The article seems to be based heavily on personal preference and opinion, and not at all on any sort of metrics. At no point during the article did Mark state his requirements for a firewall system...instead, he simply pointed out the flaws he found in others (which, by the way, I agree with...to some extent). At the end of the article, Mark states, "It still amazes me that that an adequate, affordable firewall solution for Windows servers just doesn't exist"...yet at no point does he clearly state what an "adequate" solution consists of...

Why would anyone put a personal firewall on a server system? Why would anyone put *two* personal firewalls on a server system? The thought of putting a personal firewall on a server system is beyond me...let alone two of them. I've never completely understood the level of paranoia one has to reach in order to consider that. Come on, Mark...I know you're more knowledgeable than that! For example, take into considerations such as reducing the attack surface by limiting the running services.

It's not a hardware solution, but I'll throw a firewall out there for you to consider:
http://wipfw.sourceforge.net/

H. Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com




[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/307/30929#30929