up vote 0 down vote favorite
1
share [g+] share [fb]

I have 3 apache servers in a cluster using HAProxy. Currently I allow all traffic on the backend IPs between the 3 servers - I thought about only allowing internal packets on the HTTP ports (and the memcached ports) - is this going over the top? Does the security benefit outway the performance impact (is there one?). I understand strengthening the private firewalls between the nodes would only be beneficial if one of the servers was penetrated from the frontend, thereby hindering what an attacker could do internally.

What do you do?

Thanks

link|improve this question
73% accept rate
Best practice use private network to backend and strict firewall rules(allow only service service traffic). – ooshro Feb 23 '11 at 17:37
feedback

1 Answer

up vote 1 down vote accepted

First to answer your overhead question. Yes there is overhead, but the firewall will be so simple that you wont notice it.

To answer the security question. Basicly you really cant go over the top with security. But it still has to be a workable situation. Allowing only traffic from sources you trust (or need to trust) boosts security, but is still workable.

A simple firewall would suffice, easy to maintain, hardly any (if any at all) overhead and a boost to security. Suffice to say, it would only be needed if one machine gets penetrated. But your as secure as your weakest link.

link|improve this answer
+1 for this. All you would want to allow would be your expected traffic between these servers, as anything else is likely to be malicious or at least unwanted. This is useful as your web servers are often the first point of contact an attacker will go for, so do try to prevent onward attacks. – Rory Alsop Feb 23 '11 at 20:18
Ok, service-to-service only firewall rules it is then. Thanks a lot. – Tom Feb 23 '11 at 22:15
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.