I was wondering if anyone could speak to the advantages of a hardware-based firewall vs using iptables directly on a web server.
I'm evaluating the cost effectiveness of having a dedicated firewall for just one production box.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Other than (possible) performance issues, one thing to keep in mind is that if your firewall is not on the same server as the one it's protecting, if somehow someone does get access to the webserver, they still can't muck with the firewall, meaning they couldn't change your outgoing rules, etc.
A separate firewall could also be set up to not have any way to access it via the network, which again, increases its defenses from being tampered with.
Keep in mind, this is also true of a software firewall that's a separate box, it doesn't have to be a hardware one.
I would use a hardware firewall if you are trying to protect a segment of the network as a whole, and a software firewall if you are trying to protect a specific application. The hardware protects your space from intruders outside of your overall environment, and the software protects a specific function even from other parts of your environment.
That said, in this case you are protecting a single box, so I would just go with the software. The performance hit shouldn't be too bad until the time you would be considering more than one web server anyway, in which case you'll want to look at the hardware route.
And yes, as noted elsewhere, hardware firewalls tend to overall be more reliable. Also more of a pain to set up and keep straight if you have to modify them often. The points made concerning the increased security of having suspect traffic hit a device that is separate from the web server are well-made, but my view is that the overall increase in security is not justified by the additional cost at the level of a single server (with some notable exceptions). A mature software firewall, set up simply, and on a regularly-maintained server that doesn't have any other services running beyond those required for its web functionality, should be stable and secure these days. Or, at least it will be until you start getting buffer overflow exploits going over the HTTP traffic which the firewall won't catch anyway.
Unless there is a relay clicking away, it's always a software firewall. You are just hoping the software is obscure enough that nobody knows how to hack it.
I have have and had many IPTables based Linux firewalls, Cisco PIXs, and off the shelf consumer boxes. Out of all of them, the Linux firewalls have the least problems with needing a reboot. Most have exceeded over 2 years of consent uptime. I tend to have the batteries go flat in the UPS before the system needs a reboot.
05:35:34 up 401 days, 4:08, 1 user, load average: 0.02, 0.05, 0.02 I replaced the UPS 401 days ago.
Out of the 30 Cisco PIX firewalls, 3 died after 2 years, and 5 had to be rebooted every 2 months or so.
The big advantage of the "hardware" firewalls is often the compact size and hopefully no moving parts.
It's already been stated -but if you are dealing with just ONE production box, and it's the only production box you are going to have in that environment in the concievable future, and it's not a box that will have to comply with any regulatory issues (PCI, etc) - then just doing filtering on the host should be just fine.
You don't mention redundancy or anything like that, so it's probably overkill.
I was going to say that if you have the budget for it, get a separate box as a firewall anyway (it's not wrong...) - but IMO you'd be adding an extra piece of equipment to break - so if load is not a concern, and you aren't rolling out a fault-tolerant setup, a naked server all by itself does not require a firewall.