Best of the ISP-Lists

General

Caution: Internet Ahead

Firewalls are meant to protect computers. But members of the ISP-Tech list report that users who do not understand their firewall software may suspect that they're being hacked by their ISP.

[March 8, 2002]

On the ISP-Tech list in February, SV inquired,

"One of the most common problems these days are people who install a firewall and get it horribly wrong. Are your users locking themselves out of the 'net and burning away your tech support hours? How do you solve these problems?"

VB suggested that personal firewalls don't present too much of a problem:

"I don't think I've ever seen anyone lock themselves out of the Internet. The biggest problems by far are the 'you're hacking me!' messages from people who don't understand the firewall and have it set up to be way too paranoid."

Many others said firewalls do present a problem, and that the answer is to refer the customer elsewhere:

[RS noted] "I have had several customers shut down all TCP/IP traffic to and from their computers after installing new personal firewalls. Obviously, the most common problems are blocking commonly needed ports, or uncommon ports used by special applications. When we encounter a firewall user, we tell them that the added safety may not warrant the extra work for a typical dialup customer. If you are running a virus scanner and keeping it up to date, a firewall is not crucial. And we cannot be expected to support your personal firewall."

[KW agreed] "Sometimes I find that people have their firewall set up not to allow Internet Explorer to have access to the Internet. Once I find they have a firewall in place and things are not working, I get them to disable it. If things work, then I tell them it's set up wrong, I don't support the product, I can't help them set it up, and have a nice day."

JM observed that it's all too easy to block yourself out of the Internet:

"Hell, I keep doing this to myself! My firewall pops up a dialog box any time Internet Explorer encounters an odd TCP port connection. Don't ask me how anyone without a knowledge of TCP and UDP ports would be able to handle this. Invariably, in a flurry of allowing or blocking connections on some web site or application, I completely lock Internet Explorer off from the outside world. It usually takes me a few minutes to realize this. At that point, I usually wipe out all the rules and start over, in order to regain outside access."

BS added that corporate users can present additional challenges:

"My biggest issue is with people who have a laptop at home with a personal firewall. They bring it in to work, and complain that they can't connect to the corporate network. The first time this happened, I must have spent 40 minutes on the phone having them check cables, reinstall the network stack, etc. Finally, while waiting for the reboot, they mentioned that they were glad they had their firewall software, since it had kept detecting and blocking connections to and from the LAN ever since they hooked up…"

Finally, DC warned that personal firewalls may be annoying, but they are definitely worthwhile:

"Some time back, when I surfed to my home PC where I keep a simple web page of links and a way to activate my pager, I was horrified to see that my computer was telling the world, '#### the US government.' That's via a dialup connection, which I thought to be of no interest to the hackers of the world. Since then, I've installed all kinds of firewalls, intrusion detection software, etc., and I continue to be amazed at the number of attacks that my little dialup continues to receive."

—End