Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are looking at using a hosting provider to host a Windows 2008 server for us. They say that we do not need a hardware firewall but the firewall within Windows should be fine.

The server will just be a terminal server running some app's on it so the only open port would be Terminal Services.

Do you have any views on this?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You may be completely fine with not having a firewall to protect you from incoming traffic if you're sure that you won't open additional ports on your server. And if you do decide to open ports a software firewall (that's what you're relying on in this situation) may be okay. And additionally a software firewall may not provide you with nearly as much protection as a hardware firewall. There is a big difference and it sounds like your service provide is attempting to avoid dealing with the later.

That being said, I typically set up systems to protect the outside world as much as the inside. How sure are you that your server will never start sending traffic out into the wan? In a situation like that it's really nice to have a hardware firewall to avoid being blacklisted (should your server decide to send out thousands of emails on behalf of someone else).

Think about what you may want to protect.

the lan?

the wan?

both?

share|improve this answer
    
Very good point about the outgoing traffic. –  John Gardeniers Jan 30 '10 at 23:34

Answers to questions such as this have a tendency to be a little controversial, as some people have pretty strong views one way or the other. My own view is that the firewall on a server is inadequate. Even more so in the case of Windows because it has so much stuff installed and running, whether you need it or not. Linux on the other hand can and should be installed with only what is actually required. Nevertheless, the constant stream of updates and patches should be more than enough indication that they really should not be connected directly to the Internet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.