Security

Ask something
Discussion Locked

Firewalls everywhere?

0 helpful
5 replies

by tink!

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok, I'll put Anti-virus on everything. What about firewalls?
Is it necessary, on a domain-based network, to have a firewall on each machine (clients and server)?
OR..if I route the web connection thru the server, can I just put a firewall on the server and be ok? (mind you the DSL router has a firewall running)
Also - what firewalls do you suggest?
- Anti-Virus doesn't protect you from hijacking right? do firewalls?

5 replies

by jamesrl

You don't put a software firewall on the server. You put the firewall between your network and the internet. There are software firewalls for workstations, one built into XP, but for a business you want something stonger. There are DSL routers with built in firewalls like Linksys, but preferable to get a separate device. A Cisco pix is good. But the secret is always in how you configure it - hire someone professional to set it up for you.

James

by stress junkie

Your network threats don't all originate on the Internet. You can get viruses on computers within the perimeter that you have "secured" with your Internet firewall. There is no harm in using firewall software on servers so why not do it?

Of course all firewall software is only as good as the person that configures it. Installation defaults are generally weak or otherwise inappropriate.

by jamesrl

Create an isolated subnet for the server, with a firewall connecting the subnet with the WAN.

The reason I like a separate box is for a number or reasons - separate ID and password, better logging than software firewalls (usually). If you have a software firewall on the server, you are adding load to the server, and if the server admin id is compromised, the firewall can be disabled. If you have a separate box, they have 2 levels to go through- thr stronger (firewall) protecting the weaker (server).

Of course most software based stuff is either for a dedicated server (checkpoint etc) or something designed for a workstation. Would a workstation product even run on server 2003?

James

by stress junkie

Your first line of your response still says that you are thinking in terms of a secure perimeter. The problem with that thinking is that client computers that have a need to access the servers could be infected with a virus. A subnet will not prevent malicious access from a client that has legitimate access needs.

All manner of security software is available for servers. There is firewall software for Windows server products.

by apotheon

If you really want good software firewalls running on all your servers, you need to install something like Linux or *BSD. That way, you get iptables or pf running on your servers. Most of those firewall appliances you can get at places like CompUSA are running some neutered version of iptables and, if anything, pf is better than even a fully-functional iptables for highly configurable, built-in firewalling capability.

Many of the best separate firewall devices in the world are running one or the other.

This discussion is closed to new replies.