0

I want to run my Firewall/NAT software (pfsense) and an internal NAS (looking at freenas right now) for my SOHO on one machine. Right now I have them separated on two different machines, but I'd like to consolidate them. Is this generally a bad idea? I see the security concern where if the firewall or host OS is compromised, then your data is essentially screwed. But is it really a concern for me?

Improve this question

3 Answers 3

Reset to default
2

For a small office use, as long as you're not pumping a large amount of traffic through it, I don't think it's a bad idea necessarily from a security standpoint so much as it would be a bad idea from a redundancy/reliability standpoint. Make sure you have a good backup routine in place!

Personally I like separate machines just because if one is fried, it doesn't take everything down. VM servers save energy, noise, and management headaches, but do create a single point of failure, so it's something you need to consider when budgeting; if you were to completely lose your computer tomorrow, how much is it worth to you to have that data back? That should be how much you're willing to spend on backup hardware.

For security, while there could be some concern argued, practically speaking you can set it up with networking in such a way that it will be partitioned off well enough to prevent most attack problems you're likely to encounter as long as you keep things updated and monitor the logs (and make decent backups, of course). The only other security issue I'd see is that generally you can't trust a machine to monitor itself; something gets compromised then it can report what it wants for logs and data. An external system doing IP monitoring/logging/etc. is more reliable at monitoring what is happening inside your network (unless the firewall system is what's compromised, but many appliances can be run from a read-only image with just a data partition to save logs/cache to).

Again, from what you described, I don't think you'd have much to lose in consolidating, and probably will gain more in the long run, as long as you have a plan in place for backups and spare equipment if necessary for getting your VM server online after hardware failure. You don't mention the VM server you're considering but I had assumed, perhaps incorrectly, you're thinking of something like VMWare ESXi or a Linux "bare metal" hypervisor? It's generally less of an attack surface to run a bare-metal hypervisor instead of running it on top of a regular server or workstation OS...

Improve this answer
1
  • I was looking at ESXi and Xen. I wanted to have about 3 or so appliances installed, so I'm probably going to end up leaving the firewall machine alone, and virtualizing the fileserver to handle a few more internal tasks.
    – MGSoto
    Mar 31, 2010 at 19:31
3

How valuable is your data? Machines are cheap. Your time isn't.

I would tend to use separate machines to keep configuration and maintenance as simple as possible. Plus getting to your data requires two break-ins, not one.

Improve this answer
1

That is up for you to determine. Anything that is directly Internet connected, even if a firewall, is in most cases going to be one of the first points of compromise. The same could be said for any internal network server that is NAT'd, which would essentially make that segment a type of DMZ.

In SOHO environments, I often like to have the main border router/firewall and file server as separate servers. Even so, depending on resources available, I might do otherwise. SOHO and enterprise are vastly different service levels, even for my home office. I will make compromises personally that I professionally wouldn't encourage clients to make.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .