confused re: firewalls

[mactalla]

Forgive this extremely uneducated question about the necessity of firewalls.

For an individual home workstation, I'm having difficulty understanding the necessity of a firewall (we're talking about a Gentoo system kept up to date here). As I understand it, a typical firewall setup is to allow all outgoing connections and replies to requests initiated from the computer, but to block all new incoming connections. And my understanding of ports is that a port must be opened by an application who then listens on that port. So if no application is listening on a port, then you automatically don't receive any connections from the outside, right? And if you have an application which listens on a port, then typically it's because you WANT to receive connections. So then it only comes down to rogue applications (such as spyware or malware), which is rather a non-issue (so far) while we remain with only reputable open source software.

So then where is the need for a firewall? What am I missing / what do I misunderstand?

many thanks.

[think4urs11]

[lxg]

A firewall in Linux is different from what Windows users know as firewall. Usually, with firewall we mean a low-level filter (TCP/UDP and below) that filters connections on ports, network devices and by some other criteria (e.g. remote host). It is not some sort of "Personal Firewall" that is being sold to novice PC users and is a mixture of a firewall and a so-called ALG (Application Level Gateway; a high-level filter as for example Zorp).

You need a firewall if you run a server, mostly in order to (a) prevent common low-level (in the above sense) attacks like different flavors of DoS (Denial of Service) attacks and (b) in order to prevent unwanted connections to the outside (e.g. a malicious service or user wanting to run his own IRC server ).

Surely, you could abstrain from using a firewall on a home machine. Some people say it is hard to configure and use iptables. This may be true for iptables itself; but there are great and easy to use frontends for iptables like firehol, shorewall, (both command line with easy syntax), firestarter (GTK/Gnome) and guarddog (KDE), just to name some. So I'd suggest you to set up a firewall anyways, it's easy and you'll gain extra security.
_________________
lxg.de – codebits and tech talk

[mactalla]

Thanks for your replies, I appreciate it!

[atomopawn]

There are also many other reasons you might want to use a firewall at home. With a little fancy iptables work, you can set up rudimentary parental controls (block all internet access after 10:00pm, for instance), attach several systems to a single IP address (with NAT), circumvent ISP limitations by forwarding non-standard ports to standard ones (for instance, running a web server on port 80, but also forwarding TCP 8880 packets to port 80), limit the number of packets that can cross the firewall in a certain period of time (to prevent DoS attacks) and much, much more. Of course, you may not have a need for any of these little tricks -- but they can be fun and very, very useful.