Do I really need a firewall for my server?
-
Are you saying that NAT isn’t effectively a firewall or that a NAT firewall isn’t effectively a firewall?
What sort of isp supplied residential equipment doesn’t block inbound connections? Pedantically, you’re correct.
-
Possibly it's about personality types. I was only going on my own experience. Of always being told by a chorus of experts "Oh no you don't want to do that!" and ending up being terrified to touch anything. When I now know that I usually had nothing to be afraid of, because dangerous things tend to be locked down by design, exactly as they should be.
Until they arent.
They are experts because they knew what clicking the wrong button might do.
E.g.: Database admins using the wrong script with a miscconfigured argument or a backup admin responding to a failover, tripple checking every setting to not create a problematic failover and then still clicking the wrong button causing an outage because some random behaviour caused an overload.It happens. And best case you were better (double or tripple) safe than sorry.
-
Op means, as they said, a firewall on the server itself.
NAT is, effectively, a firewall.
No it isn't. Stop giving advice on edge security.
How is NAT not a firewall? Sure theoretically it isn't but I've yet to see a implementation of NAT that doesn't act as a Firewall
-
Assuming it's not a 1-1 NAT it does make for a functional unidirectional firewall.
That's like saying a router and firewall are the same thing. NAT appears to be a "firewall" because it's usually deployed with one. NAT itself has no filtering functions the way you're describing.
Now, a pure router in the sense of simply offering a gateway to another subnet
A "pure" router, as you put it, understands upstream subnets and routing tables. NAT does not, and is usually overlayed on top of an existing routing function.
You can set up NAT between two subnets as an experiment with no iptables and it will do its job.
In practice a stateful NAT is the same as a stateful Firewall. I've never heard of a NAT that isn't a Firewall. A port forward is the same as a Firewall allow rule.
-
I use OpenWRT on my network and each server I have is on its own VLAN. So in my case, my router is the firewall to my servers. But I do have on my todo list to get the local firewalls working as well. As others have said, security is about layers. You want an attacker to have to jump multiple hurdles.
Why did you put each server in its own vlan? You now have a bunch of separate broadcast domains that need a router to move traffic between them. Switching is much faster since it is done in hardware most of the time.
-
How is NAT not a firewall? Sure theoretically it isn't but I've yet to see a implementation of NAT that doesn't act as a Firewall
Because NAT acts as a firewall with a "default deny" policy for incoming packets, but no other rules. You cannot prevent a device on the private subnet side of a NAT from attempting to communicate with an "outside" ip with nat alone, nat doesnt understand the concepts of accept/deny/drop.
All nat does is rewrite address headers.
The machines behind a NAT box are not directly addressable because they have private IP addresses. Machines out on the general Internet cannot send IP packets to them directly. Instead, any packets will be sent to the address of the NAT box, and the NAT box looks at its records to see which outgoing packet an incoming packet is in reply to, to decide which internal address the packet should be forwarded to. If the packet is not in reply to an outgoing packet, there's no matching record, and the NAT box discards the packet.
It's a confused topic because for a lot of people, nat does essentially everything they want. As soon as you get into more complex networking where a routing table needs to be updated, or bidirectional fw rules, it becomes apparent why routing + fw + nat is the most common combo.
-
Why did you put each server in its own vlan? You now have a bunch of separate broadcast domains that need a router to move traffic between them. Switching is much faster since it is done in hardware most of the time.
Mainly for security reasons. Both servers have some limited exposure to the internet. Are you saying doing it that way has performance implications? I haven't noticed any problems its all fast just like before when everything was on the same LAN
-
Mainly for security reasons. Both servers have some limited exposure to the internet. Are you saying doing it that way has performance implications? I haven't noticed any problems its all fast just like before when everything was on the same LAN
It will impact server to server performance significantly.
If the servers are independent that's fine but don't do a file share or some other performance critical component across vlans.
-
It will impact server to server performance significantly.
If the servers are independent that's fine but don't do a file share or some other performance critical component across vlans.
Interesting, I haven't noticed anything, in fact since I switched everything has felt faster. And I'm constantly sending large files to devices on other VLANs.
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
I only bind applications to ports on the Internet facing network interfaces that need to be reachable from outside, and have all other ports closed because nothing is listening on them.
A firewall in this case would bring me no further protection from external threats, because all those ports have to be open in the firewall too.But Linux comes with a firewall build in, so I use it even if it is not strictly needed with my strict port management regime for my services.
And a firewall has the added benefit to limit outgoing network traffic to only allowed ports/applications. -
I have about 20 services on my machine so I'm going to need to open a ton of ports (ssh, SSL, multiple higher number ports since some services require several ports). At that point, what is the point of a firewall if so many ports are open? With so many ports open, it seems like a firewall doesn't add much security vs the complexity it adds.
I recommend fail2ban to stop the automated attacks that are the background noise of the internet. It will set your firewall to block certain ip's for a while, especially ports 21/22 are getting hammered with dictionary login attempts. And port 80 and 8080 for example get constantly version checked to see if you are vulnerable with an old apache, old dokuwiki etc, so don't expose more than you need to and maybe learn about ssh tunnels and close a few.
I once installed ossim in a small network with a server and it showed me it is war out there, scripts flying everywhere.
-
Interesting, I haven't noticed anything, in fact since I switched everything has felt faster. And I'm constantly sending large files to devices on other VLANs.
It will be slower with more latency and CPU usage.
I would highly recommend you read up on networking and the OSI model. Switching is extremely fast because it is done in hardware. Routing is slow because it goes though the CPU.
If all else fails you could create a dedicated vlan for storage access.
-
I recommend fail2ban to stop the automated attacks that are the background noise of the internet. It will set your firewall to block certain ip's for a while, especially ports 21/22 are getting hammered with dictionary login attempts. And port 80 and 8080 for example get constantly version checked to see if you are vulnerable with an old apache, old dokuwiki etc, so don't expose more than you need to and maybe learn about ssh tunnels and close a few.
I once installed ossim in a small network with a server and it showed me it is war out there, scripts flying everywhere.
Also get rid of password authentication if you can.
-
In practice a stateful NAT is the same as a stateful Firewall. I've never heard of a NAT that isn't a Firewall. A port forward is the same as a Firewall allow rule.
What you might call a stateful NAT is really a 1-1 NAT, anything going out picks up an IP and anything retuned to that IP is routed back to the single address behind the NAT. Most home users a many to one source nat so their internal devices pick up a routable IP and multiple connections to a given dest are tracked by a source port map to route return traffic to the appropriate internal host.
Basically yes to what you said, but a port forward technically is a route map inbound to a mapped IP. You could have an ACL or firewall rule to control access to the NAT but in itself the forward isn't a true firewall allow.
Same basic result but if you trace a packet into a router without a port forward it'll be dropped before egress rather than being truly blocked. I think where some of the contention lies is that routing between private nets you have something like:
0.0.0.0/0 > 192.168.1.1
10.0.0.0/8 > 192.168.2.1The more specific route would send everything for 10.x to the .2 route and it would be relayed as the routing tables dictate from that device. So a NAT in that case isn't a filter.
From a routable address to non-route 1918 address as most would have from outside in though you can't make that jump without a map (forward) into the local subnet.
So maybe more appropriate to say a NAT 'can' act as a firewall, but only by virtue of losing the route rather than blocking it.
-
I recommend fail2ban to stop the automated attacks that are the background noise of the internet. It will set your firewall to block certain ip's for a while, especially ports 21/22 are getting hammered with dictionary login attempts. And port 80 and 8080 for example get constantly version checked to see if you are vulnerable with an old apache, old dokuwiki etc, so don't expose more than you need to and maybe learn about ssh tunnels and close a few.
I once installed ossim in a small network with a server and it showed me it is war out there, scripts flying everywhere.
My server is only available on my LAN and via a VPN. Is fail2ban applicable? Or is it mainly for public facing servers?
-
I have about 20 services on my machine so I'm going to need to open a ton of ports (ssh, SSL, multiple higher number ports since some services require several ports). At that point, what is the point of a firewall if so many ports are open? With so many ports open, it seems like a firewall doesn't add much security vs the complexity it adds.
If someone exploits a service on the machine they can then connect outside that machine on any port. Ufw would prevent this. The router firewall would also likely prevent this unless they used an open port of the router or upnp was enabled.
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
That depends. If you have exposed services, you could use some features of the firewall to geoip restrict incoming requests to prevent spam from China and Russia and whatnot.
If you don't have any services running on a publicly accessible port, then what would the firewall protect?
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
My personal advice, secure it down to only permitting what needs it, regardless of your trust to the network.
Treat each device as if they've been compromised and the attacker on the compromised device is now trying to move laterally. Example scenario: had you blocked all devices except your laptop or phone to your server, your server wouldn't have been hacked because someone went through a hacked cloud-connected HVAC panel.
I lock down everything and grant access only to devices that should have access. Then on top of that, I enable passwords and 2FA on everything as if it were public... Nothing I self host is public. It's all behind my network firewall and router firewall, and can only be accessed externally by a VPN.
-
My server is only available on my LAN and via a VPN. Is fail2ban applicable? Or is it mainly for public facing servers?
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
I just went done this road and i'd say it is worth it even only for the learning part.
I've set counter per application in nftable, and via a python script send them in SVG graph format to Glance dashboard.
The result is I can monitor my whole network per application and the best part it all add up very well so I know there is no 'unknown' outgoing or ingoing traffic on my machine.
