Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As per the title, my software supplier is trying to persuade me to upgrade to a dedicated server with a hardware firewall. (We're currently on a shared Rackspace virtual host, running Ubuntu.)

Our application's database doesn't contain confidential personal information, and we're using good password security. We also have backups.

Is there any good reason why we should be behind a hardware firewall, or is the supplier just trying to upsell us?

I don't want to be negligent, but I also don't want us to pay for services we don't really need.

Thanks for your help.

share|improve this question
6  
Without knowing more about your application / risk level (whether you're likely to be targeted, etc), it's difficult to give a firm answer. In the words of Reverend Lovejoy: 'short answer: "Yes" with an "If," long answer: "No" -- with a "But."' –  Tom O'Connor Jul 12 '12 at 8:59
2  
What are your volumes? –  Chopper3 Jul 12 '12 at 9:01
1  
"Our application's database doesn't contain confidential personal information" - good, but how valuable to your business is it? "we're using good password security" - That's good to know but it has zero point sod-all to do with firewall requirements. "We also have backups." - again, good to know but doesn't really address what you do or do not need in the way of a firewall. There are two things to consider - traffic volumes (as chopper alludes to) and risk (as per Tom). Traffic volume is a (relatively) simple technical point. Risk is a balance of exposure to vs. consequences of attacks. –  RobM Jul 12 '12 at 9:12
    
Ha, thanks Tom! Volumes - low, no more than 3,000 users ever, no more than circa 20 concurrent users. Risk - it would be bad to lose the data, but it wouldn't cause the business to fail. (What are the risks that a hardware firewall would mitigate against? I assumed it was the risk of being hacked and having the database deleted.) –  Richard Jul 12 '12 at 9:33
    
No. No firewall protects you against "losing data"; what it does do is police and possibly forbid external access to your network. –  adaptr Jul 12 '12 at 15:17

5 Answers 5

No, you don't need a hardware firewall. You may need DDoS mitigation, or any number of other services, but a hardware firewall for a single machine is a complete crock.

Since you mention you're on a Rackspace shared server, I assume you're going to a Rackspace dedicated environment, and yes, they'll force a firewall (actually a pair of the things) on you, since they have a 3 device minimum on managed colo. It's tantamount to a scam, in my opinion, and is a big part of the reason we pulled (or are in the process of pulling) all our customer's equipment out of their facilities. I'd find another provider, one who won't force you to buy stuff you don't need.

share|improve this answer

No, not needed unless it has some sort of DDoS protection with it or your going to be pushing masses of traffic >100MB/s.

The firewall within Linux should do a good enough job of the security side of things as long as configured correctly.

share|improve this answer
2  
Where do you get the 100Mbps number from? –  womble Jul 12 '12 at 9:42

It sounds like you're supplied has failed to provide any valid reason for you to buy such a device (otherwise you would have explained his reasoning?)

doesn't contain confidential personal information, [...]. We also have backups

Of themselves, these have little bearing on why such a dedicated firewall might be justified.

Assuming you've got a sensible set up for the server's firewall, then there's no justification for using a seperate firewall.

I'm not saying that your system is secure enough - that's a very different question, but, other than coping with higher traffic volumes and providing better isolation from zero-day packet level attacks (which are very infrequent) it does nothing you shouldn't be able to using iptables / tc / iproute2

Also, while the most expensive such devices can provide the sort of protection afforded by snort, none provide the functionality you can implement in software using fail2ban.

share|improve this answer

Typically, more connections will be allowed.

Depending on which model your supplier is selling, there may be additional, sometimes proprietary, features you might like. Check the relevant vendor site.

Most important perhaps is that it and your server will be dedicated rather than shared. This gives you more freedom to choose maintenance windows (although check with your hosting company as there may be additional charges for exercising that freedom) and from performance issues caused by your neighbours on shared platforms.

Enquire about load balancers too.

share|improve this answer
2  
Load balancers to a single server??? –  Sirch Jul 12 '12 at 10:53
    
@Sirch a load balancer can do a lot more for you than load balance... an F5 with iRules is an excellent layer 7 traffic preprocessor :) –  rackandboneman Jul 12 '12 at 13:54

I have to agree with the questioning of whether or not you need a FW here also. I see FWs as a traffic cops more than anything else in general. The service you are using should have some of that in place already, so I am thinking that you are looking for some web application protection. Just because you do not have any PII on your website does not mean that it is ok to be hacked. There are a couple of Cloud, Software as a Service (SaaS) based solutions for website and web application security that you should look into; xyberShield and FireEye. I know more about xyberShield, but just also reviewed the FireEye product, which is an anti-malware product. The SaaS model offers many ways to scale your product security with your products needs. Redundancy, low latency because there is no hardware on your site (at least with xyberShield), processing robustness, and updates are all handled in the back end of the SaaS model solution.

The other item that is important to understand the advantages of with these two solutions is that they are Behavioral Based AND Signature Based. The xyberShield product has a really funky advanced Behavioral Analysis Correlation Engine (BACE) that has been on and learning for more than 4 years, so anything that it learns is immediately applied to its knowledge base and available to all clients that it serves globally.

The most important thing is to understand that you may need to address the specific needs of your website and web application protection with a layered number of products and/or services. Today you should be looking to match your cloud based web site services with a cloud based security solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.