The great thing about having broadband Internet access is that your door to the Internet is always open. Turn on your computer, and you've turned on your access. That's also the bad thing about it. The Internet is a two-way street, and if your computer's downloading from it at high speeds, hackers could be sneaking out your personal files just as quickly.

Whether you can understand their motives or not, there are bored or malicious souls out there with software that scans IP addresses at random, rattling the virtual back door knobs to see whether they're locked. If they find an open door to someone's computer, they might choose to spy on their files, or take over the computer completely to perpetrate some more wide-reaching mischief.

Either way, it's a nuisance you want to avoid, and the best way to avoid it is by installing a firewall. Like the architectural feature from which its name comes, a firewall stops the spread of disaster. But in most other ways, network firewalls are far more flexible than their bricks-and-mortar equivalent. They can be configured to let traffic through (more like a fire door), and sort out who gets in and who doesn't (like a security guard).

Firewalls come in two basic flavors--software and hardware--and we'll be concentrating on hardware firewalls in this article. It's not that hardware firewalls are necessarily better than programs like ZoneAlarm or Symantec's Personal Firewall, but they do have the advantage of being platform-independent and able to protect a small network with a single installation.

Why a firewall?

So you feel secure online. Want a rude awakening? Visit Steve Gibson's Web site. Gibson's one of the good guys, but if you visit two pages on his Web site, you'll see that he knows how the bad guys think. Click on the Shields Up! link and then the Test My Shields and Probe My Ports buttons. GRC.com will show you the IP address of your computer, and which of its back doors are open. If you're not running a firewall, the list of vulnerabilities will be quite scary.

One of the best reasons for installing a firewall is having Windows as your operating system. Microsoft's easy-to-use networking comes at a cost: The client for Microsoft Networks and its File and Printer Sharing components are bound to the Internet's TCP/IP protocol, which in turn is bound to all of Windows system adapters. Basically, this means that once a hacker gets onto a regular Windows computer, he's got access to everything.

And by default, many ports are left open. In some cases, software you may have installed deliberately opens ports without warning you. Some versions of ICQ, for example, run a built-in Web server that keeps your port 80 open. (To disable this, check out your Buddy List window for the Services button, select My ICQ Page, and uncheck the option that reads Activate my home page.)

So the basic role of a firewall is to close the ports that shouldn't be open, and to conceal as much about your computers as possible. To do this, a firewall will inspect and analyze all the network traffic to your computer (a process called stateful packet inspection), and do its best to conceal the presence of your computer's ports from all unauthorized access. Sometimes, the concealment isn't too smart. Some firewalls report the presence of a port, but say it's closed (an invitation to serious hackers to try and open it). The most effective firewalls "stealth" or conceal ports-they refuse to respond to any software that pings them. Hardware firewalls also perform network address translation (NAT), which conceals the computers in your workgroup's network behind a single IP address.

How to build a firewall

For this article, we tested three hardware firewalls: the Linksys EtherFast Cable/DSL Router, D-Link DI-604, and Microsoft's Wired Base Station MN-100. All three combine firewall protection with four-port routing for home networking. In each case, because a firewall has to sit between your computer and the Internet, we powered up the firewall and plugged it between the cable modem and the computer previously attached to it. We ran a configuration program that channeled Internet traffic through the firewall/router's MAC address, and reset the broadband modem so it would sync up with the firewall (this is a step that wasn't clear when installing Microsoft's firewall/router, which led to some frustration during setup).

All of them passed the grc.com's tests for concealing (stealthing) the most vulnerable ports right out of the box. They all also concealed the IP addresses of several machines on the test network. Only the firewall box's IP address appeared, no matter which machine on the network visited the site.

So far, so good. But there's more to a good modern firewall than closing and concealing your computer's ports. In some cases, you'll want ports to be open (but still secure, of course). For example, e-mail virus-scanning software needs to sit between your e-mail server (with your ISP) and the e-mail software on your hard disk (Outlook, Eudora, and the like). To do that, some antivirus software runs its own POP proxy server on your port 110. The port may be open, but it's monitored by a "security guard" of its own, so it's more secure than a port left open carelessly. A less secure but equally legitimate use of these ports is for running a Web server on your hard disk, which will keep ports 80 and 433 open.

Administration tools

Because networking's such a technical subject, hardware firewalls need good administration tools to help non-technical users change settings with ease. And that's pretty much where all hardware firewalls fall short, since the devil's in the details. All three firewalls we looked at suffered from the same problem: If the firewall blocks a service (say, an SMTP mail activity), you don't get an explanation or useful error message, just a failure of a software application to perform a task. And any failure without an explanation leads to frustration.

For this reason, you need to educate yourself about ports and their functions if you're going to do adequate diagnostics. Although the customer-friendly help screens in the low-cost D-Link DI-604 and Microsoft's Base Station MN-100 do a fair job of broad explanation, you'll need more information if you want to start mucking around with settings safely.

In each case, the configuration of a firewall requires only a browser and password. The configuration tools reside in the firewall itself, using Web pages you can load in Netscape Navigator or Internet Explorer. (Microsoft's browser doesn't trumpet this fact, encouraging you to run a Base Station Management Tool menu from its Broadband Network Utility, which loads a series of HTML pages from the firewall's IP address in a modified Internet Explorer window).

Run a DMZ: While all the firewalls we looked at let you set up a demilitarized zone (DMZ) for multi-user gaming or teleconferencing, only the Linksys router had its own Ethernet socket specifically designated for a DMZ computer. In each firewall, the DMZ function is turned off by default (since it essentially opens a hole in the firewall for unrestricted traffic), but can be turned on equally easily through the Web-based administration pages.

View logs: Since the whole point of a firewall is to keep intruders at bay, it's useful to see logs of attempted access. Microsoft's base station dropped the ball here. The only logs we could find were network log-ins by authorized computers, no hack attacks. The D-Link DI-604 gives you the choice of what to log--attempted attacks, access to blocked sites, and so on. However, it didn't log our port-scanning test (which it passed with flying colors) as an attack. The Linksys firewall again wins out in this category, letting you group logs by system, access, firewall, and VPN entries, and providing a Log viewer program to boot.

Set up virtual private networking (VPN): With home and off-site offices increasingly needing to tap into the corporate network, virtual private networking is a necessity. However, while all these firewalls allow you to set up VPN, only the Linksys router offers a VPN end point for secure remote connection. The others do VPN using pass-through. For corporate remote office applications, this makes the Linksys EtherFast Cable/DSL Router the obvious purchase choice.

Restrict Web access for individual computers: While this isn't strictly a firewall process, it's a good networking feature that makes sense for a router being marketed for its security features (like the three firewalls we looked at). In each case, using the slick Web-based interface, you can restrict access to Internet functions based on time (so there's no Web surfing on school nights, or when the cleaner's left alone in the house, for example). We were surprised, however, that Microsoft's tool insisted on your entering the numbers assigned to the outbound ports to block without actually explaining or listing the port assignments.

Hardware and software

One of the most telling elements of dealing with these three hardware firewalls is that the most security-conscious of them all--the one from Linksys--has an option you can set that requires Zone Labs' ZoneAlarm to run at all times. Why the belt-and-suspenders approach? We installed ZoneAlarm (both the free downloadable version from the site and the pay-to-use ZoneAlarm Pro with Web Filtering) to see. A week of running ZoneAlarm taught us more about how many regular Windows programs were accessing the Internet than three weeks of tinkering with hardware firewalls. ZoneAlarm raises a flag every time a program tries to access the Internet. Better yet, when you upgrade a program, it raises a flag again--a great way of alerting you if a Trojan horse has taken over a program without your knowledge. Yes, it can get a little wearing to be alerted constantly, but if you're looking for a real sense of security (and isn't that the whole point?), two firewalls are better than one.

Firewall features you should know about

Stateful packet inspection (SPI): A must for any firewall, packet inspection does what it sounds like: It examines all the packets of information flowing through the Internet connection. What makes such inspections "stateful" is the interpretation of the packets or the analysis of whether they're being requested by the computer behind the firewall or not.

Network address translation (NAT): Each computer on a network behind a firewall has its own address. A routing firewall hides them all behind a single IP address, so that only one (secured) address can be seen by Web sites and hacking scripts.

Demilitarized zone (DMZ): This useful extra feature, like its military equivalent, is a safe place for people on one side to meet folks from the outside. In computing, it's an IP address (a computer on your network) that's opened to unrestricted two-way traffic, so you can conduct multi-user gaming or teleconferencing from behind a firewall. The computer that's exposed in this way needs its own protection, from a software firewall like ZoneLabs' ZoneAlarm or Symantec's Personal Firewall.

Virtual private networking (VPN): If you need to establish a secure link to a corporate office, the ability to allow tunneling protocols is essential. Most firewalls use a VPN pass-through technique (supporting IPsec or PPTP protocols); only robust firewalls like Linksys' EtherFast Cable/DSL Firewall Router let you configure encryption and authentication settings.