Linksys BEFSR11 router as a firewall?

[DavidRock]

Hello,
What is the difference between a router and a firewall? The above router says it can function as a firewall because it has "built-in NAT" technology. I only need to protect 3 PC's but do not wish to compromise on security. Are the two devices essentially the "same thing"?

Thanks,
David Rock

 

[pansophic]

A router and a firewall are certainly not the same thing, however, a router perform many of the functions of a firewall, and a firewall can perform many of the functions of a router.

I see a lot of routers these days that claim to be firewalls simply because they perform Network Address Translation (NAT).

NAT is certainly a first step towards filtering unwanted inbound traffic, and for many home users (who probably don't allow any inbound network connections) it is far superior to what they had before (nothing).

Firewalls can also perform "stateful packet inspection," which means that they look at every inbound packet and make sure that a connection handshake occured previously and is in their state list. If it isn't, the packet is automatically rejected, which blocks the half-open and half-closed scans that are so commonly performed across the internet. Many firewalls also offer application proxies, that allow the firewall to filter certain (possibly malicious) content in the connections, like Java in web pages or other active content in emails. And firewalls generally perform defragmentation, so that fragmented packets can't be used to DoS or avoid detection in an IDS.

But all of those extra features come at a cost. You have to understand and configure them in order to make your firewall useful.

So, if you are just using it to protect your home machines, and you aren't going to put up a server behind your router/firewall that accepts connections from the internet, then a router/firewall is probably close enough.
pansophic

 

[smah]

Well put, pansophic. I might add that a router will do nothing about outbound traffic, whereas a good firewall should alert you if there's packets being sent out that the user didn't initiate (like what would be caused by a trojan).