1

I'm a starting a small service practically. And I have single server currently. No money to purchase separated/dedicated firewall equipment now.

Is it effective installing firewall software on same machine which offering internet service? My server will offer HTTP, NFS, and SSH, and custom made server software on a several ports.

(edit) All services (except NFS) should be open to internet. Not internal services. I guess my machine (virtualized within Xen) is connected to the internet directly because I can connect to my machine SSH with only IP address.

(edit) NFS is not open to internet. Sorry for my mistake. NFS will be served via SSH only.

Improve this question
2
  • You need NFS to be open to the entire internet?
    – sciurus
    Mar 9, 2011 at 3:34
  • @sciurus Oh I'm sorry. NFS is not a public service.
    – Eonil
    Mar 9, 2011 at 4:34

4 Answers 4

Reset to default
2

If you are careful to open your ports only to the minimal subset of IP addresses that need to access those services (i.e. open custom-apps/NFS/SSH ports to just the smallest set of IP addresses that need to access these services) experience tells me that there is no issue having your packet filtering/firewall running on the same machine as your services vs. having them protected via an external firewall (if we are only talking of one server and we are not interested in NAT or some other advance firewall features such as protocol inspection).

Then for those services that need to be open to the whole of the Internet (i.e. HTTP/S) I would suggest, and depending on your choice of operating system, additional tools/techniques to minimize the risk of having those services exploited (either because of vulnerabilities in the software you are using or programming errors in the software you are writing). In case you are using linux/apache, modsecurity is a very good option to protect your web services. In case of IIS, Microsoft has it own set of tools and tweaks to provide an equivalent level of protection.

But then of course, this is only my opinion and maybe your best strategy would be to wait to hear more opinions/experiences and then decide for your self.

Improve this answer
2

If your box is powerful enough (lots of RAM, lots of core), then I suggest you go the virtualization path:

  • Install a hypervisor (VMware ESXi or Citrix XenServer -- they both have free versions)

  • Create 2 VMs:

    • VM #1 has 2 network interfaces: External & Internal*

    • VM #2 has 1 network interface: Internal*

  • Install Firewall in VM #1

  • Install your server in VM #2

**Internal here means a network that exists only inside the XenServer box, and unreachable from outside the box*

Improve this answer
1
  • Unfortunately, my machine is already virtualized. This reminds me the Inception :)
    – Eonil
    Mar 9, 2011 at 3:40
1

I wrote about this question at some length recently in Why would I need a firewall if my server is well configured? and the community seems to have, by and large, found the answer useful; you may wish to read it.

Improve this answer
0

If you are running VMWare ESX(i) then they actually have specific virtual appliances for consolidating your firewall onto the same hardware as your DMZ and private machines.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .