SDSL router running NAT. how secure is it?

[wardog25]

My small business has an SDSL modem/router as its connection to the internet. It is running NAT, but nothing else.

How secure is this? Do I need a firewall? Any recommendations? We have about 70 users if you are curious.

 

[fs483]

You should always have a firewall and anti-virus software both on the server and the workstations. A router will give you a better fighting chance but can still get into a lot of problems without a firewall.

 

[bcastner]

I like very much the discussion here:

http://www.broadbandreports.com/faq/security#4

 

[MaxPipeline]

NAT is not a good substitute for a firewall. Although NAT by nature drops any incoming packets not in it's NAT table by default, this does nothing if you have an infected PC on the inside sending requests out to the Internet. It would be wise to have a firewall between the router and your PC's. Or at the very least have personal firewalls configured on your PC's There are some free ones out there that do a decent job. Do a search for firewalls on downloads.com. I'm partial to ZoneAlarm mself.

 

[wardog25]

We have like 70 users, so zonealarm on every one would be fairly annoying. Any reccomendations for a good firewall for the router?

 

[MaxPipeline]

What make and model is your router? Does your router even have firewall capabilities? If not then you might have to install another piece of hardware between your router and the rest of your network. The costs of these vary considerably, but one possible inexpensive solution is to set up a spare PC as a proxy server and run your firewall on that machine. There are plenty of threads that describe how to do this on this board.

As for each individual PC, it is still a good idea to have some sort of personal firewall on each machine.

 

[wardog25]

Netopia is all I can remember off the top of my head. But it is just an SDSL router/modem provided by the DSL company. I doubt it is capable of much of anything.

Why bother setting up a firewall on each machine if you have a proxy server with one?

 

[MaxPipeline]

It is still a good idea for protection from viruses and trojans for example. In case one of your 70 PC's pickes up a virus or trojan it shouldn't affect the other 69 PC's. In this day and age of hackers, worms, viruses, trojans, spyware, etc. you can never have too protection. Of course your level of security is really up to whatever your comfort zone is. So perhaps for you individual PC firewalls maybe overkill. But to me I think you can never be too careful.

One more thing. Windows XP has Internet Connection Firewall built in. If your PC's have WinXP you can simply turn it on if it isn't on already. But Win2K or earlier does not have this feature. Just thought I'd throw that out there as well.

 

[cdogg]

That's right. The proxy acts as a buffer between your LAN and the internet, not between network resources within your LAN. In a large network environment, placing a firewall on each workstation is overkill, since a higher level solution needs to exist on each server. However in a smaller environment such as yours, having one on each might not be a bad idea. It's not necessarily overkill, and a little pain now can save a lot later.


~cdogg
[tab]"All paid jobs absorb and degrade the mind";
[tab][tab]- Aristotle
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884