Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently running ISA 2004 and will soon be running an Untangle box. I've always felt a tiny bit safer putting these more advanced software firewalls behind a dumb hardware firewall (like mid-grade consumer routers). So basically I do port forwarding as necessary from the hardware firewall to the software firewall which of course has a more complex configuration.

The way I figure it, this at least protects me a bit from accidentally opening something up on the software firewall, and potentially from glitches in the software firewall. However, it really only helps me by blocking ports at the edge (well, it's a little better than that, but not much). Plus it makes configuration more complicated and it's harder to test each system independently.

Should I ditch the cheap router/firewall box?

share|improve this question

closed as primarily opinion-based by Sven Jun 19 at 14:35

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

Personally, and this is only my opinion, I don't see much logic in doing this. If you can make a mistake on one firewall you can make a mistake on two. If one is dodgy, two can be dodgy. Why not three, or four, or five then?

I would rather implement a single enterprise class firewall that has a trusted, proven track record and have an independent, experienced, unbiased party validate it's configuration and operation for me and perform intrusion testing on it for me.

It's kind of like the old adage: If one pill is good for me then two must be better, right?

share|improve this answer
Thanks, I agree. – Boden Jan 22 '10 at 23:35
Glad to help... – joeqwerty Jan 28 '10 at 3:19

From a security perspective, you have to weigh the risks for your environment. Chaining devices is potentially more secure (so long as they're different technologies) but, as you eluded to, creates (much) more maintenance overhead.

Personally, if you're not a big target and/or don't see a high volume of traffic then I don't think the security benefits outweigh cost of maintenance overhead. Again, though, it depends on what you're protecting and how long you can afford to be down for if something happens and you have to rebuild. That's something only you can calculate.

From a performance standpoint, what kind of load are you looking at? One of the biggest problems I've seen when chaining devices in your firewall solution is hardware processing bottlenecks where one smaller device chokes the whole thing because it can't process things fast enough.

The biggest reason is to have multiple barriers of protection. One system's vulerabilities are typically not going to be present in another, so it puts one more variable in place for an attacker to deal with. It starts going south in a hurry, though, and is only marginally beneficial when considering things like DoS attacks against the extreme edge device. When that happens you're screwed until you resolve that attack.

share|improve this answer
Very small load, relatively speaking. Thanks! – Boden Jan 22 '10 at 22:48
@Boden: I put a bit more in after you left your comment, just fyi – squillman Jan 22 '10 at 22:56
I too would be concerned about the consumer based firewall. For two reasons. Consumer routers have small session tables and consumer firmware has a horrible track record for auth bypass attacks which makes it easy for hijacking dns and other attack vectors. – 3dinfluence Jan 22 '10 at 23:05
@ 3dinfluence: RE Consumer routers auth bypass attacks, etc... Links please? – Josh Brower Jan 22 '10 at 23:40
@Josh - here's a topical example – Helvick Jan 22 '10 at 23:44

On my own networks, I use a multi-layer approach. This usually comes down to an external boarder firewall and as you get closer to various machines, more layers including a host-based firewall on most of them.

So, while I would say having more than one parameter is useful, I don't believe having more than one layer at each of these parameters would be more secure.

share|improve this answer
Multiple layers as you're describing is not a bad thing. As long you're dealing with enterprise gear. However putting a consumer firewall/router into the mix as Boden has asked will open you to the security issues that I commented on another answer about. But worst due to it's lack of visibility via snmp traps, logging, etc it also becomes a blind spot in your network security. – 3dinfluence Jan 23 '10 at 0:58

It more likely that you will open up the wrong ports in a chained configuration. typically when there is a firewall problem admins begin opening ports till it works, then figure out what to close back up. With multiple firewalls with multiple config operations it's going to be easy to miss something.

share|improve this answer

Cheap does not necessarily mean nasty. For example, a RouterStation Pro running OpenWRT and Shorewall is a very capable firewall... for US$79, not including a case and power injector. The key thing is, it has an enterprise-grade operating system, and enough memory and CPU that it's not likely to bottleneck your network. Using one of these makes sense, whereas a consumer-grade device running its default firmware really does not.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.