The Internet Connection Firewall in Windows XP
- Overview
- Firewall Review
- Static Firewall
- Stateful Firewall
- The Internet Connection Firewall
- Enabling & Disabling the ICF
- Services Options
- Adding a Service
- Programs Options
- Security Logging Options
- Setting up Security Logging
- ICMP Options
- Adjusting the ICMP Options
- Understanding the ICMP options
- Issues to clarify before enabling Internet Connection Sharing
- Enabling / Adjusting / Disabling Internet Connection Sharing
- Summary of the ICF
This chapter is from the book
This chapter is from the book
This chapter is from the book
This chapter covers:
Overview of Microsoft's Internet Connection Firewall (ICF)
Firewall review
Enabling and disabling the ICF
Adjusting Security, Program, ICMP and Logging options
Understanding the Log file
Internet Connection Sharing and Bridge Connection issues for the ICF
Overview
A personal firewall can be defined as a software micro-firewall that works at any level of the TCP/IP stack to selectively block all or part of either inward- or outward- bound traffic. Although they have never been proven to provide a security benefit, personal firewalls are nevertheless a growing fad among home and small business users. While ineffective from a security standpoint, the growing use of personal firewalls does have an important side effect: they raise the awareness of security issues for the average end-user.
Microsoft, eager to demonstrate its new commitment to security, has integrated its own easy-to-configure personal firewall directly into Windows XP. According to Microsoft, the target audience for their Internet Connection Firewall is the new user who has an always-on broadband Internet connection and who is not aware of security issues.
The firewall has been designed to be as easy as possible to use in order to target non-sophisticated users. Microsoft has focused on streamlining the configuration process and on programming the majority of settings with common defaults.
However, as a network administrator, you should be aware of conflicts that the ICF can have for your users. Having a firewall built into the operating system is a potential source conflicts both with your enterprise security measures and with third-party vendor firewall products. For example, a user might complain that he cannot receive Remote Assistance help, when it fact it is his own ICF that is blocking him.
Nevertheless, the ICF can be useful in managing specific security issues. For power users, the firewall offers enough protection to use as a key component of a home office or small business security plan. Because of its integration with Internet Connection Sharing (ICS) and the Bridge Connection, the ICF can ensure that its host computer (and network) remains separated from outside attacks.
CAUTION
A Trojan horse on the protected side of the network can circumvent the ICF. The firewall will not protect against infected emails or vulnerabilities that are a result of 3rd party programs (e.g. web server software, FTP software, peer-to-peer sharing programs, etc...). In addition, the ICF will only block incoming requests for information, but will not block outgoing communication.