Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I posted on stackoverflow as to the overall benefits of managed hosting vs non-managed hosting.

The more I think about it, it seems to boil down to one question: should I use a managed host because they take care of the firewall, or would I be okay managing my own, software firewall?

The sites on the box do get quite a lot of traffic but as for throughput and what-not, it's not something I know much about.

Ideally, i'd take my sites over to a Linode stack and manage incoming connections using iptables or an alternative.

Here are some example hardware solutions a managed host would provide:

  • Cisco Pix 501, Pix 506, Pix 515 and ASA 5505 and ASA 5510 Firewalls, configurable in a control panel
  • the likes of an enterprise firewall such as FortiGate 110C

Aside from this, I do not need managed hosting, so I appreciate your suggestions.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

The advantage of a dedicated firewall device is that your server won't have to deal with the traffic that's going to be dropped (you can still have your interfaces saturated if you're filtering on the target box).

If you are expecting a substantial amount of traffic and a good portion of that may be dropped a dedicated firewall (either from your provider or one you manage yourself) is probably a good idea.

If you are not expecting to drop large amounts of traffic and don't think you'll saturate your server's connection with junk a local firewall may be "good enough", but I'm always in favor of separating the firewall role out onto dedicated hardwware: A PIX, ASA, or a dedicated box running PFSense or similar software are all good choices.

share|improve this answer
    
The problem is, since we managing the hardware ourselves - rather we'll use a company that sets up your box in a datacentre - the only solution I can think of is to use a managed hosting solution. Obviously a local firewall gets past these issues. –  damian86 Mar 12 '11 at 14:50
    
What would be a good 'local firewall' solution, as opposed to just using iptables. –  damian86 Mar 12 '11 at 14:51

having an external firewall like the ons you have mentioned may be helpful if your box is compromised, It's unlikely the firewall will also be compromised. This will stop hackers running certain services and you may be able to check the firewall logs to determine the source of the attack to prevent it in future. also as has been mentioned the firewall will take some load off your server.

In my opinion in practice neither of those benefits is enough to justify an external managed firewall in most cases. The load on the server that the firewall would have stopped will be negligible. If your server is hacked you will have other things to worry about than slightly restricting what they can do and having secure logs from the firewall is unlikely to be of much practical benfifit in the long run.

Use iptables and don forget to block outgoing as well as incoming traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.