A firewall protects a computer against unauthorized access by hackers, hijackers, nefarious websites and malicious software. All firewalls, except the one integrated into Windows XP, also block threats already on your computer from communicating with the perpetrator or a third party so that hackers can’t gain access to your personal data or computer. Hardware and/or software firewalls are essential components of computer security.Reviewers have not done the best job keeping pace with reviewing software firewalls. Because several companies have merged or gone out of business, many slightly older reviews are no longer relevant. For example, PC Magazine and PCFlank.com (a security site) have excellent reviews, but haven’t reviewed enough current versions of programs to provide a useful basis for comparison. Consumer Reports mentions firewalls in passing in some of its outdated security software articles. Some other reviewers do a better job of keeping pace.
Computer Shopper, InformationWeek and Matousec.com offer very good reviews supported by testing. Reviewers test each firewall program for its ability to monitor incoming and outgoing traffic, including tests for port-scan attacks and leak tests. Firewall Leak Tester doesn’t review products, but tests all major firewall programs with leak tests. A leak test is a malware program that tries to connect to an outside server from a computer to give a hijacker access. Reviewers also try to disable the software, as some malware programs try to do. While features and ease of use are important, technical performance is the most important buying consideration for firewall software.
The sources covered in our report review both commercial and free programs. Commercial programs generally include updates for one year, with automatic updates. Most of the commercial programs have 30-day free trials, but setting up and training a firewall is a time-consuming hassle that few people would want to repeat. You can buy a standalone firewall program or an integrated Internet security suite. Suites also include antivirus software, a spam filter, anti-spyware software and parental controls. They are cheaper to buy than separate programs and most are more convenient to use. However, the consensus of reviewers is that standalone programs are more effective. See our report on Internet security software for more information.
Symantec’s Norton brand is the best known and best selling brand of computer security software, but Norton Personal Firewall 2006 (*est. $45) garners mixed reviews. British magazine Computer Shopper is one of the few sources to recommend the program. It blocked all web-based attacks in their tests. Norton Personal Firewall 2006 produced above average results in Firewall Leak Tester’s leak tests. But other reviewers say Norton Personal Firewall can be frustrating. Serdar Yegulalp of InformationWeek.com says “its desperately sluggish interface makes it a chore to use.”
While the average rating for Norton among professional reviews is in the middle of the pack, people who have tried to use it in the real world reach a much stronger consensus. Amazon.com customers unanimously disparage the product. Installation problems were prevalent, and tech support responded slowly and couldn’t solve problems. Customers also complain about system drag, conflicts with other security software and crashes. Enough customers have reviewed Norton Personal Firewall 2006 to raise a red flag. Symantec has not yet released a 2007 versionA firewall is a barrier between the Internet and your computer. The computer term is named from physical firewalls in buildings or cars that block fire from spreading. A firewall is also analogous to a lock on a door: it prevents those without keys or access codes from entering. Firewalls enforce security policies. These policies or rules are in the form of built-in (usually user-controlled) filters that permit access only to authorized users.
There are two types of firewalls: software firewalls and hardware firewalls (such as those built into routers). Both examine the data that comes from the Internet and into your system. When packets of information enter your computer, the filters examine them for the source of the data and the destination of the data. The firewall does this by comparing this incoming information to the criteria set or established by the filters. If the information passes scrutiny, the information is forwarded on to its destination. Any unacceptable data is deleted or blocked before it reaches your hard drive.
Firewalls can also control the traffic that comes into and out of your computer system. A good firewall is customizable. This means that you can add or remove the filters that you want. With a firewall, you can set up these rules to restrict the information that is allowed to enter your home computer or network. Practically speaking, these rules give you control over what websites people can view or what activities they can perform. Users can grant or deny access to specific sites, and most firewalls have a preapproved list of common, reputable websites, which shortcuts configuration.
Every computer has a unique numerical IP address, which is used to identify your particular computer on the Internet so you can receive e-mail and view websites. A firewall’s filters can hide your computer’s IP address, making your computer invisible to hackers. Your computer uses ports to connect to various services. HTTP (Internet), for example, uses port 80. FTP (file transfer protocol) uses port 21. A firewall can close unused ports to prevent an attacker from entering through an open port. Another firewall filter can block specific domain names. You can also configure the firewall to prevent FTP activity (which allows you to upload or download files to and from the Internet). There are also filters relating to words or phrases, which allow you to block access to sites containing objectionable material.
Software firewalls vs. hardware firewalls
Software firewalls work differently than hardware firewalls, but the two can be used together to create a powerful level of security. Hardware firewalls are devices that sit between the Internet and your computer. If you own a router (wired or wireless), for example, it probably includes a hardware firewall. A main advantage of hardware firewalls is that they use no system resources because they work independently of your computer. They can also protect multiple computers on a network at once. They can be more difficult to customize, especially for beginners, but hardware firewalls are usually effective even without configuration. Since a router has its own IP address, potential hackers can’t see your computer; they can only see the router.
Software firewalls provide some of the best protection against viruses, worms, Trojans and other malicious programs. One disadvantage of software firewalls is that they can slow down system performance, especially if you have an older computer. Software firewalls monitor both incoming and outgoing traffic. A flaw of a software firewall is that it doesn’t totally hide your IP address from the outside world. It closes unused ports and monitors traffic to and from open ports. Radio host Kim Komando recommends a combination of hardware and software firewalls.
If you use your computer mainly for e-mail and casual web surfing, a software firewall is probably all you need. However, if you use your computer for work, store financial information on it, or use online banking, then you should also consider a hardware firewall. If you have a wired or wireless router, it likely already includes a hardware firewall. Wireless routers are covered in our wireless router report.
Windows XP and Vista firewalls
If you use Windows XP or Vista, you are already protected by their included firewalls, but most reviews still say you will likely be safer with a third-party firewall.
Windows XP includes a rudimentary firewall, but it only protects against inbound threats. Microsoft’s new operating system, Windows Vista, includes a more robust firewall that also protects against outbound threats. Microsoft is touting security enhancements as a main reason for upgrading. Most of the reviews we found of Vista are of beta versions in various stages of development. Computer magazines are brimming with excitement and criticism about Vista. In spite of the buzz, no one has tested the performance of the Vista firewall yet or compared it with third-party firewalls. We do cover a couple of good reviews that focus on Vista’s security features and evaluate the look and feel of its firewall.
The Windows XP firewall is turned on by default when you install Service Pack 2 (SP2). SP2 also includes a Security Center that allows you to easily control the Windows firewall, as well as third-party firewalls and antivirus applications you may have running. With SP2 installed, Windows will alert you when updates are available for third-party security applications.
The consensus among reviewers is that the Windows XP SP2 firewall is merely adequate. Reviewers such as PC Magazine’s Neil Rubenking say that several free third-party firewalls are a significant upgrade from the XP firewall. WebUser.co.uk’s Brad Jackson describes the default option as “a workable measure of protection for those who don’t like the setting up and interaction involved in other firewalls, and would otherwise be going unprotected.” Yet, he adds, “However, this is a risky strategy and we’d thoroughly recommend installing one of the more sophisticated firewalls instead.”
Because the XP firewall only monitors inbound threats, Computerworld.com’s Scot Finnie and Preston Gralla say that “If your PC [is] invaded by a Trojan or spyware, those programs would be allowed to make outbound connections unimpeded.” Reviewers say that this is the key reason why they recommend using a third-party firewall. To rely completely on the SP2 firewall, you’d need to be certain that your computer harbors no intruders already, such as previously downloaded programs that might be dialing out. In that case, blocking inbound traffic might be enough.
Other firewalls not only block incoming traffic, but also monitor Internet activity initiated from your computer. This enables them to catch intruders that have been planted in your computer, and are trying to pass personal information and files to a tracker, hacker or hijacker.
At least on paper, the Windows Vista firewall is a big improvement since it monitors outgoing traffic as well as inbound traffic. If you already plan to upgrade to Vista or buy a new computer, you may wish to use a free firewall program in the interim, and wait to learn whether the Vista firewall will be adequate for your needs. It’s also not clear at this time which third-party firewalls will work with Vista. Microsoft says that BlackICE (*est. $40) and Norman Personal Firewall (*est. $30), two programs that performed poorly in reviewers’ tests, aren’t even compatible with Windows XP Service Pack 2.
Patrick Marshall of Federal Computer Week (FCW) says of Vista, “The new firewall is more configurable than firewalls in previous versions of Windows, but it still does not match the configurability of most high-end hardware firewalls.” Reviews in FCW and ComputerWorld imply that the Vista firewall interface is complicated to use. We’ll revise our report when more reviews firm up their opinions on the Vista firewall.
Best software firewalls
For a third-party firewall, more experts recommend ZoneAlarm Pro 6.5 (*est. $40)
more than any other program. A basic, bare-bones ZoneAlarm firewall is free (http://www.zonelabs.com), but not as robust. The latest version of ZoneAlarm Pro is bundled with anti-spyware software as a bonus. ZoneAlarm Pro includes identity theft protection, spy site blocking, privacy protection, and a new feature called game mode that allows the user to turn off program alerts (like a “do not disturb” sign).
ZoneAlarm Pro is rated as the best software firewall by Personal Computer World and CNet.com. CNet’s Robert Vamosi claims that ZoneAlarm is fast and efficient. Vamosi says, “As new threats emerge, ZoneAlarm Pro 6.5 is able to pass along new firewall rules and, in the case of extremely malicious activity, shut down any program that attempts dangerous activity.” He also likes the interface.
Although Matousec.com isn’t satisfied with any of the firewall programs it tests, the organization concedes that ZoneAlarm is the best of the bunch. It performed very well in most tests. ZoneAlarm Pro ranked in the top three programs tested for leaks by Firewall Leak Tester. Computer Shopper and InformationWeek recommend the free version of ZoneAlarm, which is a very stripped-down version of ZoneAlarm Pro. A review at PC Today says, “Even the free version includes an up-to-date interface and well-thought-out design.” The free version does need a lot of user configuration. After installing ZoneAlarm, you must respond to numerous confirmation popups to teach ZoneAlarm what programs are allowed. ZoneAlarm Pro does a lot of this work for you, with a preapproved list of several thousand highly reputable websites.
ZoneAlarm Pro automatically disables the Windows XP SP2 firewall to prevent conflicts. Technical support is free on the Internet, including chat and a user forum, but phone support costs $2.95 per minute. Only a few ZoneAlarm Pro 6.5 users have posted comments or reviews on websites that invite customer reaction. All the CNet.com readers complain about conflicts with other software, which is a common complaint about other ZoneAlarm products. ZoneAlarm, Norton and McAfee products experience the highest percentages of conflicts, according to owners reporting trouble.
If concern about conflicts or other issues discourages you from considering ZoneAlarm Pro, reviews also recommend Agnitum Outpost Pro. Outpost Firewall Pro 4.0 (*est. $40) is the salutatorian of firewall programs — ranked number two by many review sources. Outpost Firewall Pro produced the second-best results in Firewall Leak Tester’s “outbound application filtering” tests. It is ranked as the second-best program by TopTenReviews.com, Matousec.com and Adware Report.
Outpost Firewall Pro will automatically update itself. It blocks popup windows and unwanted ads in web pages. It protects itself from being disabled or shut down by attacks. Outpost Pro has its own version of ZoneAlarm’s game mode. Computer Shopper asserts that Outpost is very easy to use. Firewall Leak Tester recommends the program based on its technical performance.
Reviewers are mixed about the value of Kerio Personal Firewall 4 (*est. $20). Kerio Technologies used to offer a commercial version for $40 and a stripped-down free version. When Sunbelt acquired Kerio Personal Firewall in December 2005, Sunbelt discontinued the free version and halved the price of the commercial version.
Computer Shopper says Kerio Personal Firewall is the best in its class and an exceptional value as well. The UK magazine says, “With its good range of features, simple interface and a great price, Kerio is our preferred standalone firewall for those on a budget.” Personal Computer World concurs, “Kerio Personal Firewall is a safe bet for those on a budget.” The program produced average results in Firewall Leak Tester’s leak tests.
PCFlank.com’s Andrew Cooper does not recommend the program “because it failed to block some security risks” in his tests. He does like Kerio’s ease of use and features, such as blocking a variety of advertising including popups and pop-behinds. Matousec.com is completely unsatisfied with Kerio’s security capabilities, saying, “Kerio could be classified as an average packet filter with a nice interface, not a personal firewall.”
On the other hand, Computer Shopper says, “The interface is nearly identical to ZoneAlarm’s, but the program is more powerful and has more levels of user control.” You can password-protect the firewall, manage cookies, protect privacy and manually configure security levels. Instead of Kerio Personal Firewall, PC Magazine says you should consider Comodo Personal Firewall (discussed below), a free firewall that outperforms all but the highest-rated paid firewalls.
Sygate Personal Firewall Pro was highly regarded in its time, but Sygate was acquired by Symantec last year. Symantec develops Norton security products. The company has discontinued the highly regarded free version of Sygate, but says it will continued to develop the paid version.
Free software firewalls
For non-business users, free firewalls may give you enough protection, especially if you are using a hardware firewall as well (such as a wireless router). Free firewalls often don’t have as many customizable features, and they can take more work to configure. One of the best-known free firewalls is the free version of ZoneAlarm. In coverage at PC Magazine, editors say ZoneAlarm is a good firewall for those using older Windows operating systems, but overall testers recommend a different free firewall.
PC Magazine designates Comodo Personal Firewall 2.0 (http://www.comodogroup.com) the best free firewall. Neil Rubenking had previously reviewed four free firewall programs, including free versions of ZoneAlarm (since updated) and Kerio (since discontinued), and concludes that Comodo is much better. Rubenking asserts that Comodo “works as well as all but the best for-pay firewalls.” Comodo survived a dozen leak tests. Rubenking enthuses, “It keeps hackers out and tricky unauthorized programs off the Internet, and it resists being terminated.” He also likes Comodo’s “spiffy interface and impressive performance.” Rubenking’s only criticism is one that he says is a problem with most firewalls: users must deal with popups to accept each program on their computer when first opened after installation. Comodo has been upgraded to version 2.3.4 since the PC Magazine review.
We found no other professional reviews of this program, but PC Magazine readers and amateur (but geeky) reviewers on the Tweaks R US website report mixed experiences with the free Comodo firewall. The same types of issues that many people have with commercial security products, such as installation and system drag, are expressed about Comodo. Comodo Personal Firewall aced PC Magazine’s leak tests, but only produced average results in Firewall Leak Tester’s tests, well below ZoneAlarm Pro and Outpost Pro.
Jetico Personal Firewall v.1 (http://www.jetico.com/) is another free firewall. A beta version of version 2.0 is also available. Jetico Personal Firewall lets you choose and edit a predefined security policy or create your own. Remarkably, no commercial program produced better results in Firewall Leak Tester’s leak tests.
At Personal Computer World, reviewer Chris Wiles compares Jetico favorably to the Windows XP firewall. Personal Computer World rates the program 4 stars on a 5-star scale. The rating equals that of two commercial programs, Kerio Personal Firewall and Outpost Personal Firewall Pro, and is only topped by ZoneAlarm Pro. However, in a review at CNetDownload.com, editors say Jetico is too confusing for all but those with experience in Internet security. According to CNet: “How should the average user reply to the prompt svchost.exe is attempting to communicate with the Internet. Should this be permitted? No tutorials exist to guide you through the configuration process either.”
Mac firewalls
Macintosh pundits disagree about the need for security. Apple’s operating systems are structured differently than Windows operating systems and are less vulnerable to attack. Also, since Apple systems represent a minority, they have been less attractive targets for hackers. Mac users running OS X already have a firewall included in the operating system. By default, the Mac firewall closes the most-exploited ports, requiring users to actively enable ports for file sharing, print sharing or personal web hosting. Rebecca Freed, in her article for PC World, writes that the Mac OS X firewall “has some advanced features, including activity logging and a stealth mode. If enabled, the stealth mode makes your Mac invisible to incoming data inquiries, which is essentially the same thing that hardware firewalls do.” Freed notes that users do need to turn on the Mac firewall, which isn’t turned on by default. However, the firewall settings are a little hard to find. You can find them under System Preferences>Internet & Network>Sharing.
SecureMac reviews ContentBarrier (*est. $60), DoorStop Firewall (*est. $50), IPNetSentry (*est. $60), NetBarrier (*est. $70) and Norton Personal Firewall (*est. $60) . Programs are rated on a 5-point scale. DoorStop is only rated 4 (out of 5); the other four programs get the highest rating. As all the programs receive rave reviews, this review isn’t very valuable.
Macworld also reviews Norton Personal Firewall and DoorStop Firewall. Both are rated higher than the integrated Mac OS X firewall, but reviewer Jeffery Battersby seems to believe a third-party firewall is unnecessary. Like the Windows XP firewall, the OS X firewall only protects against inbound threats. Battersby gives little indication that he or Macworld tested the performance of any of these firewalls. Norton Personal Firewall is top-rated, however. It is “simple and effective.”
Several free firewall programs have been developed for Linux. None have been formally reviewed.
Important Considerations: Firewalls
Experts recommend keeping these factors in mind when selecting and using security software:
- If possible, start with a clean computer. If burglars were already in your house, you wouldn’t just install a new lock and then expect to be safe. Similarly, it’s wiser to install a firewall before your computer is already harboring anything nasty. It may take more than one anti-spyware application to catch all the spyware on a computer. See the ConsumerSearch reports on anti-spyware and antivirus software for recommendations.
- Reviews recommend using a (wired or wireless) router with its own firewall as
the first layer of protection, with the software firewall as the second. This is worth consideration even if you don’t have a network. (See the ConsumerSearch report on wireless routers for details.)
- Though you have security software installed, you must still monitor your Internet behavior. Research before clicking on an ad or download, and don’t open e-mails or attachments that look suspicious. Stay up to date about the latest Internet dangers by browsing computer news sites or subscribing to e-mail alerts. (See the Best Research section below for recommendations.)
- Disable file and printer sharing if you aren’t using this feature.
- When choosing a firewall, be sure to check system requirements. Choose the correct version for your operating system. All work with Windows XP, but some don’t work with older operating systems.
- Update security software regularly. Be sure your software is set to check for updates automatically, preferably at least once a day. Most security software does this automatically.
- After the firewall is installed, test that it’s working properly. Use a testing site like Security Space Desktop Audit (http://www.securityspace.com) or one of the websites listed in the Best Research section below to make certain your firewall is working properly and is configured correctly.
- Turn on auto-updates or regularly check the Microsoft website for security updates and patches to the Windows operating system. It doesn’t take long for hackers to exploit vulnerabilities in Windows operating systems, and keeping your system up to date is the best foil. If you’re running Windows XP, be sure to update to Service Pack 2.
>> Firewalls prices
Consensus Report
* Also see our Comparison Chart.
Reviewers recommend ZoneAlarm Pro over any other software firewall. Many of the same reviewers rate Outpost Firewall Pro as the second-best program. At half the price of the top two programs, Kerio Personal Firewall is specifically recommended by two British computer magazines as the best budget choice. PC Magazine ranks Comodo Free Firewall as the best of the five free firewalls it has reviewed. Computer Shopper rates Norton Personal Firewall 2006 a Best Buy, but other reviews aren’t as positive. Jetico Personal Firewall produced the best results in Firewall Leak Tester’s leak tests, but hasn’t been featured in mainstream reviews.
Advertisement — report continues below
Alternative Considerations
If you want to avoid installing a software firewall, there are some options. Most reviews say you could get by with the one-way firewalls included with Windows XP and Max OS X, especially if you don’t use your computer to store banking and financial information, or other sensitive personal information. Windows Vista includes a two-way firewall that has not yet been subjected to full reviews or extensive tests. Early reviews suggest that existing third-party firewalls are still better than Microsoft’s new offering, but for many home users, the Vista firewall may be fine.
If you need other security software as well as a firewall, Internet security suites include firewall, antivirus, anti-spyware, anti-spam and parental-control components. See the ConsumerSearch report on Internet security software . The top-rated firewall program, ZoneAlarm Pro, includes anti-spyware software.
A wired or wireless router with an integrated firewall is an excellent first line of defense. Routers can be complicated to configure, but experts note that they provide good protection even with no configuration. They won’t tax your system’s resources at all, and most experts say they are more effective than software firewalls. If you need to protect a network of small business computers, experts recommend a dedicated hardware firewall.
Experts who address the subject say that a software firewall in tandem with a router provides the best protection for a home user or home network.
Best Research
The National Cyber Security Alliance offers tips for online security: http://www.staysafeonline.info/
An October 2004 article at PC Magazine, “You Need a (Properly Configured) Firewall,” offers a simple explanation of firewalls. This article also suggests an approach that simplifies setting up a newly installed firewall, a process that can be confusing: http://www.pcmag.com/article2/0,1759,1647698,00.asp
It can be confusing when a firewall asks permission to let a program on your computer access the Internet. Windows has many tasks running in the background whose names are not likely to be familiar. You can look up information about such tasks to find out if they are “good guys” or invaders: http://answersthatwork.com/
PCStats.com offers a Beginners Guide: Firewalls and Internet Security for those wanting to learn about firewalls: http://www.pcstats.com/articleview.cfm?articleID=1450
Solutions Review has a tutorial on setting up ZoneAlarm Pro: http://www.solutionsreview.com/ZoneAlarm_Pro_Setup.htm
ZDNet offers guidelines for securing a wireless network: http://reviews-zdnet.com.com/4520-7297_16-5540710.html
You can test your system’s security at any of these sites:
Shields Up – www.grc.com/x/ ne.dll?bh0bkyd2
PC Flank – http://www.pcflank.com/about.htm
Audit My PC – http://www.auditmypc.com
Security Space – http://www.securityspace.com. A basic audit or a single test is free.
HackerWhacker – http://hackerwhacker.com. The first test is free.
Staying up to date:
PC Magazine has a weekly online newsletter called Security Watch: http://www.pcmag.com/category2/0,1738,1356337,00.asp
Home PC Firewall Guide has a list of the newest titles and improvements. This is a detailed online guide to personal firewall software. You can find tips on how to make your computer more secure, including information on firewalls and antivirus software: http://www.firewallguide.com
Shields Up! offers in-depth analysis of the potential dangers to your system. Software developer and security expert Steve Gibson outlines what the dangers are and how to combat them: https://grc.com/x/ne.dll?bh0bkyd2
AntiOnline has anti-hacking and antivirus news and advice: http://www.AntiOnline.com
These sites and articles can help you learn more about firewalls and how to use them:
HowStuffWorks explains “How Firewalls Work” – http://computer.howstuffworks.com/firewall.htm
Internet Firewalls: Frequently Asked Questions – http://www.interhack.net/pubs/fwfaq/
Global firewalls “outbound application filtering” ranking – http://www.firewallleaktester.com/tests.php
Firewalls FAQ – http://www.faqs.org/faqs/firewalls-faq/
Macworld article, “Protect your Mac: 18 ways to safeguard your data and your privacy right now” (June 19, 2006) – http://www.macworld.com/2006/06/features/protectmac/index.php
Vicomsoft offers a comprehensive explanation of what firewalls do and how they work called “Firewall Q&A” – http://www.vicomsoft.com/knowledge/reference/firewalls1.html
Software developers’ websites:
Agnitum Outpost – http://www.agnitum.com/
Comodo – http://www.personalfirewall.comodo.com/
Jetico – http://www.jetico.com/
Netbarrier (for Mac) – http://www.intego.com/netbarrier/
Norton – http://www.symantec.com/
Sunbelt Kerio Personal Firewall – http://www.sunbelt-software.com/Kerio.cfm
ZoneAlarm – http://www.zonelabs.com/