Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 3 apache servers in a cluster using HAProxy. Currently I allow all traffic on the backend IPs between the 3 servers - I thought about only allowing internal packets on the HTTP ports (and the memcached ports) - is this going over the top? Does the security benefit outway the performance impact (is there one?). I understand strengthening the private firewalls between the nodes would only be beneficial if one of the servers was penetrated from the frontend, thereby hindering what an attacker could do internally.

What do you do?


share|improve this question
Best practice use private network to backend and strict firewall rules(allow only service service traffic). – ooshro Feb 23 '11 at 17:37
up vote 1 down vote accepted

First to answer your overhead question. Yes there is overhead, but the firewall will be so simple that you wont notice it.

To answer the security question. Basicly you really cant go over the top with security. But it still has to be a workable situation. Allowing only traffic from sources you trust (or need to trust) boosts security, but is still workable.

A simple firewall would suffice, easy to maintain, hardly any (if any at all) overhead and a boost to security. Suffice to say, it would only be needed if one machine gets penetrated. But your as secure as your weakest link.

share|improve this answer
+1 for this. All you would want to allow would be your expected traffic between these servers, as anything else is likely to be malicious or at least unwanted. This is useful as your web servers are often the first point of contact an attacker will go for, so do try to prevent onward attacks. – Rory Alsop Feb 23 '11 at 20:18
Ok, service-to-service only firewall rules it is then. Thanks a lot. – Tom Feb 23 '11 at 22:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.