A traditional firewall vs port forwarding household stuff

Question

What is the actually difference between port forwarding and a firewall?

So do these so called firewalls built into household adsl routers actually do anything to protect your network?

Answer 1

To touch on your 2nd question. The only thing that the consumer routers do is provide a NAT layer to your network. Most of them use what's called Stateful Packet Inspection to do this. Which is just a fancy way of saying that they keep track of all the connections that have been initiated from the LAN until they are destroyed by normal TCP/IP means or time out after a period of no activity. This does offer a network some level of security as the only traffic is let through is traffic that is initiated from inside the network. There are a few exceptions to this with UPNP and port forwarding which allow unsolicited traffic to be forwarded through.

What consumer devices don't offer that an enterprise firewall does at a basic level is the ability to have rules on incoming and out going traffic. For instance if you wanted to block traffic from or to a certain port or host. You can also have schedules that define when the rules are enforced. But as others have mentioned in some cases the enterprise hardware can also have additional functionality beyond a firewall but that's really beyond the scope of the question you're asking here.

Answer 2

Port Forwarding is one of many things a firewall is capable of doing. As to your second question it depends on the modem. Your question sets the bar pretty low ie are they better than nothing. I would say that yes most do offer protection. Are they going to be as robust and feature rich as a Cisco ASA 5505? No. Does that mean you need to go out and spend $400 on an ASA 5505? That also depends. If you are a home user the built in firewall in the adsl router/modem is probably good enough assuming it is turned on and properly configured. If you have a home office and want a robust set of security features plus support plus reliability then by all means spend $400 dollars. Otherwise just make sure that the firewall is indeed turned on and not wide open.

As an aside, I just used Cisco as an example. There are other options that you could consider like Watchguard, Fortinet, etc. if you were interested in a true soho firewall.

Answer 3

In my experience home routers lack the capacity, logging, accountability (RADIUS or TACACS support), complexity of ruleset, redundancy, reliability of hardware, number of physical networks supported, VLANs, VPN concentrators, intrusion detection sensors and a whole lot of other stuff you don't need in a home network.

Home routers are difficult to misconfigure, and complexity is the enemy of security... so I'd say that they're generally better than the big stuff... unless you need some of those features I listed.

Answer 4

Without getting in an argument about firewalls and protection, your single best protection is regular security patching and a firewall. The firewalls built into home routers do work as firewalls but cannot stop many of the self inflicted viruses/exploits/trojans that can infect a computer from simple web browsing. The same is true for Anti-virus software, most is next to useless for newer exploits or user inflicted (i.e. you clicking or visiting where you should not) exploits. In a home setup a port forward will expose the computer that is the receiver of that port forward to any potential attacks on that port.