7

Are there any compelling reasons to protect a dedicated server (Windows 2008 R2 in my case) with a hardware firewall? What security concerns would a hardware firewall cover better than the built-in software firwall?

Thanks,

Adrian

Edit: To clarify: I am referring to a server running an SaaS website run by a Micro-ISV that are used by clients on a regular basis. I am not referring to a multi-million business.

2nd Edit:: Server load is not an issue in my case. The server is never running at more than 20% CPU or more than 50% memory load. Nor is centralized administration - there is only one windows server.

9
  • My suspicion, based on your accepted answer, is that you weren't looking for real answers but instead were looking for someone to affirm your notion that you didn't need a hardware firewall.
    – joeqwerty
    Oct 29, 2010 at 1:40
  • @joeqwerty I was indeed hoping that it is not necessary to spend hundreds or thousands of euros on a firewall. The only scenario in which I would have done is if the answers were unanimously for a firewall. However, there were good arguments for and against a hardware firewall, probably depending on how you defined "professional grade". I picked the side that I think works best for my scenario. If I was running a much bigger site with a lot bigger budget, I might have decided otherwise. Oct 29, 2010 at 11:13
  • Gotcha. Glad you got it sorted out for yourself. :)
    – joeqwerty
    Oct 29, 2010 at 12:20
  • @Adrian, I think you are drastically overestimating the cost of a simple hardware firewall; underestimating their benefit; and simply looking for someone to agree with you rather than listen to the vast majority of professionals. But in the end the decision and responsibility is yours.
    – Chris S
    Oct 30, 2010 at 0:21
  • @Chris S: As previously mentioned, I think the problem is how you define professional. I am not a full time sysadmin, I am just a developer running his own web servers and working full-time in my own two-people company, whereas most people in this forum seem to be full-time sysadmins managing servers for companies with a much bigger budget. Oct 30, 2010 at 9:04

9 Answers 9

6

If you have only a single server, then I think it's OK to rely on the built-in software firewall if you know what you are doing.

However, when you have 2, 3, 4 ... 10 servers, this becomes rather complex to manage, and you're better off with a hardware firewall you can manage in one place instead.

(you'll still want software and hardware firewalls for the whole "defense in depth" theory, though, so you can't get out of running the software firewalls on each server in any case. In my experience, Windows Server 2008 and beyond have excellent software firewalls and we used them exclusively on Stack Overflow for 2 years.)

1
  • Thanks for your reply, Jeff! Easier manageability is definitely a good point, although it does not apply in my case. Oct 30, 2010 at 9:08
6

Obviously "professional-grade" isn't an official term with definite properties, but if we assume it to generally mean the best-case configuration, then yes, a hardware firewall is preferred in my experience. While hardware and software firewalls can theoretically perform the same functions, a hardware firewall allows you to offload that work to a dedicated device. "Professional-grade" firewalls also have features that most software firewalls do not, and allow for much more advanced management. Also, any "professional-grade" configuration will generally include strong vendor support, which is generally superior for hardware firewalls.

Edited to add: More specifically, it runs on dedicated hardware, so it doesn't rob performance from your boxes. It sets at the border of your network, so that you have the "vault door" approach that @jowqwerty noted. It provides centralized management of firewall rules, NAT translations, etc for multiple servers. It may allow more advanced NAT/PAT configurations or other options than a typical software firewall. It typically has stronger professional vendor support.

7
  • 4
    In addition, best practice would dictate that you have a firewall at the ingress\egress of your network and configure it to pass inbound traffic for only those services (HTTP, SMTP, etc.) that you want to make available via the internet. If you run firewalls on your host machines only then you have essentially let the bad guys in and it's only a matter of time before they have their way with you. It's analogous to a bank vault door: You've left the vault door open and it's only a matter of time before the bad guys break into the safe deposit boxes.
    – joeqwerty
    Oct 28, 2010 at 14:27
  • +1 for you joe, host firewalls are for chumps ;)
    – phoebus
    Oct 28, 2010 at 14:49
  • 1
    -1: Thanks for your reply, but I was asking for a more concise answer. What exactly does it do better than the software firewall, especially when considering that hardware firewalls are just software running on dedicated hardware? Could you elaborate? Oct 28, 2010 at 16:15
  • And I and Joe told you what it does better. It runs on dedicated hardware, so it doesn't rob performance from your boxes. It sets at the border of your network, so that you have the "vault door" approach that @jowqwerty noted. It provides centralized management of firewall rules, NAT translations, etc for multiple servers. It may allow more advanced NAT/PAT configurations or other options than a typical software firewall. It typically has stronger professional vendor support.
    – phoebus
    Oct 28, 2010 at 16:34
  • 1
    As for the "vault door": you open the vault door by allowing port 80. :) The only time that the vault door is closed is when no ports are forwarded through the firewall.
    – Ernie
    Oct 29, 2010 at 22:48
5

"Hardware" firewalls are just dedicated devices running firewall software. They aren't actually implemented solely in hardware. That said, most hardware firewalls are thoroughly bulletproofed against script-kiddies, malware, and various exploits that might exist in a full Windows PC. For high value sites I would never trust Windows Software to be secure enough on it's own.

1
  • That said, there are nice linux appliances with preconfigured firewalls that would NOT count as hardware firewall as you have to still install them.
    – TomTom
    Oct 28, 2010 at 14:46
4

It should be behind a firewall however not much of a difference between which type. A hardware firewall is just a proprietary OS usually Linux built into an enclosure and includes a support agreement that provide assistance when you have questions on the product. All do the same thing and unless price and or support are an issue, either will work fine.

3
  • Usually Linux? More like usually Cisco IOS. Especially when you're protecting "professional grade" servers.
    – Ernie
    Oct 28, 2010 at 18:10
  • They don't all do the same thing, see AndyN's answer. The ASIC chips give an edge to hardware firewalls in performance, even in the cheaper models, like the SOHO ASAs. Oct 30, 2010 at 1:52
  • would love to see benchmarks comparing such against say, intel core i7 dedicating linux firewall box consisting of a linux ip table filter set vetted by dod. not to say one is better than the other and i find it equals and the support included with a manufacturer is very valuable support for us as an enduser. pricing an asa device and support vs intel white label commodity box, could be the same but the support might be the differentiator when it comes down to it for some. Oct 30, 2010 at 5:17
4

Security comes in layers, like onions. You want both perimeter protection and host protection and all you can get in-between and inside the host protection (application and so on).

Hardware isn't as most answers indicate really any different today, it's just software in appliance form. I wouldn't hesitate to put a Microsoft TMG on the perimeter defense and then use the built-in firewalls for host defense but generally there's some additional feel of safety (and increased maintenance burden) by mixing different firewall systems like a Cisco appliance and/or a Linux-based perimeter firewall.

2
  • Hardware firewalls tend to have specialized chips to handle the increased load... this takes the load off your servers. Even the cheaper ASAs do this. Oct 30, 2010 at 1:54
  • Sure, and if you're going really big, purpose-built hardware will prevail but compared to say any ASA I'm just saying any modern general purpose hardware, especially when outfitted with some offloading network interfaces, can perform equal in "software" to "hardware" solutions. The difference is usually in the packaging, service and support imo (and perhaps energy consumption). Even hardware firewalls with decent encryption accelerators require separate VPN accelerators when over a certain limit. These could just as well be built into a generic NIC or added as pci-something expansion cards. Oct 30, 2010 at 12:35
4

We don't have a firewall protecting any of our servers. Here's why:

Host-based security says that any open port is a potential vulnerability (including, but not limited to, the ports you're intentionally making available to the public). If your servers simply do not have any open ports but the ones that you want to make available to the public, that's almost the same protection as a firewall will give you. The only added benefit that a firewall will bring is that you can easily control which IP addresses on the internet are (or are not) allowed to access the otherwise publicly-available ports. However, many servers have this functionality built in anyway. One other benefit is that a hardware firewall can be configured to use only one public IP address for many machines - which is mostly what they're used for these days.

Also, if there are ports open and servers running that you don't want to make publicly available because you know they're vulnerable somehow (and thus, need the protection of a separate firewall), security doctrine says that's little protection against attackers, because there's several ways to circumvent the firewall anyway. Say you have an SSH or HTTP server behind a firewall, and several vulnerable windows machines on the same network. Should someone break into the server, they have access to the entire internal network. Likewise, should someone download a virus, that computer could attack your server from inside the network.

You're better off using the firewall software on the server and not bothering with the "hardware" firewall. That is, if you even need a firewall to begin with. Secure your web server such that the only software it's running is IIS, and only IIS will be vulnerable to attack. Which would be true whether you have a firewall or not.

Edited to add:

I also originally wanted to point out that a hardware firewall also adds a single point of failure to the network. This issue is also one of the major reasons we don't have a firewall protecting our servers. While it centralizes administration, it also centralizes outages caused by administration. It's also worth noting that all the servers run Debian, and vulnerabilities in the kernel and libraries are patched in a reasonable amount of time.

While hardware firewalls ensure that the holes don't line up, attackers are mostly interested in where the holes do line up: like in the ports that are specifically open in the firewall. If there's a vulnerability in a service that you provide, that is where they will attack. And get through your firewall(s). And attack the rest of the network, looking for the easier vulnerabilities that the firewall was supposedly protecting.

FYI, we haven't had any servers exploited since switching to Debian and using the Debsecan software, save for a few webmail accounts that fell victim to phishing attacks.

11
  • +1 for an in depth answer, although I disagree with it. Security, in my opinion, is best achieved through layers. While your answer is valid in terms of hardening the actual host, I would never leave that as my only line of defense. The key to security, again in my opinion, is to provide a sufficient enough number of layers to make the potential reward not worth the effort.
    – joeqwerty
    Oct 29, 2010 at 1:34
  • -1 You assume that your Windows drivers and kernel have no vulnerabilities before the firewall software kicks in. Circumventing multiple firewalls isn't as easy as your "security doctrine" thinks. Well designed network security isn't a single layer as you suggest, it's multiple layers like an Onion, as Joe, Oskar, and others have pointed out. Using multiple layers of protection is almost universally "safer" than relying on a single piece of software on a single server while exposing any other misconfiguration to the net. While your answer seems well written, I strongly disagree with it.
    – Chris S
    Oct 29, 2010 at 13:09
  • 1
    @Chris S: It depends on cost vs. benefit, not just benefit alone. My question was whether it's worth it for a rofessional website run by a micro-isv. You might be having a much bigger scale in mind... Oct 29, 2010 at 21:53
  • @joeqwerty: Oh, I definitely agree that security in layers is better. But sometimes it's not just about security. Sometimes it's about availability and simplicity. If whatever technique you use works, then why knock it, really?
    – Ernie
    Oct 29, 2010 at 22:40
  • 1
    @ChrisS: If the windows drivers or kernel or TCP stack have vulnerabilities, those vulnerabilities would still be available to attackers if they can see port 80 on the server. If on the other hand, you had a database server that only talked to your web server and should never be seen by the internet at large, then that server would be protected by your firewall. Until, of course, your web server was compromised.
    – Ernie
    Oct 29, 2010 at 22:44
2

To be pedantic: It should be noted that some high-end commercial firewall appliances feature custom-designed ASIC chips which do some of the work in dedicated silicon, and not on the main CPU. Such beasts are generally not needed unless you're dealing with big traffic and big crypto. As others have noted, in casual usage "hardware firewall" means a device running a minimized, hardened OS and firewall software, with a support contract from the vendor.

To the original question: All complex systems have flaws. To mitigate the risk of exploit, we build layered systems, so that the holes don't line up.

Exhibit A: "The target area is only two meters wide. It's a small thermal exhaust port, right below the main port. The shaft leads directly to the reactor system."

1
  • +1 for the answer and for the Death Star reference. :)
    – joeqwerty
    Oct 28, 2010 at 17:18
0

I know I'm coming in after an answer has been accepted, but my perspective is you go with a hardware firewall, too. Even in your given situation, the low-end hardware firewalls (< US$1000) would do you good. Defense in depth is part of it. But part of it is that the hardware firewalls have specialized chips to handle the network load. Meaning they handle the traffic better. Also, by allowing the firewall to handle all the nonsense (and if you ever put an IDS on the edge you'll see what I mean by nonsense), you offload that from your servers, thereby allowing them to function better. Their memory and CPU isn't being tied up discarding invalid traffic. The hardware firewall is doing it for them. Also, if you can pay a bit more, a lot of hardware firewalls are coming with built-in IDS/IPS functionality, meaning it can alert you if something is coming down the pipe that is cause for alarm.

0
  1. Instead of thinking about as a sys admin and comparing the cost of doing it, think about it as a business person and ask 'what is the cost of not having a hardware firewall?' What would happen to your business if your servers went offline for X hours? or data was stolen? How many customers would you lose? what would happen to your business reputation?

  2. Are you hosted in your office or in a data center? Most data centers offer a hardware firewall service with redundancy/failover/management for a monthly fee. Or get your own firewall. Several years ago we bought a little Cisco Pix for about $600 and it has been great.

3
  • Regarding 1: That's exactly what I am currently doing. Which is why I am of course concerned above all this, but I also have to know exactly where a hardware firewall would excel in order to justify the extra cost. Oct 30, 2010 at 8:42
  • Firewall basics - a properly configured hw firewall can hide your servers behind NAT on a local network. External attackers will have a hard time getting past it and to your more vulnerable servers. But you have to make the decision based on what your app does. If you do anything with money transactions you will be a target.
    – jqa
    Nov 2, 2010 at 0:37
  • this should have been part of prev comment. got some obscure err msg that it didn't want to save the comment. And don't forget the application vulnerabilities like XSS. If you are concerned about firewalls you might also want to check your app for vulnerabilities tool like rapid7's scanner or something from OWASP. App vulnerabilities cannot be solved by a firewall.
    – jqa
    Nov 2, 2010 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .