Is it beneficial to chain multiple firewalls at the perimeter?

Question

I'm currently running ISA 2004 and will soon be running an Untangle box. I've always felt a tiny bit safer putting these more advanced software firewalls behind a dumb hardware firewall (like mid-grade consumer routers). So basically I do port forwarding as necessary from the hardware firewall to the software firewall which of course has a more complex configuration.

The way I figure it, this at least protects me a bit from accidentally opening something up on the software firewall, and potentially from glitches in the software firewall. However, it really only helps me by blocking ports at the edge (well, it's a little better than that, but not much). Plus it makes configuration more complicated and it's harder to test each system independently.

Should I ditch the cheap router/firewall box?

Answer 1

Personally, and this is only my opinion, I don't see much logic in doing this. If you can make a mistake on one firewall you can make a mistake on two. If one is dodgy, two can be dodgy. Why not three, or four, or five then?

I would rather implement a single enterprise class firewall that has a trusted, proven track record and have an independent, experienced, unbiased party validate it's configuration and operation for me and perform intrusion testing on it for me.

It's kind of like the old adage: If one pill is good for me then two must be better, right?

Answer 2

From a security perspective, you have to weigh the risks for your environment. Chaining devices is potentially more secure (so long as they're different technologies) but, as you eluded to, creates (much) more maintenance overhead.

Personally, if you're not a big target and/or don't see a high volume of traffic then I don't think the security benefits outweigh cost of maintenance overhead. Again, though, it depends on what you're protecting and how long you can afford to be down for if something happens and you have to rebuild. That's something only you can calculate.

From a performance standpoint, what kind of load are you looking at? One of the biggest problems I've seen when chaining devices in your firewall solution is hardware processing bottlenecks where one smaller device chokes the whole thing because it can't process things fast enough.

The biggest reason is to have multiple barriers of protection. One system's vulerabilities are typically not going to be present in another, so it puts one more variable in place for an attacker to deal with. It starts going south in a hurry, though, and is only marginally beneficial when considering things like DoS attacks against the extreme edge device. When that happens you're screwed until you resolve that attack.

Answer 3

On my own networks, I use a multi-layer approach. This usually comes down to an external boarder firewall and as you get closer to various machines, more layers including a host-based firewall on most of them.

So, while I would say having more than one parameter is useful, I don't believe having more than one layer at each of these parameters would be more secure.

Answer 4

It more likely that you will open up the wrong ports in a chained configuration. typically when there is a firewall problem admins begin opening ports till it works, then figure out what to close back up. With multiple firewalls with multiple config operations it's going to be easy to miss something.

Answer 5

Cheap does not necessarily mean nasty. For example, a RouterStation Pro running OpenWRT and Shorewall is a very capable firewall... for US$79, not including a case and power injector. The key thing is, it has an enterprise-grade operating system, and enough memory and CPU that it's not likely to bottleneck your network. Using one of these makes sense, whereas a consumer-grade device running its default firmware really does not.