Hi all! I have configured home network consisting of 2 PC's each connected to a DSL router equipped with NAT/firewall. The internet access goes via router of course. Do i need separate firewall software on each of the machines at all ? like zonealarm, or ICF... The machines are DHCP clients, and are assigned LAN ip adresses, so i wonder if thay are seen at all from WAN which makes firewall unnecessary? Help me here please ;) Thanks, Amn.

Most router has built-in firewall. If correctly setup (99% user doesnt), it will be secure enough to protect all computers.

How do set it up correctly? My NAT table is empty , i.e no port/adress redirection is specified. Firewall is enabled.

No port redirection is the highest security, that means nothing can get in.

What about packets SPECIFICALLY telling router to pass via gateway...so called router messages or something...Have you ever heard about those ? Thanks for great help so far, Amn.

Sid is right, No port redirection is the best security. NATing mode prevent incoming connection onto your computer. However, good security rules also control outgoing connection. Then in the [filters] section of your router, you should add some rules that restrict outgoing port you really need. common rules are: port tcp/80 - ALL port tcp/443 - ALL port udp/53, tcp/110, tcp/25 - ISP only block all other ports from 1 to 1023, and disable ICMP protocol if possible. Some router also have a "Stealth mode" that should be enabled. Why restriction outgoing connection? Simply to prevent worm propagation and trojan from providing personnal information. Second reason, if someone break into your system, he will not be able to use it to attack others.

But really, what about packets still coming in to my machine behind the router ? A while ago, when i still had ZoneAlarm installed, i sometimes had got alerts of incoming blocked connections from global hosts (Internet)...i was wondering how did they come through ???.... THis means obviously, some incoming packets indeed bypass router. And that might be serious reason for personal firewall on each DHCP client ? Anyways, thanks for all the posts, i hope this benefits others with similiar issues.. Amn.