A good rule of thumb is that any computer connected directly to the Internet should also be protected by a firewall. A personal firewall can be your ticket to strong intruder protection and peace of mind.

And now for the good news! If you are running Microsoft Windows XP Professional or Home Edition, Windows XP Media Center Edition, or Windows XP Tablet PC Edition, you've already got access to a built–in basic firewall. Microsoft Internet Connection Firewall (ICF) is included as a Windows XP networking feature and you should enable it if you need firewall protection. (If you've set up your Internet connection using the wizard and selected a direct or dial–up connection to the Internet, ICF may already be enabled.)

When running Windows XP, ICF opens and closes most ports on the firewall dynamically as you access services but there are a few exceptions. (See the Windows Messenger and ICF section below for details on manually configuring ports to enable file transfer and voice calls). Since Internet Connection Firewall provides inbound protection only, if you have concerns about programs that “phone home” or send outbound data to an unknown destination over the Internet, you may want to consider a third–party firewall.

Who Needs Firewall Protection?

You need protection if you have a direct, dial–up connection to the Internet, a single computer connected to a cable modem, or a single computer connected to a DSL modem. You'll also want to enable a firewall on the Windows XP–based host computer (and only the host computer) that is used for Internet Connection Sharing (ICS). If you're a broadband user with two or more ISP assigned IPs connected through a hub, you'll need to protect each computer individually. An easy rule of thumb—if a computer connects directly to the Internet, it needs protection.

To activate ICF:

Windows Messenger and ICF

Most of the time, my computers are connected wirelessly through one of my Network Address Translation (NAT) boxes that is connected to an AT&T Broadband cable modem. I'm waiting for UPnP firmware for these units that will enable Nat traversal so I can use all of the features of programs like Windows Messenger behind them. (Voice and video instant messaging were not working behind these NAT boxes when I wrote this column, but I'm hoping for firmware that will make this possible and when it arrives, I'll share information on the new UPnP NAT capabilities here in the Expert Zone.) When I wish to use the voice and video instant messaging real time communications (RTC) features, I connect a computer directly to my cable modem, and I enable the Internet Connection Firewall for these sessions.

Windows Messenger version 4.0, which ships with Windows XP, as well as the updated Windows Messenger 4.7 that is now available, also include the ability to transfer files. However, by default, ICF blocks file transfer and you will need to manually configure the appropriate ports to open. Here's how it's accomplished:

Additionally, you will have open Port 6901 for both TCP and UDP to receive incoming computer to computer voice calls and UDP Ports 6801, 6901, 2001–2120 for computer to phone voice calls.

As shown in the image above, I've enabled a single port only for a single file transfer only. The process to open ports to add other services is the same. Settings needed for some of the other more popular programs appear in the table below:

Security Logging and Trouble Shooting

If you want to examine incoming connection attempts, you can turn on logging from the ICF Advanced Settings tab as well as specify the size of a log file. If you're experiencing connectivity issues and need to trouble shoot your connection, the ICMP tab provides some configuration options for this purpose.

Some Special Circumstances

VPN Usage : If you're a VPN user and connect to a remote office, you should not use ICF. Turn it off before you start your VPN session.

File and Print Sharing : Some broadband providers offer connectivity for more than a single computer and supply multiple public routable IPs. In this case, computers are connected to a hub or switch (rather than a router or NAT box) that connects to a cable or DSL modem. Since ICF disables file and print sharing using TCP/IP, you may need an alternative method of sharing files among your own computers. You can install an additional network transport protocol such as IPX/SPX that will enable you to transfer files between your computers. To install IPX/SPX, from the Connection Properties dialog box, select Install , then select Protocol , Add and then NWLink IPX/SPX/NetBIOS Compatible Transport Protocol .

Outgoing Windows Messenger Calls Behind ICF: If you are using Windows XP Professional, ensure you are using an account with administrative privileges; otherwise outbound calls will not work. (Users of Windows XP Home Edition are assigned the proper administrative privileges by default.)

Who Does Not Need to Enable Internet Connection Firewall?

If a computer is a client computer to an ICS (Internet Connection Sharing) host, do not enable ICF, but be sure you do enable it on the host computer. If a computer is behind a NAT box or router, don't enable ICF, because the inherent properties of NAT will protect you. If you're in an enterprise/corporate environment, don't enable ICF while logged into a domain at work because your IT staff will have proper commercial firewalls in place on the network. In most cases, user policies will prevent you from enabling ICF if you are logged into a domain. If you've logged on at home using cached credentials and enabled ICF, user policies will probably prevent you from using ICF at work, but you will be able to use it at home while not protected by the corporate firewall.

Barb Bowman enjoys sharing her own experiences and insights into today's leading edge technologies. She is a product development manager for AT&T Broadband Internet Services, but her views here are strictly personal.