What firewall should I choose for my new PC with dial-up?

February 2, 2004 10:29 AM

Just got a PC at home. On a dial-up service and would be grateful for any suggestions for a good firewall/protection package (preferably free).
posted by Frasermoo to computers & internet (21 comments total)

ZoneAlarm.
posted by majcher at 10:41 AM on February 2, 2004

Kerio > ZoneAlarm.
posted by Danelope at 10:44 AM on February 2, 2004

Is it a Windows machine? If so, there are a ton of packages advertised as firewalls (although they are actually packet filter and access control systems, which is something slightly different from an actual "firewall"). I liked earlier versions of Tiny Personal Firewall which used to be free but appears to cost money now, as well as ZoneAlarm, which I liked at the time but seems to have accreted many more features of questionable value since.

If it's not a Windows machine, the answer will be quite different.
posted by majick at 10:48 AM on February 2, 2004

I would recommend ZoneAlarm, also.
posted by Blue Stone at 10:59 AM on February 2, 2004

If you're on dial up, you don't necessarily need a firewall. It depend son your usage.
posted by Orange Goblin at 11:07 AM on February 2, 2004

If you're running Windows XP there is a basic built-in firewall...
posted by Lynsey at 11:08 AM on February 2, 2004

I used to recommend ZoneAlarm, now I disrecommend it. I say go with Kerio. XP's basic firewall stuff is not very good and not at all transparent, so it's best not to use it IMHO.
posted by ursus_comiter at 11:43 AM on February 2, 2004

Yeah.... same with me, ursus. Kerio seems pretty darn good, so far, especially for the cost. Not that I was particularly unhappy with ZoneAlarm, mind you -- it's just that I prefer free stuff to stuff I have to pay for.
posted by ph00dz at 12:10 PM on February 2, 2004

Sygate Personal Firewall (free for personal use). Kerio has too many features that don't interest me (pop-up and ad-blocking, for example). I'd rather use a program that does one thing and does it well and SPF is just such a program. Using a firewall on dialup seems like overkill to me, though.
posted by TimeFactor at 12:13 PM on February 2, 2004

Can those recommending Kerio over ZoneAlarm say why they prefer Kerio? ZoneAlarm does exactly what I want - it blocks unauthorized access attempts to my computer and lets only the programs I tell it to access the internet. It seems to do this 100% reliably. If it is not doing this reliably, and Kerio does this better, I'd really like to know. If, however, as TimeFactor suggests, Kerio simply does more things that I really don't need it to, then I'll stick with ZoneAlarm. Can anyone cast away the shadows here? From my limited understanding I'd refute that you don't need a firewall on dial-up - without a firewall ones machine is exposed regardless of bandwidth - is this a misunderstanding on my part? Again if anyone can help...
posted by nthdegx at 12:19 PM on February 2, 2004

Not that I was particularly unhappy with ZoneAlarm, mind you -- it's just that I prefer free stuff to stuff I have to pay for.

Zonealarm is still free for personal use.

I second nthdegx. It'd be much more helpful if people could articulate reasons why they prefer one product over another. This will help the rest of us decide if those reasons apply to or are important to us. thanks.
posted by vacapinta at 12:42 PM on February 2, 2004

Hmmm... didn't know that. I paid for ZA, apparently not knowing that there's a free Zone Alarm version. Honestly, I had no complaints about it at all, I just thought I had to continue to pay for it and get upgrades.
posted by ph00dz at 2:53 PM on February 2, 2004

Since you're on dialup, you probably don't even need a firewall, as you probably won't be keeping the same IP address for very long -- thus, thwarting hackers trying to get at you.

However, if your goal is to monitor what sort of traffic in and out of your computer there is ... stuff like software phoning home, etc., then I'd say Zone Alarm is a pretty good choice.
posted by crunchland at 3:07 PM on February 2, 2004

phoodz, the second part of my comment was addressed more to danelope and ursus_comiter who offer no reasons whatsoever why they think kerio is preferable to zonealarm.
posted by vacapinta at 3:49 PM on February 2, 2004

Reasons I prefer Kerio to ZoneAlarm:

1. Kerio's free version provides a multitude of features basic ZoneAlarm does not, including Web filtering (cookies, popups, etc.), automatic intrusion detection and lockdown, application monitoring (to selectively prevent apps from launching other apps, which is often the case at the start of virus/worm propagation), etc..

2. Any of the features you don't need can be easily disabled (or re-enabled) with a single checkbox.

3. Kerio's interface is more streamlined, informative, and professional than ZoneAlarm. It's also not bright screaming yellow.

Whether any of these factors matter to you is entirely subjective.
posted by Danelope at 4:35 PM on February 2, 2004

Since you're on dialup, you probably don't even need a firewall, as you probably won't be keeping the same IP address for very long -- thus, thwarting hackers trying to get at you.

With every new Windows worm and self-propagating virus introduced onto the Internet, having a barrier against infection becomes more and more important. Hackers are the least of your worries when IPs are unendingly and randomly being bombarded by CodeRed, Nimda, and countless others, even years after they were initially discovered.

Plug an unpatched Windows machine into any network connection (dial-up or otherwise) and I can all but guarantee you'll have at least one infection before Windows Update has the chance to complete. Particularly when you have 100+ MB of patches to download via a dial-up connection.
posted by Danelope at 4:41 PM on February 2, 2004

"Since you're on dialup, you probably don't even need a firewall, as you probably won't be keeping the same IP address for very long..."

Please excuse my bad attitude but that's utterly misinformed and dangerously bad advice. Nobody and no exploit cares how long your hardware has been allocated its current IP address. Attackers go after whole blocks of addresses, regardless of who or what is there.

It only takes a few seconds to turn the average Windows box into a zombie which will cheerfully tell an IRC channel full of script kiddies your current address and accept commands to do their bidding, no matter how many times you've hung up and reconnected or how much bandwidth it has to the network.

Saying that is like advising someone to skip the condom because they aren't going to be in there that long anyways.
posted by majick at 5:30 PM on February 2, 2004

Thanks for all the advice. Even though we are on dial-up, the machine is on for a long time.

I'm gonna have a look at the recommendations.
posted by Frasermoo at 12:47 AM on February 3, 2004

I just installed Kerio and Zonealarm on my system (altho not at the same time). Kerio uses almost none of the resources, while ZA uses up a whopping 11%. Kerio offers some useful items such as pop-up -under blocking etc, which ZA doesn't. Kerio was so effective, as a matter of fact, that it wouldn't allow me to connect at all to the internet, even though my ISP said that I was indeed connected. Final analysis: ZoneAlarm allowed me to connect and surf, which makes it better. Win98SE, btw.
posted by ashbury at 6:32 AM on February 3, 2004

Follow-up question (since, as usual, the crowd on AskMeFi is so incredibly helpful): I use XP's Internet Connection Firewall (linked by Lynsey above). Does that work as advertised to block incoming connections? Is there anything I'm vulnerable to that I wouldn't be with Kerio or ZoneAlarm? And why is it that my machine still accepts connections for Kazaa Lite?
posted by fuzz at 7:16 AM on February 3, 2004

Windows ICF is essentially a really feeble packet filter. Yes, it will block some incoming connections, but doesn't allow for much flexibility in configuration. You're better off with a product that gives you some choice as to how you control incoming connections.
posted by majick at 10:26 AM on February 3, 2004