Do I really need a firewall for my server?
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
I like to run ufw on all my machines but I'm also a tinfoil-hat wearing wacko who believes that no computer should ever really be trusted. Just trusted enough to do specific tasks.
-
I've heard this analogy before but I don't really care for it myself.
It creates a mental image but isn't really analogous.
In the case of a firewall on a server behind a NAT, ports forwarded through the NAT are holes through the first several slices.
If done correctly, those may only be open from the internet, but not from the local network. While SSH may only be available from your local network - or maybe only by the fixed IP of your PC. Other services may only be reachable, when coming from the correct VLAN (assuming you did segment your home network). Maybe your server can only access the internet, but not to the home network, so that an attacker has a harder time spreading into your home network (note: that's only really meaningful, if it's not a software firewall on that same server...)
-
If done correctly, those may only be open from the internet, but not from the local network. While SSH may only be available from your local network - or maybe only by the fixed IP of your PC. Other services may only be reachable, when coming from the correct VLAN (assuming you did segment your home network). Maybe your server can only access the internet, but not to the home network, so that an attacker has a harder time spreading into your home network (note: that's only really meaningful, if it's not a software firewall on that same server...)
Sure mate, keep trotting out the dumb swiss cheese analogy. Fine by me.
-
Disclaimer, I'm not a network professional im only learning. But you dont need ufw since your router firewall should be able to filter majority of the traffic. But in security there is a concept of layers. You want your router firewall then your device firewall to provide multiple layers incase something slips through one layer.
So to give a simple answer, it depends how secure you want your network to be. Personally I think UFW is easy so you may as well set it up. 5sec of config might stop a hacker traversing your network hoping from device to device.
it depends how secure you want your network to be. Personally I think UFW is easy so you may as well set it up
IMO this attitude is problematic. It encourages people (especially newbies) to think they can't trust anything, that software is by nature unreliable. I was one of those people once.
Personally, now I understand better how these things work, there's no way I'm wasting my time putting up multiple firewalls. The router already has a firewall. Next.
-
it depends how secure you want your network to be. Personally I think UFW is easy so you may as well set it up
IMO this attitude is problematic. It encourages people (especially newbies) to think they can't trust anything, that software is by nature unreliable. I was one of those people once.
Personally, now I understand better how these things work, there's no way I'm wasting my time putting up multiple firewalls. The router already has a firewall. Next.
IMO this attitude is problematic. It encourages people (especially newbies) to think they can't trust anything, that software is by nature unreliable. I was one of those people once.
IMO: Exactly the reverse. That's how we get clients clicking and agreeing to everything presented without for once thinking critically.
In 6 working years (MSP) I had probably less than 10 occurrences of clients questioning a security concept from their own action.
If we didnt protect them from their own stupidity, the amount of cyber breaches would explode...Just recently:
A client: I clicked on the box that is asking me for domain credentials.The client didnt say what type of window it was or what happened before/after.
The client juat contacted us, because the pc wouldnt connect to the network and thus was unusable... >_> -
Disclaimer, I'm not a network professional im only learning. But you dont need ufw since your router firewall should be able to filter majority of the traffic. But in security there is a concept of layers. You want your router firewall then your device firewall to provide multiple layers incase something slips through one layer.
So to give a simple answer, it depends how secure you want your network to be. Personally I think UFW is easy so you may as well set it up. 5sec of config might stop a hacker traversing your network hoping from device to device.
I have about 20 services on my machine so I'm going to need to open a ton of ports (ssh, SSL, multiple higher number ports since some services require several ports). At that point, what is the point of a firewall if so many ports are open? With so many ports open, it seems like a firewall doesn't add much security vs the complexity it adds.
-
IMO this attitude is problematic. It encourages people (especially newbies) to think they can't trust anything, that software is by nature unreliable. I was one of those people once.
IMO: Exactly the reverse. That's how we get clients clicking and agreeing to everything presented without for once thinking critically.
In 6 working years (MSP) I had probably less than 10 occurrences of clients questioning a security concept from their own action.
If we didnt protect them from their own stupidity, the amount of cyber breaches would explode...Just recently:
A client: I clicked on the box that is asking me for domain credentials.The client didnt say what type of window it was or what happened before/after.
The client juat contacted us, because the pc wouldnt connect to the network and thus was unusable... >_>Possibly it's about personality types. I was only going on my own experience. Of always being told by a chorus of experts "Oh no you don't want to do that!" and ending up being terrified to touch anything. When I now know that I usually had nothing to be afraid of, because dangerous things tend to be locked down by design, exactly as they should be.
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
I use OpenWRT on my network and each server I have is on its own VLAN. So in my case, my router is the firewall to my servers. But I do have on my todo list to get the local firewalls working as well. As others have said, security is about layers. You want an attacker to have to jump multiple hurdles.
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
If it is just you on your server and the only access from outside your network is SSHing in front the VPN? You're good. Especially if it's just you on your network/VPN.
If there are services that others utilize, you need a firewall. Can't trust other people's devices to not drag in malware.
-
I have about 20 services on my machine so I'm going to need to open a ton of ports (ssh, SSL, multiple higher number ports since some services require several ports). At that point, what is the point of a firewall if so many ports are open? With so many ports open, it seems like a firewall doesn't add much security vs the complexity it adds.
Sounds like you could use a reverse proxy.
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
You have a firewall. It’s in your router, and it is what makes it so that you have to VPN into the server. Otherwise the server would be accessible. NAT is, effectively, a firewall.
Should you add another layer, perhaps an IPS or deny-listing? Maybe it’s a good idea.
-
I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?
Just make sure you're using public key authentication and you're good
-
You have a firewall. It’s in your router, and it is what makes it so that you have to VPN into the server. Otherwise the server would be accessible. NAT is, effectively, a firewall.
Should you add another layer, perhaps an IPS or deny-listing? Maybe it’s a good idea.
Op means, as they said, a firewall on the server itself.
NAT is, effectively, a firewall.
No it isn't. Stop giving advice on edge security.
-
Op means, as they said, a firewall on the server itself.
NAT is, effectively, a firewall.
No it isn't. Stop giving advice on edge security.
Are you saying that NAT isn’t effectively a firewall or that a NAT firewall isn’t effectively a firewall?
-
Op means, as they said, a firewall on the server itself.
NAT is, effectively, a firewall.
No it isn't. Stop giving advice on edge security.
Assuming it's not a 1-1 NAT it does make for a functional unidirectional firewall. Now, a pure router in the sense of simply offering a gateway to another subnet doesn't do much, but the typical home router as most people think of it is creating a snat for multiple devices to reach out to the internet and without port forwarding effectively blocks off traffic from the outside in.
-
One thing that hasn't been said in this thread is the following:
Do you trust your router? Do you have an isp that can probe your router remotely and access it? In those cases, you absolutely need a firewallAbsolutely. Even if your ISP is firewalling, never trust they will maintain it, and some of these cheapshit routers they use are awful. Use your own router and put it on the ISP routers DMZ.
-
Are you saying that NAT isn’t effectively a firewall or that a NAT firewall isn’t effectively a firewall?
NAT simply maps IPS across subnet boundaries in such a way that upstream routing tables don't need updating.
If you use destination NAT forward rules to facilitate specific destination port access, you are using a firewall.
-
Assuming it's not a 1-1 NAT it does make for a functional unidirectional firewall. Now, a pure router in the sense of simply offering a gateway to another subnet doesn't do much, but the typical home router as most people think of it is creating a snat for multiple devices to reach out to the internet and without port forwarding effectively blocks off traffic from the outside in.
Assuming it's not a 1-1 NAT it does make for a functional unidirectional firewall.
That's like saying a router and firewall are the same thing. NAT appears to be a "firewall" because it's usually deployed with one. NAT itself has no filtering functions the way you're describing.
Now, a pure router in the sense of simply offering a gateway to another subnet
A "pure" router, as you put it, understands upstream subnets and routing tables. NAT does not, and is usually overlayed on top of an existing routing function.
You can set up NAT between two subnets as an experiment with no iptables and it will do its job.
-
Sounds like you could use a reverse proxy.
That doesn't count as a firewall though no? I use traefik as my reverse proxy (and like one thing on nginx that also goes through traefik ultimately) but I still put crowdsec on top
-
That doesn't count as a firewall though no? I use traefik as my reverse proxy (and like one thing on nginx that also goes through traefik ultimately) but I still put crowdsec on top
No, but putting a bunch of those services behind a reverse proxy would lower the amount of open ports. It would also have the side effect of making firewall configuration easier, since you don't need rules for all those ports anymore.
