I was wondering if anyone could speak to the advantages of a hardware-based firewall vs using iptables directly on a web server.

I'm evaluating the cost effectiveness of having a dedicated firewall for just one production box.


Other than (possible) performance issues, one thing to keep in mind is that if your firewall is not on the same server as the one it's protecting, if somehow someone does get access to the webserver, they still can't muck with the firewall, meaning they couldn't change your outgoing rules, etc.

A separate firewall could also be set up to not have any way to access it via the network, which again, increases its defenses from being tampered with.

Keep in mind, this is also true of a software firewall that's a separate box, it doesn't have to be a hardware one.

| improve this answer | |
  • 2
    I'll also add that by having a separate firewall ("hardware" firewall, or just a separate box running iptables / pf / etc.) you don't have the traffic that's going to be dropped hitting the web server. – voretaq7 Sep 10 '10 at 18:24
  • I agree, I would just add hardware firewalls generally have fewer moving parts and aren't as prone to dying - in my experience. Also, if there is any expansion going on later, might make more sense to have separate roles for boxes... (firewall is a firewall, web server is a web server...) – Matt Sep 10 '10 at 20:02

I would use a hardware firewall if you are trying to protect a segment of the network as a whole, and a software firewall if you are trying to protect a specific application. The hardware protects your space from intruders outside of your overall environment, and the software protects a specific function even from other parts of your environment.

That said, in this case you are protecting a single box, so I would just go with the software. The performance hit shouldn't be too bad until the time you would be considering more than one web server anyway, in which case you'll want to look at the hardware route.

And yes, as noted elsewhere, hardware firewalls tend to overall be more reliable. Also more of a pain to set up and keep straight if you have to modify them often. The points made concerning the increased security of having suspect traffic hit a device that is separate from the web server are well-made, but my view is that the overall increase in security is not justified by the additional cost at the level of a single server (with some notable exceptions). A mature software firewall, set up simply, and on a regularly-maintained server that doesn't have any other services running beyond those required for its web functionality, should be stable and secure these days. Or, at least it will be until you start getting buffer overflow exploits going over the HTTP traffic which the firewall won't catch anyway.

| improve this answer | |

Unless there is a relay clicking away, it's always a software firewall. You are just hoping the software is obscure enough that nobody knows how to hack it.

I have have and had many IPTables based Linux firewalls, Cisco PIXs, and off the shelf consumer boxes. Out of all of them, the Linux firewalls have the least problems with needing a reboot. Most have exceeded over 2 years of consent uptime. I tend to have the batteries go flat in the UPS before the system needs a reboot.

05:35:34 up 401 days, 4:08, 1 user, load average: 0.02, 0.05, 0.02 I replaced the UPS 401 days ago.

Out of the 30 Cisco PIX firewalls, 3 died after 2 years, and 5 had to be rebooted every 2 months or so.

The big advantage of the "hardware" firewalls is often the compact size and hopefully no moving parts.

| improve this answer | |

It's already been stated -but if you are dealing with just ONE production box, and it's the only production box you are going to have in that environment in the concievable future, and it's not a box that will have to comply with any regulatory issues (PCI, etc) - then just doing filtering on the host should be just fine.

You don't mention redundancy or anything like that, so it's probably overkill.

I was going to say that if you have the budget for it, get a separate box as a firewall anyway (it's not wrong...) - but IMO you'd be adding an extra piece of equipment to break - so if load is not a concern, and you aren't rolling out a fault-tolerant setup, a naked server all by itself does not require a firewall.

| improve this answer | |
  • " a naked server all by itself does not require a firewall." !!!! – Sunny Mar 29 '14 at 10:47

In my opinion OpenBSD is the solution. Have a dedicated piece of hardware running OpenBSD. There you can configure your firewall and stuff.

It is more secure since ObenBSDs firewall runs in kernel space where as iptables on a Linux machine runs in the user space.

| improve this answer | |
  • You're just wrong. iptables is kernel space, as is pf. – Bill Weiss Sep 11 '10 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.