In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware.

The only ports that are open to accept connections are the ones from services that I'm running, and want to be able to access. If there's a zero-day in Apache or OpenSSH, the firewall won't help you.

So, it seems like the only thing that a firewall does is make it harder for me to setup new services (by having to figure out what ports to open).

So, in a server-based environment, where the machines are all under my control, what is there to be gained from having a firewall?

  • Pedantic note: The question would probably be better phrased as something like "Should my I set my default firewall policies to block?", because these days pretty much every (non-embedded) OS comes with built-in firewall functionality. In your case that's probably iptables/nftables. You just haven't changed its chains' default ACCEPT policy or added any rules.
    – Will
    Jan 28 '19 at 0:21

Additional security usually decreases functionality, so it is for you to establish the risk and see if the benefits of a local firewall outweigh the limited functionality. The purpose of a firewall is to block based on a port but also based on the source IP. A server local firewall adds a layer of security that seems redundant to you, but if another layer of security fails, it could prevent malicious activity.

Scenarios this could help you with:

  • If you want to limit who can ping or make console connections to the server, based on console port and a limited number of accepted IPs
  • If new software is installed and starts listening on a new port, firewall will prevent connections to this service unless a matching firewall rule is also added
  • If the server was scanned for services from the outside or inside the network, a local firewall could reduce the results and focus an upcoming attack somewhere else
  • If you did have a vulnerability so severe as to want to block web traffic to the server, you could be better prepared for this if the firewall is pre-installed and working

As mentioned above, it does decrease functionality, but it helps add a layer of protection, thus preventing a single point of failure on your network. Not only that, but by implementing logs, (even just the absolute basic logging)- you’re helping create an audit trail to see what exactly what was accessed, rather than just a singular log somewhere else upstream.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.