Would you need an internal, external and a host-resident firewall for each POS client?

  • Sorry I am still new to the subject. I want prevent or reduce the risk of say a Smurf Attack maybe by filtering out spoofing packets. – Gray Dec 14 '18 at 10:30
  • Ok, so not DDoS, but classic DoS threats. Firewalls can help with that if they have those inspection features. Where to place them depends entirely on the network architecture and where those threats will be coming from. Can you explain more about the architecture? – schroeder Dec 14 '18 at 10:40
  • It is a small point of sale network. Just one server and four client workstations with the POS application on them. – Gray Dec 14 '18 at 11:22
  • Ok, and where are the DoS threats coming from? (You put protections in place in the vector of t he threat) – schroeder Dec 14 '18 at 11:27
  • Say externally from a malicious party wanting to prevent payments from occuring – Gray Dec 14 '18 at 12:20

You have multiple areas of concern with DOS/DDOS attacks. If they are external they can fill up the "pipe" in your ISP before they ever reach you. That means that nothing on the inside (internal firewalls, layer 7, blackholes) will prevent packet loss before you even are reached. In order to mitigate this you need to contact your ISP and they will have protections (Kona being Akamai's; there are others).

Internally, a layer 7 firewall should have protections against this. Most layer 7's work with "DPI" and "stateful" detection which means that if you're getting a packet that doesn't make sense for the communication flow, it will be blocked. It will also cut connections for slow loris and other common attacks.

How does your small subnet use the internet? What are you required to allow in? Can you set this up in "proxy half open" which means that anything is allowed out to start a connection, but all incoming connection requests are blocked? That alone should solve this problem so long as the packet flood isn't more than your ISP "pipeline."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.