Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let's say that our first firewall have some vulnerability and malicious person is able to exploit it. If there's second firewall after it, she should be able to stop the attack, right?

Also what will be the side effects I mean would this slow the traffic or not. What are other possible effects like this one?

Here is what I mean for configuration:

Firewall 1 -> Firewall 2 -> Network

Firewall 1 is different from Firewall 2.

share|improve this question
1  
@naught101 Better use socks with holes in different places as a metaphor, since condoms are known for tearing from friction against each other. I suppose two firewalls could also have trouble working together. –  user1306322 Jul 4 at 1:26
    
It would be nice to know of a concrete instance where two firewalls in series actually saved the day or conversely were of no help whatsoever against a well-crafted attack. Due to the nature of the beast, the first case is likely to be rare and undocumented, the second case is is likely to have occurred quite a few times (e.g. via successful drive-by download attack). –  David Tonhofer Sep 16 at 15:08

5 Answers 5

up vote 32 down vote accepted

DMZ

There are both advantages and disadvantages having two firewalls. While firewalls are not commonly exploited, they are prone to denial of service attacks.

In a topology with a single firewall serving both internal and external users (LAN and WAN), it acts as a shared resource for these two zones. Due to limited computing power, a denial of service attack on the firewalls from WAN can disrupt services on the LAN.

In a topology with two firewalls, you protect internal services on the LAN from denial of service attacks on the perimeter firewall.

Of course, having two firewalls will also increase administrative complexity - you need to maintain two different firewall policies + backup and patching.

Some administrators prefer to only filter ingress traffic - this simplifies the firewall policy. The other practice is to maintain two seperate rulesets with both outbound and inbound filtering. If you need an opening from LAN to WAN, you will have to implement the rule on both firewalls. The rationale behind this is that a single error will not expose the whole network, only the parts the firewall is serving directly. The same error has to be done twice.

The main disadvantage is cost and maintenance, but in my opinion the advantages outweighs these.

share|improve this answer
    
No, the main disadvantage is that you've added another single point of failure in your network. –  Shadur Jul 5 at 23:30
    
Also, point of note, but almost all industry-grade firewalls in the market nowadays can handle a DMZ setup with only a single firewall box by maintaining different networks on different ethernet ports. –  Shadur Jul 5 at 23:39
    
If you worry about single points of failures, redundancy is the option. In this case, single points of failures are not "random", as it is initiated by malicious intent. What is worst? A denial of service disrupting the whole network, or just the external network? –  Dog eat cat world Jul 6 at 22:06

As a rule, No.

Firewalls aren't like barricades that an attacker has to "defeat" to proceed. You bypass a firewall by finding some path through that isn't blocked. It's not so much a matter of how many obstacles you put up but rather how many pathways through you allow. As a rule, anything you can do with two firewalls you can do with one.

share|improve this answer
    
This is why I give a specific situation in my question. Let's say that an attacker have some exploit for this firewall and he is able to bypass it. In this case I think that the second FW will be able to prevent the attack. –  user3395407 Jul 1 at 16:54
34  
As a rule, you don't exploit a firewall. There's no code you can download that will defeat Juniper firewalls or Cisco firewalls. You bypass a firewall by tunneling your traffic over connections that the firewall is already configured to allow. –  tylerl Jul 1 at 17:16
1  
@tylerl Your comment is just as good as your answer. Basic concepts need to be reinforced! –  Jared Burrows Jul 3 at 15:27
3  
@Kiwy you will find that 99.99% of those vulnerabilities are created by already open connections in particular configurations, there is no way to physically hack a firewall that is actively blocking you. You attack a connection that already accepts you. –  Sammaye Jul 3 at 18:01
1  
Sigh, _ Firewalls aren't like barricades that an attacker has to "defeat" to proceed_ except in all the movies and TV episodes I've seen that mention them falling one by one. For a giggle, see strangecharmed.com/internet/become-a-tv-hacker-in-3-seconds –  Andy Dent Jul 4 at 2:00

Are two firewalls better than one ? There are two perspective to that from a hacker point of view it doesn't matter as they look for open ports for exploitation. From a network administrator point of view firewall do create a single point of failure. Using Multiple firewall can provide redundancy if an active device firewall fails then service traffic is switched to backup firewall. Depending upon the type of firewall deployed there must be synchronization between two firewalls before link switchover. Furthermore Multiple Firewall can be deployed in.

  1. Active-Standby Mode (Having Backup firewall in place)
  2. Load Balancing (Both Firewall in active mode)

Source : White Paper Stateful failover Techniques

enter image description here

share|improve this answer
    
Although a valid opint, the question stipulates firewalls "after" each other, and not in a HA setup. –  m1ke Jul 3 at 10:02
    
@m1ke I agreed and my answer was to address the problems with OP current Firewall configuration. –  Ali Ahmad Jul 3 at 11:54

There is potentially a scenario in which firewall software has a bug that causes it to allow traffic through which it shouldn't. In that case, there might be a benefit to having a second firewall behind the first running different software, on the assumption that the different software does not suffer from the same bug.

But how common are firewall bugs? My feeling is that they are not common enough to justify the additional complexity of this setup, which raises the risk of misconfiguration, and causes you to waste time that might be better spent securing the services behind the firewall.

share|improve this answer
    
Well it mainly depend on what you secure. If I must secure server with highly confidential data, in this case it will be better to use two. –  user3395407 Jul 2 at 7:23
1  
@user3395407 for completeness, I note that securing a server with highly confidential data is not simply a case of deploying multiple firewalls. Defense-in-depth is required from the policy/management level to the technical configuration of the server software, taking care to avoid the implicit assumption that internal traffic is trusted (often a bad premise for deriving a security policy). If the data is so highly confidential as to be disastrous if it leaked, you'd be looking at more than just "putting in a firewall"; right up to formal verification of the server software, for instance. –  Cosmic Ossifrage Jul 2 at 13:35

Features and capabilities differ a lot between firewalls, so you can not simple ask if two firewalls would be better than a single one. I guess that you have a limited budget, so it might be better to get a single, but more capable firewall for the same money, than two cheaper firewalls, which even combined have less capabilities than the more expensive appliance.

But, if you have enough money it might be a good idea to combine capable devices from different vendors, so they get together a more secure system. Of course, it will not only cost more money to buy these firewalls, but also to maintain them. Each of them will have a different interface, slightly different capabilities or at least different ways to achieve the same thing. So you have to get administrators which are fluent in all these different models, maybe have to find some way to combine the different logs and alerts from the different firewalls etc.

So yes, it will be more secure, but only if you have the money to buy capable devices and administrators. If you are on a limited budget I would suggest to better get the best single device and administrator you can get for your money.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.