>If you do use a software firewall for w2k or w2003 servers:
>1. What do you use?
I have been evaluating a product called "CHX-I Packet
Filter" (http://www.idrci.net/). I had been looking
for a lightweight packet-filtering option for some of
my Windows Servers similar to the software firewalls
that are available with Sun Solaris 10 (IP Filter)
and other UNIX varieties. I wanted to avoid most
of the application-based firewalls that display
"pop-ups" to warn of possible intruders or unknown
applications. With the packet-filtering option, I
disable all ports by default and then enable only
the ports and IPs (or MAC addresses) of the traffic
that I need to pass in/out.
Similar packet-filtering rules can be implemented
within the "Local Security Policy" using IPSec, but
I don't believe the IPSec rules perform stateful
inspection and I don't think there is an option
for logging which can be useful when setting up
and troubleshooting new filtering rules.
>2. Can you copy the firewall rules for backup or use on another machine?
Yes - very easily.
>3. Have you used any tools such as performance monitor to determine the
>software firewall's affect upon system resources such as cpu time and
Not yet. Still evaluating. Mostly concerned with setting
up the packet-filtering rules at the moment. Have read some
postings on various message boards that stated CHX-I was very
good at using limited resources.
>4. Does this require a yearly subscription?
Free for personal use, but not for commercial use. When I
contacted the company regarding use in an educational environment,
that wanted to push a campus site-license. However, since I
was only interested in about five machines, I was granted
permission to use the software for free. As I mentioned, I
am still evaluating - there doesn't seem to be too many bells
and whistles with this product, but from what I have seen so
far, it seems to do what I need it to do and that is packet-filtering,
plain and simple.
James T. Brown
UNIX Systems Administrator
Geography/Fisheries & Wildlife
Michigan State University
email: [log in to unmask]