Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?

share|improve this question
2  
This question should be revised. It should probably read "How does a firewall help to protect a server". rather than asking specifics about the misconception that a firewall will truly protect everything. (A firewall is just one part of a working IT security solution) –  Thomas W. May 7 '13 at 4:45

2 Answers 2

up vote 10 down vote accepted

A firewall allows you to limit access to ports you specify, and you can specify sources as well. For example, you can prevent non-root users from creating services that accept connections, so an attacker can't create a new shell backdoor. You can even limit outbound connections to reduce the possibility of reverse shells. A not uncommon practice is to only allow SSH connections from "internal" IPs.

Security is about minimizing attack surface, and a firewall is a component in that. Like any tool, it can be almost useless or very useful, depending on how you use it.

share|improve this answer
    
+1 for mentioning reverse shells. That's normally something people forget about, and it's one thing I always look for when testing. Essentially, if you get an explicit close back on a port, you can be pretty sure that the firewall allows outbound connections through it. –  Polynomial May 7 '13 at 10:09
    
+1 and you can configure a firewall to only accept properly-formed http requests, as well as providing alerting and logging when traffic is non-standard. –  schroeder May 7 '13 at 14:55
    
After an initial bout of negative votes for what I thought was a legitimate question, I got discouraged and never checked back. Just got an email notification. Your answer helped me understand the role of firewall more clearly. Thanks for the explanation. –  bran May 8 '13 at 5:36

There are different types firewall in place each have its own purpose we have

  1. Packet Filter Firewall: Packet-filtering firewalls are the simplest firewall that validate packets based on protocol, source and/or destination IP addresses, source and/or destination port numbers, time range. They have no visibility to the packet payload.
  2. Stateful Packet Filter: Stateful Packet Filter are more advanced than simple packet filters my maintaining state of network connections like TCP streams and UDP streams.
  3. Application / Reverse Proxy Firewall: These are the most advanced type of Firewall and as the name indicate they operate on application layer. In Simplest word these firewall proxy the client application request to the backend server and drops the request if they are malicious.

Obviously cannot block port 80 with a Packet Filter Firewall you to need deploy Application Layer Firewall to protect your web application to do so. An example of application layer firewall will be mod security.

share|improve this answer
1  
It's probably a bit awkward way of putting it, saying that WAF is more advanced when compared to lower level firewalls. It operates on a higher, application level, which comes with both advantages as well as disadvantages. Obvious advantage is that it can handle rules more tightly in lieu to application, but comes with also obvious disadvantage the packets are already processed at that same level, meaning they penetrated lower level security layers already. Perhaps it wouldn't go amiss saying they can be used together instead of just listing them as separate class firewalls? –  TildalWave May 7 '13 at 7:52
    
@TildalWave There is always a confusion about role of application layer firewall and network layer firewall. My Question would by to detect XSS attack with an IP filter Firewall. Problem seems obvious attacker is not targeting network layer which is well protected. You cannot block port 80 traffic to protect your servers. I hope you get my point. –  Ali Ahmad May 7 '13 at 8:42
    
Oh I do get your point, no problems with that part of your answer (in fact, I believe I said the same thing), I was merely trying to suggest this should be pointed out more. Most people hear a word firewall and still, sadly, think they have something like that somewhere on their router and they're covered as well as they could be by a firewall. My experience at least. Anyway, I thought this difference should be addressed further than it currently is, maybe a few links to other WAF threads and such... ;) –  TildalWave May 7 '13 at 10:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.