwarding, forward port 113 requests to an ip that never gets used and hit the apply button.

    Here's screenshots of my settings for this in my Linksys router:

    Advanced Section

    Port Forwarding Section
     
    TonyT,
    #13
  15. 2004/02/10
    BillyBob Lifetime Subscription

    BillyBob Inactive

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    OK. I see that your shots were taken from what appears to be the same as my OLD BEFSR41. ( I think one of the first ones out )But the basic setting are the same.

    The new one is VERY different. But the general ideas are the same.

    In fact on screen is even different than the printed manual. ( on the CD of course ) Sure as hello not much help there :(

    But anyhow. Things are looking up and unless I get messing around again they will more than likely stay that way.

    At least I HOPE so.

    BillyBob
     
    BillyBob,
    #14
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...