Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering if anyone could speak to the advantages of a hardware-based firewall vs using iptables directly on a web server.

I'm evaluating the cost effectiveness of having a dedicated firewall for just one production box.

share|improve this question
    
Duplicate: serverfault.com/questions/82522/… –  OMG Ponies Sep 10 '10 at 18:18
add comment

migrated from stackoverflow.com Sep 10 '10 at 18:18

This question came from our site for professional and enthusiast programmers.

5 Answers

Other than (possible) performance issues, one thing to keep in mind is that if your firewall is not on the same server as the one it's protecting, if somehow someone does get access to the webserver, they still can't muck with the firewall, meaning they couldn't change your outgoing rules, etc.

A separate firewall could also be set up to not have any way to access it via the network, which again, increases its defenses from being tampered with.

Keep in mind, this is also true of a software firewall that's a separate box, it doesn't have to be a hardware one.

share|improve this answer
2  
I'll also add that by having a separate firewall ("hardware" firewall, or just a separate box running iptables / pf / etc.) you don't have the traffic that's going to be dropped hitting the web server. –  voretaq7 Sep 10 '10 at 18:24
    
I agree, I would just add hardware firewalls generally have fewer moving parts and aren't as prone to dying - in my experience. Also, if there is any expansion going on later, might make more sense to have separate roles for boxes... (firewall is a firewall, web server is a web server...) –  Matt Sep 10 '10 at 20:02
add comment

I would use a hardware firewall if you are trying to protect a segment of the network as a whole, and a software firewall if you are trying to protect a specific application. The hardware protects your space from intruders outside of your overall environment, and the software protects a specific function even from other parts of your environment.

That said, in this case you are protecting a single box, so I would just go with the software. The performance hit shouldn't be too bad until the time you would be considering more than one web server anyway, in which case you'll want to look at the hardware route.

And yes, as noted elsewhere, hardware firewalls tend to overall be more reliable. Also more of a pain to set up and keep straight if you have to modify them often. The points made concerning the increased security of having suspect traffic hit a device that is separate from the web server are well-made, but my view is that the overall increase in security is not justified by the additional cost at the level of a single server (with some notable exceptions). A mature software firewall, set up simply, and on a regularly-maintained server that doesn't have any other services running beyond those required for its web functionality, should be stable and secure these days. Or, at least it will be until you start getting buffer overflow exploits going over the HTTP traffic which the firewall won't catch anyway.

share|improve this answer
add comment

Unless there is a relay clicking away, it's always a software firewall. You are just hoping the software is obscure enough that nobody knows how to hack it.

I have have and had many IPTables based Linux firewalls, Cisco PIXs, and off the shelf consumer boxes. Out of all of them, the Linux firewalls have the least problems with needing a reboot. Most have exceeded over 2 years of consent uptime. I tend to have the batteries go flat in the UPS before the system needs a reboot.

05:35:34 up 401 days, 4:08, 1 user, load average: 0.02, 0.05, 0.02 I replaced the UPS 401 days ago.

Out of the 30 Cisco PIX firewalls, 3 died after 2 years, and 5 had to be rebooted every 2 months or so.

The big advantage of the "hardware" firewalls is often the compact size and hopefully no moving parts.

share|improve this answer
add comment

It's already been stated -but if you are dealing with just ONE production box, and it's the only production box you are going to have in that environment in the concievable future, and it's not a box that will have to comply with any regulatory issues (PCI, etc) - then just doing filtering on the host should be just fine.

You don't mention redundancy or anything like that, so it's probably overkill.

I was going to say that if you have the budget for it, get a separate box as a firewall anyway (it's not wrong...) - but IMO you'd be adding an extra piece of equipment to break - so if load is not a concern, and you aren't rolling out a fault-tolerant setup, a naked server all by itself does not require a firewall.

share|improve this answer
    
" a naked server all by itself does not require a firewall." !!!! –  Samir Mar 29 at 10:47
add comment

In my opinion OpenBSD is the solution. Have a dedicated piece of hardware running OpenBSD. There you can configure your firewall and stuff.

It is more secure since ObenBSDs firewall runs in kernel space where as iptables on a Linux machine runs in the user space.

share|improve this answer
    
You're just wrong. iptables is kernel space, as is pf. –  Bill Weiss Sep 11 '10 at 16:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.