Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough?

I'm running a VPS with Rackspace on their cloud offering. It's running Windows Server 2008. I don't believe there are any other firewalls between it and the outside world. I've got a few things on there ranging from my blog through to a couple of client websites. None of which are eCommerce but I'm sure the clients would like their data kept private.

share|improve this question
    
Suitable for running? Yes. Sufficient on its own? Rarely. Can you describe a little more? –  Jeff Ferland Oct 12 '11 at 14:05
    
I think we need a bit more information to make an informed opinion. Which version of Windows, how will it be managed, by sole protection do you mean no other firewalls between it and your clients, etc? What is the criticality of the asset and what types of threats are you trying to protect it against? –  Scott Pack Oct 12 '11 at 14:43
    
Thanks Scott, I see your point. –  Greg B Oct 12 '11 at 16:35
add comment

4 Answers

I guess it is up to you and your experiences. We (the company im working) is using Windows Firewall. As far as I know, a lot of small enterprises is running Windows Firewall. it is "only" a firewall, and is therefore not more secure than what you make it yourself. Consider it ACL (Access Control Lists) you specify what traffic you allow and what you do not.

I can recommend these two sites for you, if you consider using Windows Firewall.

This one is a "How to configure windows firewall in a small enterprise: http://technet.microsoft.com/en-us/library/cc875816.aspx

And this one is a textfile provided from Microsoft with an Introduction to Advanced Configuration of Windows Firewall Introduction to Windows Firewall with Advanced Security

share|improve this answer
add comment

It sounds like your firewall and webserver are on the same machine -- this increases your attack surface.

You need to quantify the assets that you are protecting, then you can determine the amount of money to spend protecting them.

share|improve this answer
add comment

I'm not sufficiently familiar with the Windows firewall, but I think it does not allow really fine-grained control but only "Please allow WWW". Hence, it is only suitable for beginners, IMO. But there are more fundamental problems to consider:

If the underlying Windows system has a problem, chances are that both, the firewall and the webserver, become compromised, allowing the adversary to extend his influence as he likes. Especially if they reside on the same machine.

In contrast, you could significantly reduce the attack surface if you deploy a BSD-based firewall in front of the Windows server. BSD has much less bugs/month and the packet filter would be able to prevent the exploitation of bugs on the windows box or at least restrict/monitor communication.

Due to the reduced code base, update rate and bug rate, the BSD box also adds only minimal maintenance overhead once it is deployed. If you have someone familiar with Linux/iptables it may also be worth looking into a specialized Linux distribution, such as Shorewall, or strip down your favorite Linux distribution.

share|improve this answer
    
The firewall, at least on modern server instances, is fairly configurable. One might need to use GPOs or other non-clicky interfaces, though. –  Scott Pack Oct 16 '11 at 1:02
add comment

I would say no, it is not. Your firewall is running on the same server that is providing content or resources and that is considered to be bad practice. The attack surface available to an attack is to large.

What we did to get around this is to book a small CentOS Linux machine in addition to the Windows machine, setup IPTables as a firewall and use Nginx to proxy all port 80 and 443 web requests through to IIS on the windows machine.

The web app users get a response from a Ngix server and there is a proper layer of security and control BEFORE they even see IIS.

That's my .02$

SG

share|improve this answer
    
"The attack surface available to an attack is to large." please explain: what is the attack surface, and how larger is it? –  curiousguy Jun 19 '12 at 20:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.