I currently have a colocated server being protected by a hardware firewall, however this firewall is old and I want to replace it. I was wondering if the built-in Firewall software for Windows 2003 could possibly be good enough for this task. In the end I really just want to block all ports except SSL, HTTP, FTP, and RDC. Is this a big mistake/hassle and should I just go with another hardware firewall?
When possible you should always separate your firewall from your application level services. Some reasons include:
- It's more secure. As mentioned, a breach in the firewall will also mean a breach on your application server and easier access to your data if the firewall and application are colocated.
- Things are easier to configure and troubleshoot. Configuration problems on your application or firewall will often be easier to identify when the services are separated.
- It's potentially faster. One server doesn't have to singlehandedly provide firewall proxying/filtering AND application processing. This will have a variable level of benefit based on your app's usage statistics and processing requirements.
- You can have a organizational separation of responsibilities such that a security team won't have to worry as much about coordinating with an application development team when changes to the server are necessary. If the services are separated then the security team can worry about the firewall and the app team can worry about the app server.
- Oh yeah, and running a firewall on an AD domain controller is just BAD juju. Don't know if this is your situation or not (probably/hopefully not).
I think you should go with another hardware firewall, because if if you go with the firewall on the hosting machine, in case someone breaks in, he will have control over the os plus the firewall. IMHO firewalling should be a seperate process, this gives you more security and flexibility.
The firewall that ships with Windows Server 2003 is ok, but I would recommend having a firewall outside of Windows in front of the server as well. The main reason is configurability. There are many things you can do with a more advanced firewall that Windows just can't do. As others have also mentioned, it makes it more difficult for attackers since they now have two systems to gain control over instead of one.
The downside to having an external firewall is that it provides another single point of failure. There are firewall applications that will run in clusters so you can have more than one in a failover mode, but now we're talking about additional equipment. If you've lived with one up to now, then you should be ok with one going forward. Find a cheap/old PC and slap a Linux or OpenBSD system on it and use that as the firewall. You don't really need a dedicated "device" unless management demands a support contract from a vendor on it.
I agree with Maxwell in that havving the firewall on the web host is crazy talk, but have you considered building a virtual machine to handle your firewall needs?
This would be seen as a separate machine in your environment and has a zero cost for hardware, though the OS licence would need to be paid for.
I'd view the Windows firewall as being OK for casual or home user purposes, as in it will act as a deterrent to the more uninterested hacker and do a reasonable enough job of keeping bots and script kiddies out.
For a public facing machine that's going to be up 24/7, at times when you're not always physically at the machine itself to be able to view (and respond immediately to) what's happening on it, I'd want something more serious.
It's probably ok, as long as don't put that server in the same domain in your network.
However, having a separate firewall hardware always works better.
Three other notes...
Because Windows Firewall is just another application running on the same machine you are trying to protect, it is much easier to attack or subvert the firewall.
I'm not sure if there is a way to turn this off, but by default Windows Firewall has a built-in allow rule for all machines on the same subnet. In other words, if you were to setup a NIC with a public IP address, all the other machines at your ISP within the same IP range would have unhindered access to your server.
Another feature I do not believe can be turned off is the fact that Windows Firewall does not block out going traffic. Leaving you vulnerable to phoning home or attacks that call code from another location.