Outgoing Firewall @ Router Recommendations?

Friends
Got a question I thought I knew answer to but questioning my own bias.
For a multi-pc network [small, small business] the consensus is that the only effective [if one exist] firewall would be at the Router. My questions are these:
- if you suspect a malicious agent somewhere on the inhouse network, how do you restrict certain workstations from OUTbound traffic other than, or outside of, admin-designated endpoints/addresses/targets????
- the suspicion is that one station or other has a P2P program or malware that fires off detrimental outgoing messages to recipients. How/which is best for defending?
- We have AVG on the whole network and presumably [underscore] mail traffic on Outlook Express, Outlook, or webmail is being inspected, checked, quarantined. Are we mistaken?

No VPN is involved here although its a thought for the future. When I read the lit. on common Linksys & Netgear routers, its seems their best efforts are aimed at VPN's, but this is just a regular pedestrian net.....

thx for any help/advice/recos
z

 

Entry Level Routers do not intervene with outgoing traffic.

Make sure that there is two way Firewall, AntiSpy ware, and Antivirus Software on each computer.

I commonly use.

PCTools Firewall, http://majorgeeks.com/PC_Tools_Firewall_Plus_d5470.html

Windows Defender, Native to Windows updates here, http://www.majorgeeks.com/Windows_Defender_Antispyware_Definition_Updates_d5994.html

Avira AntiVir, http://majorgeeks.com/download955.html

All are among the top in their class and are free.

There might be a small fee for business use, check the vendors sites.

In addition, I put on each computer this free utility from Microsoft.

It shows all the traffic that goes through the TCP/IP stack.
http://majorgeeks.com/TCPView_d599.html

It takes few second to look at the traffic in case of "Strange" behavior.

 

Thank You, Cat.
I had no prior knowledge of the TCP/IP viewer!

I'm puzzled at the descrips of common Router products from, for examples, Linksys and Netgear. No mention of firewall [though the features ARE there] on common SOHO routers/wireless/wired. But in the VPN category, they all compete hard for "secure firewall" features because the issue is so pronounced for VPN users. I was making the dangerous assumption that the "non VPN" routers probably had the same feature set but the features were not trumpeted due to the interests of the intended consumers....

 

Here about Router's Firewall.

http://www.ezlan.net/routers1.html

And this to clarify VPN.

http://www.ezlan.net/vpn.html

.

 

thx, cat, again.

I had a chat with an IT manager today about this and here's what he said:
The Malware guys will most often kick open Port 25 and send SMTP port 25 messages to specific mail servers to spread their joy.
By restricting Access to Port 25, and frequently reading the logs, one can quickly identify the workstations that gen a flurry of requests. Those should be taken offline and examined or flattened.

An inexpensive way to restrict/monitor outbound, says he, is a Linksys WRT open-source router [my choice WRT54GL] that can be nuked and reloaded with DDWRT - This package gives ability to restrict outbound port access.
Should, in theory, provide most of what is required for this case.

z