Re: [fw-wiz] Host based vs network firewall in datacenter

From: Daniel Linder (dan_at_linder.org)
Date: 06/10/05

  • Next message: Rik Schneider: "RE: [fw-wiz] Host based vs network firewall in datacenter" 
    To: "Zurek, Patrick" <pzurek@uillinois.edu>
Date: Fri, 10 Jun 2005 15:58:25 -0500 (CDT)

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Patrick Zurek said:
    > These are the options as I see them:
    > 1) Wide open - keep the hosts locked down tight and keep open services to
    > a minimum.
    > 2) Host based firewall - put ipf on the hosts
    > 3) Network firewall behind the router - ???

    > 1) Does not seem feasible to continue to operate this way.

    I agree 100%.

    > 2) As a short term measure I have applied ipfilter on several of our non
    > production hosts. My manager has began to advocate putting it on all
    > production systems now (about 15 hosts). At first I thought this would be
    > a bad idea, as a network firewall would ease administration and having to
    > administer seperate rule sets for each server would be unwieldy. However,
    > after reading the opinions of certain members of the list, I'm at a loss
    > as to how to proceed.
    [snip]
    > I'm interested in using the right tool for the
    > job. Is ipf on a production Sun 15k a good idea?

    I guess it all depends on your workload of the servers. If they are
    handling 1000's of packets per second, then the overhead of doing packet
    filtering on each client might be a bit overwhelming.

    > 3) This option is good because it will allow us to apply stateless ACLs at
    > the gateway and centralize the management of firewall functions.

    You might want to look into a Linux/BSD system setup as an in-line
    firewall. Basically, the system has two NICs setup as a bridge. The
    traffic IP addresses don't get translated, but the system can filter using
    IPTables rules. I think the latest Linux Journal discussed this setup.

    If you can't convince your bosses this step is necessary, present these
    scenarios to them:
    1: Someone starts sending DoS traffic to your systems as they are no.
    Each machine has to investigate each packet and drop it themselves, plus
    intra-server traffic will be impacted.
    2: Same situation, but you have a single firewall as a chokepoint. This
    single system is stopping all those 'bad' packets before they ever have a
    chance to get to your servers. This keeps your internal network available
    for the valuable traffic and the trash off it.

    Dan

    - - - - -
    Wait for that wisest of all counselors, Time.
     -- Pericles
    "I do not fear computer,I fear the lack of them."
     -- Isaac Asimov
    GPG fingerprint:9EE8 ABAE 10D3 0B55 C536 E17A 3620 4DCA A533 19BF

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQFCqf7wNiBNyqUzGb8RAit5AJ9jMIltbrBZ4PmuJMLynXDix+209wCeMf3M
    f3VvSOXoEPtBeBnMnronXVE=
    =d3RI
    -----END PGP SIGNATURE-----
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Rik Schneider: "RE: [fw-wiz] Host based vs network firewall in datacenter"

    Relevant Pages

    • Re: iptables and dhcp
      ... > the same physical network segment as the firewall and the remote DHCP ... You used INPUT and not FORWARD chain ... # This target allows packets to be marked in the mangle table ...
      (comp.os.linux.networking)
    • Re: Trouble accessing Outlook Web Access from behind firewall
      ... When starting the firewall I also set ... > rejected and dropped packets are logged, however I see nothing in my log ... > # Higher ports needed to accept incoming/outgoing calls ...
      (comp.security.firewalls)
    • Re: Visnetic and 8signs firewall LOOPHOLE Read....
      ... I said I am just reporting bug in your Firewall, ... From the Port Scan/Properties control screen: ... The firewall filtered 100% of the packets that were received. ... operating system (I'm talking Windows, ...
      (comp.security.firewalls)
    • Re: strange network traffic
      ... Maybe not so wise to not have a firewall and trust a third party lurker to ... Subject: strange network traffic ... > -> connection established, following packets have neither SYN nor ...
      (Security-Basics)
    • Re: port 80 is open
      ... The firewall drops all packets initiated ... > internet the ISP router does not send the unreachable message. ... and then close the connection as your IP is seen as not connected. ...
      (comp.security.firewalls)