1

In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware.

The only ports that are open to accept connections are the ones from services that I'm running, and want to be able to access. If there's a zero-day in Apache or OpenSSH, the firewall won't help you.

So, it seems like the only thing that a firewall does is make it harder for me to setup new services (by having to figure out what ports to open).

So, in a server-based environment, where the machines are all under my control, what is there to be gained from having a firewall?

Improve this question
1
  • Pedantic note: The question would probably be better phrased as something like "Should my I set my default firewall policies to block?", because these days pretty much every (non-embedded) OS comes with built-in firewall functionality. In your case that's probably iptables/nftables. You just haven't changed its chains' default ACCEPT policy or added any rules.
    – Will
    Commented Jan 28, 2019 at 0:21

2 Answers 2

Reset to default
1

Additional security usually decreases functionality, so it is for you to establish the risk and see if the benefits of a local firewall outweigh the limited functionality. The purpose of a firewall is to block based on a port but also based on the source IP. A server local firewall adds a layer of security that seems redundant to you, but if another layer of security fails, it could prevent malicious activity.

Scenarios this could help you with:

  • If you want to limit who can ping or make console connections to the server, based on console port and a limited number of accepted IPs
  • If new software is installed and starts listening on a new port, firewall will prevent connections to this service unless a matching firewall rule is also added
  • If the server was scanned for services from the outside or inside the network, a local firewall could reduce the results and focus an upcoming attack somewhere else
  • If you did have a vulnerability so severe as to want to block web traffic to the server, you could be better prepared for this if the firewall is pre-installed and working
Improve this answer
0

As mentioned above, it does decrease functionality, but it helps add a layer of protection, thus preventing a single point of failure on your network. Not only that, but by implementing logs, (even just the absolute basic logging)- you’re helping create an audit trail to see what exactly what was accessed, rather than just a singular log somewhere else upstream.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .