Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have 6 nodes that have internet access on eth1 and private access to one another on eth0. Currently I have firewall rules for eth0, for things like memcached and NFS. Is this necessary? It's a real headache as NFS for example communicates on loads of different ports, and I recently introduced glusterfs which needs more still. Is the headache of figuring out what backend ports to unblock worth the security enhancement?

I should mention that I will of course still have a firewall rule on eth0 to block servers owned by others in the same datacenter.

Thanks

share|improve this question
    
Having a firewall are not a goal in itself! Only do that if you can think of a specific reason, like "preventing foo from having network access to bar". –  curiousguy Jul 1 '12 at 10:17

3 Answers 3

up vote 1 down vote accepted

It's a pain, I agree. You can do without (as long as you still block everything else on eth0, which you already indicated).

The only risk is: If 1 of your 6 servers get compromised it is easier for the "bad guy" to get onto the other 5.
They are likely running the same OS with the same vulnerability as the first server so the attacker is probably also able to compromise them via eth1 in the first place.
But if those 6 servers are different OS or have different services exposed on eth1, then the additional FW on eth0 might be able to prevent an attacker getting access on the other 5.

Regardless which choice you make: I do hope you have different accounts/passwords setup for those machines. You probably have SSH enabled on eth0 anyway. If an attacker gets an account on 1 he can just ssh into the next box if they are the same. Sometimes userid/password authentication on top of key-based authentication is a good idea.

share|improve this answer

If every server is allowed to contact every other server on every open port, then the firewalls are not actually doing anything and you might as well use a blanket accept. If there is some internal traffic which is not allowed then it depends on the consequences of those restrictions being bypassed compared to the management effort.

share|improve this answer

Opening ports for NFS and glusterfs need not be a headache.

Glusterfs uses many ports but it is a known and finite list so can be scripted. NFS can be configured to use specific ports (in /etc/sysconfig/nfs on RHEL and similar NFS servers) rather than random ones.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.