Is it necessary to setup a firewall in both PC and router?

You have asked two different questions, the one in the title isn't the same in the body of your question. Having a firewall software directly installed on your machine isn't the same as setting up iptables.

Is it necessary? No

Will it give you an extra layer of security? Yes

Why?

Having a firewall solution installed on your PC isn't just about blocking bad IPs and closing ports. Many firewall software employ attack signatures that are able to detect many automated (as well as targeted) attacks on legitimate ports that you might be using.

For example you may want to enable SSH access to your PC to tunnel your traffic from an untrusted network. In this case you want to open the port 22, most primitive routers can't do anything other than closing/blocking access to that port. You want something to detect attacks, automatically blacklist offending IPs (although I prefer the concept of whitelisting).

One more important point, your source of attacks might not be only from outside networks. One of the machines inside your network could be compromised and used to launch attacks on the other unsuspecting machines.


There are advantages to both a hardware firewall and a PC firewall. The hardware firewall is isolated from your computer, which you run potentially bad code on that could compromise the integrity of the firewall. The hardware firewall may still have problems with it, but it is likely far harder to compromise. The disadvantage however is that a hardware firewall knows very little if anything about what program is making an outgoing connection. It is best at keeping out intruders as opposed to keeping bad things from getting out to the Internet since that would take far more complex configuration of denying any connection that isn't explicitly configured as allowed.

A software firewall on the other hand runs on your computer and is aware of the application that is trying to access the network. You can allow things at a much more granular level and it will do more to prevent a bad program (or even a good program) from accessing the network in a way you don't want it to, but the down side is that a smart bad program may be able to disable the functionality of the firewall and get past it.

Tags:

Firewalls