Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for recommendations on firewalls for a dedicated server that will be hosting a few websites of average traffic (5000 uniques monthly). the hosting company has port and full hardware firewalls. There's also the option of installing software firewalls. What is the level of protection of 'port' protection mentioned here: http://www.xlhost.com/firewall.php? Is this adequate? Any recommendations (Windows Server OS)?

share|improve this question

migrated from stackoverflow.com Feb 20 '10 at 14:35

This question came from our site for professional and enthusiast programmers.

    
Added - windows server –  FiveTools Feb 20 '10 at 14:50
    
Thanks for everyone's input! –  FiveTools Feb 21 '10 at 19:26
add comment

5 Answers

up vote 2 down vote accepted

It looks like a port on a FireBox would offer decent protection. Do you want application level protection? The FireBox probably won't be able to discern different application traffic on the same TCP/IP port. Meaning, if you had a software firewall, you could configure it just a bit more granular to only allow a certain executable to have access to port 80 (for example) whereas with a port on a firewall, you could only tweak port 80 to either allow or deny traffic without respect to what executable is initiating or responding to the traffic on your server.

As ErikA pointed out, Windows Server's built-in firewall would seem to be sufficient (as long as it was Server 2008 or above). Some alternatives that are noteworthy are:

With me not knowing exactly what your desires are, you'll have to do some digging to compare the products with the internal Windows firewall and see exactly what benefits are of significance to you.

share|improve this answer
add comment

Well if this is Windows Server 2008, it actually has a fairly capable software firewall.

share|improve this answer
    
Yup, the built-in windows firewall is really good. –  Espennilsen Feb 20 '10 at 17:24
1  
Well, I think really good is a stretch. I'd still much prefer pf or iptables, but in this situation, that's obviously not an option. –  EEAA Feb 20 '10 at 18:47
    
I think any good is a stretch. Theres many features it lacks, and in a not so distant past ksecdd was vulnerable to a use-after-free condition stemming from how the firewall processed malformed ICMP packets - Among other problems. It can't be trusted. –  zv_ Feb 23 '10 at 16:05
add comment

Unfortunately, Getting Firewalls right is like getting encryption right - A lot of people think they can do it right, for that matter a lot of experts think they can get it right. Getting it right is not so easy.

If the FD mailing list is any guide, The firebox is vulnerable to Syn-Fin ambiguity. Best evidenced by this snippet of code.

if(tcp->syn && !(tcp->ack || tcp->rst))
     tcpsyn=1;

If it isn't immediately obvious, A piece of processing code like this allows you to pass packets through the firewall as long as you set the Finish with the Synchronize bits thus effectively defeating port-filtering.

In short, If security is a concern for you, I'd stick with the tried and true - ASA/PIX. Failing that, BlackIce firewall is very well done, as well as pf/iptables of course.

share|improve this answer
    
Wow, great to know. However, BlackIce is dead. =( –  Wesley Feb 23 '10 at 16:49
    
Agreed. A Cisco ASA5505 is affordable and capable. Would be a good choice for one or more dedicated servers. –  Martijn Heemels Feb 26 '10 at 21:42
add comment

Assuming its actually a dedicated server and not a VPS, you could install a bare-bones linux distro on the metal (debian-netinst, etc), run Shorewall and then run the windows machine under Xen, KVM or a VirtualBox headless instance.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.