Windows firewall, why does it suck, exactly?

Post by **ayu** » 23 Sep 2008, 10:48

Ok, on my Windows computer I use the Windows firewall, just because I only use Windows to play some games once in a while, so don't see a need for anything else.

Thing is, that every time I mention that I use it, someone always says something along the lines of "awwww man windows firewall SUCKS!! so buggy and full of holes!"

So....why does it really suck? The only reason that I think it's bad is because it can create trouble sometimes when allowing applications to pass it. But nothing more then that. So, is it really that bad? can it really be bypassed as easy as people say?

And are there any other reasons to why people hate it so much?

Post by **DNR** » 23 Sep 2008, 22:49

I just rather not use the firewall that came with the OS, I just trust another third party to monitor the OS. When I did use it, I thought it was too easy - it doing all the work for me, and yet not explaining what it did.
I like comodo.com.

DNR

Post by **bad_brain** » 24 Sep 2008, 05:01

well, the earlier versions (before SP2) REALLY sucked because there were loads of bugs, so it couldn't even be called a real firewall.
ok, the later versions seem to be better, but still outgoing connections can not be processed (what a surprise, users might block traffic to MS).
also the possibilities in packet processing are very limited compared to iptables....packet size, flags set, etc,...all this can't be utilized for rules in the MS firewall.
the maybe biggest problem is the fact that TCP/IP is still nothing but an application in MS and not implemented in the kernel like on *nix, and because of this the risk of potential flaws is much bigger.
there must not be even a flaw in the firewall app itself, a flaw in the underlying applications could make the whole firewall useless, on a *nix system there must be a kernel bug to make the firewall exploitable.....which is much more unlikely than a bug in an application, and such bugs are usually also much harder to exploit (at least it's nothing the average skiddy can do).

F4LSE · Post by **F4LSE** » 24 Sep 2008, 17:36

its made by windows... thus... sucky

Post by **ayu** » 25 Sep 2008, 00:25

Diagnol wrote:its made by windows... thus... sucky

Thought you said you used Vista

the king of suck ^^

Lyecdevf · Post by **Lyecdevf** » 25 Sep 2008, 00:35

I like to have a look at the logs from my firewall. In windows as far as I know that is not possible. It just sits there doing its job but I need more than that. Especially if I want to experiment with stuff. For instance I once put a windows box with ZoneAlarm on my LAN and port scanned from my linux box also on the LAN just for fun. ZoneAlarm of course showed me the logs of the event. No such thing is going to happen with the windows firewall. So I guess for experimental purposes the windows firewall is useless.

Post by **Stavros** » 25 Sep 2008, 00:40

Under Control Panel > Windows Firewall > Advanced tab the windows firewall is located at C:\WINDOWS\pfirewall.log. Of course you can change this to you're liking. All you'll need is something like Notepad or Wordpad to view the log file. That's simply for windows XP. I wouldn't know how to do it for Vista.

Post by **ayu** » 25 Sep 2008, 01:00

Stavros wrote:I wouldn't know how to do it for Vista.

Oh that's easy, just break into Microsoft's mother computer, and look for a file called "Big Brother Project 666", you'll find all your logs there I assure you.

F4LSE · Post by **F4LSE** » 25 Sep 2008, 17:42

cats wrote:
Diagnol wrote:its made by windows... thus... sucky

Thought you said you used Vista the king of suck ^^

ouch, caught me red-handed. :p

There should be a vista support group.

Hi my name is Diagnol and im a vista user...

Lyecdevf · Post by **Lyecdevf** » 25 Sep 2008, 23:42

Diagnol wrote:Hi my name is Diagnol and im a vista user...

Well to keep the discussion on the firewall, I have heard that Vista has a pretty good firewall. They put a lot of thought into security but forgot about the rest!

Post by **ayu** » 26 Sep 2008, 00:42

Lyecdevf wrote: They put a lot of thought into security but forgot about the rest!

Actually I think that if you call Microsoft and ask them about the security in Vista, they'll answer ".....what?"

Anyway....

So, before SP2, was there any known exploits in the Windows firewall? and are there any now?

Post by **bad_brain** » 26 Sep 2008, 03:10

one or two can be found here.
^^

Post by **ayu** » 26 Sep 2008, 03:42

bad_brain wrote:one or two can be found here.
^^

wow, damn xD

Well, I most likely wont have to use the Windows firewall anymore soon anyway, since my Linux gaming tests are going excellent at the moment ^^ (check Linux board).

But, those vulnerabilities, would those pose a threat today? (not that I have an updated box, so I'm most likely in the danger zone, but I don't usually boot into Windows if it's not for Photoshop or gaming business)

Post by **bad_brain** » 26 Sep 2008, 03:56

hm, the last vulnerabilities are from february 2008, but I haven't checked how serious they are.....I would say better the windows firewall than none at all. in most cases flaws in the firewall are used for DoS or to evade the firewall for following attacks against an underlying service.
the main problem is all that phone-home stuff which can't be blocked, so I don't recommend to use free *cough* software, at least not when being online....