Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to the server. I am doing some upgrading and wondering if I really need the firewall. Are there any drawbacks to just using the Win 2003 built in firewall to make sure only traffic on 3389 and 80 get through?

share|improve this question

migrated from stackoverflow.com Dec 6 '10 at 9:48

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers

up vote 3 down vote accepted

Hardware based firewalls are meant to be industrial strength safeguards that can do more than just block ports. They are highly configurable, fast, and meant to shield the actual server(s) from attack or excessive/needless load while being separate from the OS they are protecting.

take a peek at http://networking.anandsoft.com/network-security-firewalls.html for a good side-by-side comparison.

In short, no.

share|improve this answer
add comment

No you do not need a hardware firewall for a single node. The software based packet filter firewall built into windows can do what you need.

share|improve this answer
add comment

No you don't have to have one, but you really should have one if this server is doing anything thing of value to you. A separate firewall will help to mitigate a number of risks including but not limited to:

  • OS bugs
  • Human error while configuring the OS
  • Undetected compromise

If all you have is the OS firewall then an OS level 0-day or DDoS bug can take you down. A separate firewall adds an extra layer protection in the event you accidentally open something up that shouldn't be. If your server does get compromised then a separate firewall can help you detect the compromise. A separate firewall does add cost and complexity. In my opinion in most cases the pros outweigh the cons.

share|improve this answer
add comment

you should also consider changing your default RDP port http://www.petri.co.il/change_terminal_server_listening_port.htm

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.