Workgroup Setup

I want to do the following;

1 workstation containing 2 NIC's, I realize that I have to setup 1 card with
an static IP address, have this computer access the internet via 1 card and
the other card access the workgroup. All workgroup computers shall access the
internet via the computer that has the 2 cards.

My question is do I need a firewall on all workgroup computers or just the
one that access the internet directly? I will have anti-virus on all PC's.

TIA

Steve
Sun May 04 22:41:40 PDT 2008

On Sun, 4 May 2008 18:13:01 -0700, SteveL
<SteveL@discussions.microsoft.com> wrote:

>I want to do the following;
>
>1 workstation containing 2 NIC's, I realize that I have to setup 1 card with
>an static IP address, have this computer access the internet via 1 card and
>the other card access the workgroup. All workgroup computers shall access the
>internet via the computer that has the 2 cards.
>
>My question is do I need a firewall on all workgroup computers or just the
>one that access the internet directly? I will have anti-virus on all PC's.
>
>TIA

Enable Internet Connection Sharing on the 2-NIC computer's Internet
NIC, which will automatically assign a static IP address to that
computer's LAN NIC. Don't configure the LAN NIC settings yourself.

All computers should have a firewall to protect them from LAN-based
threats. XP's built-in Windows firewall is fine for that.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

SteveL
Mon May 05 06:06:01 PDT 2008


Thank you for the response, so what you are saying is that I have to have a
firewall on the, let's say, the 2 computers in the intranetwork. What is the
purpose of a firewall if it is going to allow outside activity to bypass the
PC that is hooked up to the internet.

"Steve Winograd" wrote:

> On Sun, 4 May 2008 18:13:01 -0700, SteveL
> <SteveL@discussions.microsoft.com> wrote:

> Enable Internet Connection Sharing on the 2-NIC computer's Internet
> NIC, which will automatically assign a static IP address to that
> computer's LAN NIC. Don't configure the LAN NIC settings yourself.
>
> All computers should have a firewall to protect them from LAN-based
> threats. XP's built-in Windows firewall is fine for that.
> --
> Best Wishes,
> Steve Winograd, MS-MVP (Windows Networking)
>
> Please post any reply as a follow-up message in the news group
> for everyone to see. I'm sorry, but I don't answer questions
> addressed directly to me in E-mail or news groups.
>
> Microsoft Most Valuable Professional Program
> http://mvp.support.microsoft.com
>

Steve
Mon May 05 09:33:49 PDT 2008

On Mon, 5 May 2008 06:06:01 -0700, SteveL
<SteveL@discussions.microsoft.com> wrote:

>> Enable Internet Connection Sharing on the 2-NIC computer's Internet
>> NIC, which will automatically assign a static IP address to that
>> computer's LAN NIC. Don't configure the LAN NIC settings yourself.
>>
>> All computers should have a firewall to protect them from LAN-based
>> threats. XP's built-in Windows firewall is fine for that.
>
>Thank you for the response, so what you are saying is that I have to have a
>firewall on the, let's say, the 2 computers in the intranetwork. What is the
>purpose of a firewall if it is going to allow outside activity to bypass the
>PC that is hooked up to the internet.

You're welcome. I didn't say that outside activity will bypass the PC
that's hooked up to the Internet. I said to enable a firewall on the
intranetwork computers to protect them from LAN-based threats (ones
that come from other computers in your own network). For example, a
user on one computer could open an infected attachment and become
infected with a worm. That worm could try to send itself to the other
computers over the LAN.

I see no disadvantage to running a firewall on every computer. Do you?
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

SteveL
Mon May 05 19:08:00 PDT 2008

Hey Steve thanks again for replying, the firewall will not help you if a PC
gets infected do you not agree? If a PC gets infected by a virus the only
thing that will stop the infection is an anti-virus pgm.

So to answer my question if I have a firewall on 1 PC and the others access
the internet from this PC they will be covered by the same firewall correct?

1 more question if I may the PC that will be connected to the internet also
is a remote station I have a person that connects via the internet and does
some work.
This is currently in place but all 3 stations connect to the internet
through a single route. I am trying to make it more secure with less software
to be installed on each PC, I do not like the Windows firewall so I do not
use it, I use a third parties.

Thanks again for any info.

Steve

"Steve Winograd" wrote:

> You're welcome. I didn't say that outside activity will bypass the PC
> that's hooked up to the Internet. I said to enable a firewall on the
> intranetwork computers to protect them from LAN-based threats (ones
> that come from other computers in your own network). For example, a
> user on one computer could open an infected attachment and become
> infected with a worm. That worm could try to send itself to the other
> computers over the LAN.
>
> I see no disadvantage to running a firewall on every computer. Do you?
> --
> Best Wishes,
> Steve Winograd, MS-MVP (Windows Networking)
>
> Please post any reply as a follow-up message in the news group
> for everyone to see. I'm sorry, but I don't answer questions
> addressed directly to me in E-mail or news groups.
>
> Microsoft Most Valuable Professional Program
> http://mvp.support.microsoft.com
>

Steve
Mon May 05 23:32:10 PDT 2008

On Mon, 5 May 2008 19:08:00 -0700, SteveL
<SteveL@discussions.microsoft.com> wrote:

>> You're welcome. I didn't say that outside activity will bypass the PC
>> that's hooked up to the Internet. I said to enable a firewall on the
>> intranetwork computers to protect them from LAN-based threats (ones
>> that come from other computers in your own network). For example, a
>> user on one computer could open an infected attachment and become
>> infected with a worm. That worm could try to send itself to the other
>> computers over the LAN.
>>
>> I see no disadvantage to running a firewall on every computer. Do you?
>
>Hey Steve thanks again for replying, the firewall will not help you if a PC
>gets infected do you not agree? If a PC gets infected by a virus the only
>thing that will stop the infection is an anti-virus pgm.
>
>So to answer my question if I have a firewall on 1 PC and the others access
>the internet from this PC they will be covered by the same firewall correct?

A firewall on the Internet-connected computer will protect the other
LAN computers from direct access by malicious Internet users.

But it won't protect the other LAN computers from threats that
propagate on the LAN.

If one computer gets infected by a worm, firewalls on the other
computers can prevent the infected computer from infecting the other
computers.

For that reason, I recommend running a firewall on all of the
computers.

>1 more question if I may the PC that will be connected to the internet also
>is a remote station I have a person that connects via the internet and does
>some work.
>This is currently in place but all 3 stations connect to the internet
>through a single route. I am trying to make it more secure with less software
>to be installed on each PC, I do not like the Windows firewall so I do not
>use it, I use a third parties.

I'm sorry, but I don't understand this question. I recommend that you
post a new message, with a descriptive subject title, and give as much
detailed information as possible.

>Thanks again for any info.
>
>Steve

You're welcome.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com