Do I need my router's firewall when using NAT?

Hi there,

As I understand things the NAT in my Zyxel P660HW-t1 router/modem will prevent any outside intrusions to my home network. No-one from "outside" can "see" either of my home computers, NAS drive, xbox (all on wired ethernet) or iphone (wifi).

In this case, do I need to run my zyxel's built in firewall? If I disable it will I become vulnerable in some way?

In case its relevant, I use a NAS drive which I have set up to be a local back-up for my computers and an FTP server. I use the FTP side to transfer files to/from work colleagues. I have obviously had to forward ports in my router to achieve this. AFAICT its all pretty secure and safe, password protected.

The router's firewall just seems to complicate my set-up and I'm not sure if its necessary anyway. Am I right in saying the firewall is only really useful when dealing with larger or more complex LANs - eg for blocking certain activities of those users on your LAN? I am happy for every and any user inside my LAN to do anything they want.

I am not a complete beginner to home networking but I'm still learning!

If its relevant we're all using macs here (except the xbox and NAS!)

NAT is a good first defence for security. However, a firewall is still handy to bolster that defence.

However, I'm not sure what the zyxel firewall actually does. Generally you want to stop all incoming packets that are not a response to an outbound request. You don't really need to block outbound unless you want to stop someone on your network from doing something (ie you might block P2P if you have kids).

When talking between things on the internal lan the router firewall wouldn't normally be involved (it normally sits between LAN and internet, not between devices in the LAN).

All comes down to what exactly the zyxel is firewalling. If it is internal LAN stuff then I would disable it. If it is blocking incoming connections I would leave it enabled. It blocking outbound connections then I would only enable if I needed it for something specific.

Thanks for the response, Ian72

The firewall can affect all directions. wan to lan, lan to wan, lan to lan, wan to wan. Its default state is to block WAN to LAN and WAN to WAN but allow activity within the LAN, and LAN to WAN.

When things are blocked you can set up rules to allow certain traffic eg "block WAN to LAN but allow port x"

When things are allowed (eg LAN to WAN) you can set up individual rules to block certain things (eg FTP port 20).

You can also set alarms to be raised or logged when traffic does a particular thing (eg x tried to access y)

Its a regular firewall I guess.

With NAT switched on though the outside world still wont see my FTP server for example, no matter what the firewall is allowing/forwarding. It it only if I set the NAT server table to forward certain ports to particular LAN addresses that the firewall has any effect.

My feeling is that the firewall is there in case you need it. Perhaps you don't want to use NAT for some reason but want to be able to block certain activity for eg.

It seems to me that in my case I don't need this firewall as I have NAT switched on. I want to keep things simple. "just switch everything on" doesn't necessarily lead to better security. I am far from a network expert though and I wouldn't be surprised if I'm "missing something" here.

I welcome thoughts and comments

cheers

I'm not sure I fully get where you are coming from.

With NAT enabled a single port can only ever be forwarded to a single IP - you can't just open the FTP port and expect to be able to get at all machines. If you want that then it is NAT you would have to disable and you would need public IPs for all the PCs to be addressed externally.

In reply to a post by ian72:

I'm not sure I fully get where you are coming from.

With my NAT enabled, I am simply wondering if disabling my firewall will make my LAN vulnerable or less secure in any way. If so I'd like to know in what way. I don't want to switch on my firewall "just for good measure" without knowing how its helping me.

My previous ramble was in response to the last paragraph of your first response.

I can see reasons for maybe using both NAT and the firewall for office/corporate style networks, say with guest laptops connecting to wifi etc but for more meagre home set-ups like mine, I wonder if the firewall is just complicating matters.

In summary, is NAT alone (no firewall) safe enough?

I suspect that with NAT adding the firewall will make a pretty small difference to security. The firewall may even be there primarily for those who drop NAT and go for public static IPs in which case a firewall would be essential.

I'm not going to say you will be bullet-proof if you don't implement the firewall but the chance of getting a security issue because you hadn't is small.

Cheers for you time and thoughts Ian72.

Good to have confirmation in such matters

Just to add (if it helps) that I've had no firewall other than NAT for many, many years now without incident.

But it is important to understand that NAT's firewalling effect is strictly one way, you are protected from the outside world, but there is absolutely nothing that NAT can do to prevent a compromised device on your network spamming the rest of the internet. (Which is, incidentally, where a lot of Spam comes from).

Maintain a tight ship and that risk is low, and you save yourself the hassle of maintaining an outgoing firewall which can often seem more of a hindrance than a help.

In reply to a post by medwayman:

Just to add (if it helps) that I've had no firewall other than NAT for many, many years now without incident.

What incident were you expecting ?

Surely if someone is hacking into your network, the last thing he/she would want would be to make you aware of it ?

Thanks medwayman,

That does help.

I totally concur about keeping a tight ship. Firewalls are only one part of keeping your system secure and, it seems to me, their usefulness "depends". It would be foolish for anyone to to think they are fully insulated from internet nastiness just by switching a firewall on and running virus checkers. Indeed I am of the opinion that keeping things simple and "being aware", is far more likely to result in a reliable, safe system.

cheers