Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to the server. I am doing some upgrading and wondering if I really need the firewall. Are there any drawbacks to just using the Win 2003 built in firewall to make sure only traffic on 3389 and 80 get through?

share|improve this question

migrated from Dec 6 '10 at 9:48

This question came from our site for professional and enthusiast programmers.

up vote 3 down vote accepted

Hardware based firewalls are meant to be industrial strength safeguards that can do more than just block ports. They are highly configurable, fast, and meant to shield the actual server(s) from attack or excessive/needless load while being separate from the OS they are protecting.

take a peek at for a good side-by-side comparison.

In short, no.

share|improve this answer

No you do not need a hardware firewall for a single node. The software based packet filter firewall built into windows can do what you need.

share|improve this answer

No you don't have to have one, but you really should have one if this server is doing anything thing of value to you. A separate firewall will help to mitigate a number of risks including but not limited to:

  • OS bugs
  • Human error while configuring the OS
  • Undetected compromise

If all you have is the OS firewall then an OS level 0-day or DDoS bug can take you down. A separate firewall adds an extra layer protection in the event you accidentally open something up that shouldn't be. If your server does get compromised then a separate firewall can help you detect the compromise. A separate firewall does add cost and complexity. In my opinion in most cases the pros outweigh the cons.

share|improve this answer

you should also consider changing your default RDP port

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.