ZoneAlarm vs Native Firewall on windows

windows-firewall

Which is the benefits to use ZoneAlarm instead of windows native firewall? Is it really necessary?

Best Answer

It can be argued that no, it's not necessary. Depends on your configuration. For home systems, for example, you normally have a limited number of systems inside the network, and those few systems are in turn shielded by a NAT'ed router.

ZoneAlarm does offer more refinement and reporting of what is running and trying to access the network, though. As I recall it was more involved to set up (it would prompt me when any new program or updated program was trying to access network functions) and you would allow/disallow individually; it gave statistics on what is running, and you could "shut down" network access for everything with a click.

Windows firewall works, but reporting tends to suck, and it's not quite as fine-grained.

It's been awhile since I used ZoneAlarm but that's what I remember of it. I often wished the controls to Windows' built-in firewall were like ZoneAlarm. I thought of it as kind of like Process Explorer from Sysinternals is to Task Manager. They both perform similar functions, but man...process explorer is nicer. But not necessary, per se.

Plus ZoneAlarm gives you more control, which means it's more confusing for the layperson. Techies, sure. Average users will just click through whatever pops up. So it's not something to install on Mom's computer and walk away.

Related Solutions

How to know currently open ports on the Windows Firewall

The reason you can't get the same results using the same commands is that the Win7 firewall rules can be specific to an individual application, and configured per network type (Private, Domain, Public), protocol, port, etc. Powershell should give you a much better way to query this information and sort it. Here's a quick script I have to dump my configuration, when I need it.

Function Get-EnabledRules
{
    Param($profile)
    $rules = (New-Object -comObject HNetCfg.FwPolicy2).rules
    $rules = $rules | where-object {$_.Enabled -eq $true}
    $rules = $rules | where-object {$_.Profiles -bAND $profile}
    $rules
}

$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"))
 $connections = $networkListManager.GetNetworkConnections()
[int[] ] $connTypes = @()
$connTypes = ($connections | % {$_.GetNetwork().GetCategory()})
#$connTypes += 1
Write-Host $connTypes

$connTypes | ForEach-Object {Get-EnabledRules -profile $_ | sort localports,Protocol | format-table -wrap -autosize -property Name, @{Label="Action"; expression={$_.action}}, @{Label="Protocol"; expression={$_.protocol}}, localPorts,applicationname}

A lot of this was based off of this post on MSDN

Blocking web sites with Windows Firewall

Yes, you should be able to achieve that using the Advanced Settings of the firewall. But you will need to know all the ip addresses of the remote servers.

See this example which talks about ICMP but you can do the same for any traffic. The Scope tab would be of interest because that's where you would define the remote ip of the web server(s).

Best Answer

Related Solutions

How to know currently open ports on the Windows Firewall

Blocking web sites with Windows Firewall

Related Topic