A couple of very good free firewall programs you might consider installing include

* ZoneAlarm from http://www.zonelabs.com
* SyGate from http://www.sygate.com

TIP

If you really like the idea of a firewall scanning for viruses, spyware, and hackers as they cross the digital threshold, consider the SonicWall TZ 150, a $300 router/firewall hardware combination designed for small business that scans for malware and downloads signatures automatically several times an hour.
Hardware Firewalls

Hardware firewalls are devices that physically sit between your computer and the wire that goes out to the Internet. Although businesses usually use a device that is physically separated from their other network gear, at home you’ll find a firewall built into home network routers.

Some of the many advantages to hardware firewalls are

* They are fire and forget. Install them and you are protected. No tweaking needed.
* They are included in the price of a device that shares your Internet between computers (meaning you can share your Internet connection with other computers in your home). No fees or extra costs.
* They have no impact on the system performance of your computer.

Easy Defense with a NAT Firewall

Home network routers have a firewall feature built in that uses a technology called network address translation (NAT).

It’s not a firewall technology itself, but it offers a firewall-like feature that provides natural protection from Internet nasties, such as hackers and worms.

TIP

If you install a third-party firewall on Windows XP, the XP Security Center should detect it and turn off the Windows Firewall because running two is redundant, could cause conflicts, and can slow down the computer unnecessarily. If for some reason you find that both Windows Firewall and a third-party firewall are running at the same time, simply open the Control Panel, choose Security Center, click on the Windows Firewall button, and turn off the firewall.

The Windows XP Security Center monitors the presence of a software firewall (in this case ZoneAlarm) and, on detection, turns off the Windows Firewalls to avoid redundancy.

NAT was invented because of a shortage of IP addresses available to the ever-growing Internet population. Sounds complicated but it’s not really. An IP address is like a phone number for each device connected to the Internet. Every device on the Internet has an IP number. An IP address is a set of four three digit numbers that can’t be any lower than 0.0.0.0 or higher than 255.255.255.255.

If you can surf the Internet on your computer right now, it has an IP address. Because there’s a shortage of IP addresses, not everyone can have her own. So NAT devices were invented to help.

This Netgear router uses network address translation (NAT) that hides the identity of computers connected to it.

NAT routers work like this: Every large company has a switchboard. Everyone dials one central public phone number to talk to the company operator. When they reach the operator, they ask for an extension and they are put through.

NAT works like that. The router has an IP address that everyone on the Internet can call (it’s like the switchboard). Behind the router is a home network. Each computer on the network has a private IP address (like a phone extension).

NOTE

Under the current IP address scheme, called IPv4, there’s only 4,294,967,296 possible addresses in the world (although not all of those addresses are available for reasons that only bona fide, card-carrying geeks care about). Experts predict that those addresses could all be used sometime before 2020 unless our uber-geek friends come to the rescue. However, under a new plan called IPv6 there are 340 undecillion addresses, which is a really, really, really big number. According to wikipedia.org, that’s 670 quadrillion IP addresses per square inch of Earth. If that is too big to fathom, trust me when I say that if I had that many mallomars, I’d be fat and probably dead.

When data from the Internet arrives for one of those computers, it is sent to the NAT router and the NAT router looks up the computer on its network (in a handy little directory it keeps) and checks to see which one made the request.

The router hands the data off to that computer. This is built-in security because no one on the Internet can send data to a computer behind a router directly. They always have to go through the router first.
Stateful Inspection: The Meticulous Traffic Cop

There’s one more level of security built into a NAT router that offers great and easy security. Let’s say your child’s computer, your computer, and your spouse’s laptop are all behind a router. Suddenly, in comes communication from a server on the Internet that hosts bumfluff.com.

The router looks at a list it keeps of all computers attached to it to see who initiated a request with bumfluff.com. When it discovers that none of the computers did, it realizes that bumfluff.com is a bad website that is actually a front for hackersncrackers.com. So it discards the request, and all is right with the world again.

NOTE

The acronym NAT can stand for network address translation or natural address translation. Like a cookie and a biscuit, it’s the same thing.

You see, in order to communicate with a computer behind a NAT router, that computer has to first communicate with you

In stateful packet inspection, a router only allows information through to a computer if the computer requested it.

So if I use my computer to contact bumfluff.com to see the latest news about mallomars (which are tasty marshmallow and chocolate cookies), the router notes that I am making contact. When bumfluff.com comes back to the router with information about mallomars, the router says, “Oh yeah, Andy’s computer has been communicating with bumfluff.com, so I’ll let it through.”

This is called stateful inspection or sometimes stateful packet inspection. All NAT routers engage in stateful inspection.