9

If I have the router firewall enabled, is it really necessary to setup iptables in my system? Isn't it a little redundant?

For example I add a rule in the router where the PC can't use the port 12345 for outgoing connections. Why should I add this very rule in the firewall of the PC?

mlp
  • 546
  • 4
  • 8

4 Answers4

8

You have asked two different questions, the one in the title isn't the same in the body of your question. Having a firewall software directly installed on your machine isn't the same as setting up iptables.

Is it necessary? No

Will it give you an extra layer of security? Yes

Why?

Having a firewall solution installed on your PC isn't just about blocking bad IPs and closing ports. Many firewall software employ attack signatures that are able to detect many automated (as well as targeted) attacks on legitimate ports that you might be using.

For example you may want to enable SSH access to your PC to tunnel your traffic from an untrusted network. In this case you want to open the port 22, most primitive routers can't do anything other than closing/blocking access to that port. You want something to detect attacks, automatically blacklist offending IPs (although I prefer the concept of whitelisting).

One more important point, your source of attacks might not be only from outside networks. One of the machines inside your network could be compromised and used to launch attacks on the other unsuspecting machines.

Adi
  • 44,095
  • 16
  • 138
  • 170
  • This is slightly different with IPv6 as your router will not do port-forwarding nor stand in between the connection as a gatekeeper. At least, not by default in consumer level equipment. – Daniel Feb 02 '13 at 13:29
3

There are advantages to both a hardware firewall and a PC firewall. The hardware firewall is isolated from your computer, which you run potentially bad code on that could compromise the integrity of the firewall. The hardware firewall may still have problems with it, but it is likely far harder to compromise. The disadvantage however is that a hardware firewall knows very little if anything about what program is making an outgoing connection. It is best at keeping out intruders as opposed to keeping bad things from getting out to the Internet since that would take far more complex configuration of denying any connection that isn't explicitly configured as allowed.

A software firewall on the other hand runs on your computer and is aware of the application that is trying to access the network. You can allow things at a much more granular level and it will do more to prevent a bad program (or even a good program) from accessing the network in a way you don't want it to, but the down side is that a smart bad program may be able to disable the functionality of the firewall and get past it.

AJ Henderson
  • 42,081
  • 5
  • 65
  • 112
  • So basically the point is: use hardware firewall for incoming rules and use software firewall for outgoing rules, isn't it? –  Jan 21 '13 at 16:09
  • 1
    @yzT - There are some other things that could be useful. For example, application specific incoming rules could be beneficial in some cases, but for an average home user, yes, the software firewall is outgoing while the hardware is incoming. – AJ Henderson Jan 21 '13 at 17:03
1

Your question can be answered using two terms: network-based firewall and host-based firewall.

You can search their textbook definitions in Google. The easy-to-understand definition is:

  1. Router firewall (or other external firewall hardware connected to router in prevention mode) belongs to network-based firewall. Because the objective is to inspect multiple devices connected with router. Hence, there is a generate set of firewall rules same for all network devices.

  2. PC firewall belongs to host-based firewall. We need it because there are some firewall rules specially designed for this host (PC) only. By the way, in practical, some host-based firewall also includes anti-malware (e.g. virus) function to protect a single critical host.

Now is your case. If you refers to a rule like "filter certain TCP port number". Usually, this is the work of network-based firewall. If you duplicate the same rule on PC again, it does not affect the decision (ACCEPT or REJECT or DROP).

The only concern is the processing delay, because the packet is inspected twice. For single packet or little packets, the additional delay can be ignored. For large amount of packets (e.g. million) and time-critical network, the delay may not be ignored. * Especially Deep Packet Inspection (DPI) function is included.

TJCLK
  • 838
  • 8
  • 25
1

It may not be necessary, but having both offers protection in case something slips by the other one. Basic principle of defense-in-depth.

I think of it like this:

enter image description here

I'd rather force a lockpick to pick two locks to get in. Slows them down, and might make them just pass me up for an easier house to break into.

David Stratton
  • 2,686
  • 3
  • 23
  • 37