Protect Your Computer with a Firewall

A firewall/WAN router is perhaps the smartest investment a computer user can make.

The Internet is a very dangerous place. There are worms that can affect PCs running Windows. There are worms that can affect PCs running Linux. There are even exploits that can affect Mac users.

However, not since Colt started selling his first six-shooters has there been such an effective "equalizer" out there as the common firewall/WAN router box. Companies such as SMC, Linksys, MacSense, 3Com, DLink, and many others make effective little firewall boxes that run under US$100. Many are going for US$80 or less.

The one thing these little guys have in common is this: an ethernet port to plug in a cable or DSL modem* and an ethernet port to plug in your computer. Most have a 4-port switch built in, so you can plug in up to four computers into the box. And these devices play well with other switches (I have an 8-port Addtron switch hooked into the uplink port of my SMC Barricade firewall/WAN router), so if you have more, the more the merrier.

* Since there is no modulation/demodulation process that goes on in DSL, it is a misnomer to call a DSL interface device a "modem." However, since nobody's come up with a better term for it, "modem" will have to do.

Many of these little boxes, including my SMC Barricade, have a serial port for an external analog modem. Until I recently got cable modem service through Adelphia, I used mine with my trusty Best Data v90 external modem. Now the analog modem provides automatic failover should I lose my cable connection.

Why would someone who uses a narrowband dialup connection - where the connection is opened and closed and is never "always on" - want one of these devices? Well, even a PPP connection can get stumbled upon by a script kiddie or attacked by a zombie computer under control of a worm like Code Red or Nimda. You do get an IP address when you log into a PPP connection, just like everyone else on the Internet. Thus you are just as vulnerable when you are using a dialup connection as when you are using a cable or DSL connection. "Always on" connections like cable and DSL are more stationary targets and therefore more attractive to the predators that lurk on the Internet. But if someone stumbles upon the pool of IPs that your ISP assigns to users via PPP, they can wreak as much havoc as they want to.

Software firewalls are as vulnerable as the operating systems they run on.

Yes, there are software firewall solutions. But there is recent evidence that they are not enough, according to a security firm quoted on Cnet's site</a>. Software firewalls are as vulnerable as the operating systems they run on. There are real and potential exploits that use "features" of Microsoft Windows to allow a person to rummage around a remote computer and peep at your private files.

As of Mac OS 9, there are now hooks in the Mac OS to allow AppleScripts to remotely control a Mac. And in Unix-derived operating systems like Mac OS X and Linux, there are similar processes that can be hijacked by a hostile intruder or hostile code for similar uses. Antivirus programs for Windows and Mac are useful and should be used as an adjunct to a hardware firewall.

Most hardware firewalls use some type of Web browser interface for initially programming the device to accept an Internet connection. The SMC Barricade uses one, and although it's not the prettiest thing I've ever seen, it serves its purpose.

Before you turn your firewall on, you need to prepare your computer to use it. Most firewalls use an IP address in the 192.168.x.x range of non-routable addresses. These are addresses specifically designed to not go out over the Internet. By the use of something called Network Address Translation (NAT) you can use one IP address, whether dynamically configured or static, for many computers. All anyone on the outside of your network sees is the single IP address your ISP gives you. In itself, NAT is a measure of protection against crackers. It is also a way of conserving IP addresses, a precious commodity nowadays. (A new version of the Internet Protocol, IPv6, is on the way and will support many, many more IP addresses that the current version, IPv4, can. Until then, we've got NAT.)

My SMC Barricade uses the 192.168.2.0 network, and it defaults to the IP address of 192.168.2.1. Most firewall devices will want that x.x.x.1 address as it's the traditional one to give the gateway router in a network. Another word for a WAN router is a gateway. You will need to know what a gateway is for the next step.

You can do things the easy way or the hard way with one of these devices. The easy way to set up your computer is to tell it to use DHCP to get its IP address, default gateway, DNS address, etc. In Windows, that's the way the TCP/IP setup defaults. If you have information already in your Network control panel, just by setting the radio button to the "Obtain an IP address automatically" setting, you can allow it to use DHCP for configuration information.

On a Mac running the classic Mac OS, you have reliable support for DHCP from System 8 onwards. There had been DHCP options for Open Transport since it first came out, but it was not very dependable until the version of OT that came with System 8.

On a Linux box and with Mac OS X, you can also specify that DHCP is used. DHCP was originally designed to ease the burden of setting up TCP/IP on Unix systems, so your Unix-derived OS will handle DHCP very well.

However, if you are dealing with older machines running Windows 3.1 or earlier versions of the Mac OS that either use early versions of Open Transport or MacTCP, you cannot use DHCP. Those machines have to have a static IP to connect to your WAN router and the outside world. In a home network, sometimes it's a lot handier to use static IPs for connecting your computers. By using static IPs and either maintaining a "hosts" file linking your computers' IPs with friendly names (or doing like I do and just keeping a written-out list of which IP goes with which box), you can utilize TCP/IP servers and clients to pass files back and forth between your computers, regardless of their operating system. That's the beauty of open standards.

In my network I have PCs running Windows, PCs running Linux, and Macs of various vintages running versions of the Mac OS that range from 7.1 to 8.5.1. The Mac OS has Web sharing, Windows has the Personal Web Server for Windows9x and the version of IIS that comes with Windows 2000 Pro and with Windows XP. And a Linux box comes with all the servers you'd want - Apache for the Web and FTPd for FTP. Mac OS X also comes with Apache. Behind a firewall you can run any number of services which will enable your networked machines to communicate with each other and swap files. The point is to make sure nobody from the outside can use them, and that's where your firewall/WAN router box comes in.

When you give your machines static IPs, you have to be on the same subnet as your firewall/WAN router. Like I said before, my SMC Barricade uses the 192.168.2.0 network and automatically gets 192.168.2.1. You can use any number from 2 to 254 for your machines. I have everything using low numbers (from 2 to 150) on my network. Since DHCP is handy for guests to come in and use with their laptops, I have the internal DHCP server handing out addresses from 151 to 254. As if I'm really going to have 103 guests here! ;-) 255 is a number you can't use because it means "broadcast to everyone on the subnet." And the TCP/IP network uses zero to denote a network address.

There is also something called a subnet mask that is used to tell TCP/IP which bits mean the network and which mean the host or individual computer. You will probably never encounter one that isn't 255.255.255.0. This mask tells the routers out on the Internet and your firewall/WAN router box that the first three of the four IP address numbers are used by your network, and the fourth one is the individual address of each computer. One can do a lot of funky stuff by changing numbers around in a subnet mask, from further dividing a subnet into smaller subnets to concatenating several subnets into one big subnet - that's called supernetting. But that's not our concern here. Your firewall/WAN router box is designed to keep things simple.

So when you input your static IP information, use the network address that the box defaults to, the host number you want to assign to a given computer, (remember, they must always be unique) usually the subnet mask of 255.255.255.0, and the pre-programmed IP address of your firewall/router box as the default gateway. The term Apple uses instead of default gateway is router - simple, right?

Before you put your firewall online, the first thing you will need to do is password-protect it. If you don't have a password on your device, a malicious individual could conceivably get in and mess around with your settings - or worse. Most software (SMC included) will not allow you to proceed further until setting a password. You need to use a strong password on the device. By a strong password, I mean

• One that is not a word in a dictionary. Many crackers use electronic dictionaries as lists of potential passwords.
• Uses both upper and lowercase letters.
• Uses numbers and punctuation marks.
• Is at least 6 characters long - longer is better.