myjulybabes, I too am a system admin, but I very rarely have to explain this stuff; it is a lot faster to hook it up myself while showing them. They also seem to have better retention of what I did

. Seriously, Windows XP (the part of the computers "Brain" that converts what you tell it to do into what makes sense to the computer) has a built in "Blocker", but it doesn't work that well. just about anyone can get by it. think of a little car driving from point A to point B. this car, once it gets to your computer has to go through 7 tollbooths ( I guess it is somewhere near New York...). Each of these tollbooths has an INS agent that can stop the car. The first three of these "Layers" are where the INS Agents have to run the gates, so they cannot inspect the inside of the car. (or in technospeak, they are Hardware Layers that it hits before the Windows Firewall can block it.) If you have a separate "Blocker", it doesn't do anything but check the cars so it can do a much more thorough job. Now, all of the "Blockers" are not equal, some just move the good cars on to a different road (rather than stopping the bad cars, it hides the entrance ramp) but then again you really probably don't care about how firewalls work; how about a story about why I changed firewalls at my office?
My DBIL (actually this was before we were married, but at any rate that is who he is) called me up and said they were training a new security expert and asked me if I would let him do a security assessment of our network. I said sure, I had a computer running Rapter Firewall Software ( A Very common and well known and trusted firewall). It was a separate "Blocker" in between my Internet and my Office. The New Guy plugged his laptop into my phone line, asked me if he had to dial a 9, and asked what my website address was. I figured I could tell him that much. He proceeded to tell me which version of the Rapter software we were running, and that the person who hooked it up (My ISP) left lots of holes in it. He then pulled up a spreadsheet from my account that had some payroll information on it, changed a figure, and wrote it back to my directory. Now granted, he is quite good, and granted I had to change my shorts, but he explained to me about the 7 layers, and tunneling under the bottom 3. He sold me on a separate box that the software was designed in Israel. He doesn't like the new PIX firewalls, because they don't really scan the packets (cars), and can be sidestepped fairly easily by someone who knows what they are doing. but it is a good line of defense against a lot of the Kids out there, and works better than Black Ice (which makes your computer run a lot slower)
I have rambled on long enough...The "Cars" are TCP/IP Packets, the Tollbooths are the Layers of the TCP/IP protocol stack, the bottom 3 being the Hardware layers below the operating system. If you would like to see details of this (and give yourself a headache, here is a link to a site I found on Google that explains what each layer does...
http://en2.wikipedia.org/wiki/TCP/IP#Layers_in_the_TCP/IP_Stack
Is this visual enough? PM me if your DH wants to talk Firewalls...
