0

I recently set up a local server on my home network to host some files and personal webapps. In an attempt to improve security, I bought a pfsense-based firewall. I know some basics of networking but I'm not particularly advanced, so I tried to do some general reading about firewalls as I was setting things up.

There was a long thread that I read on some forums where the benefits of firewalls on a home network were discussed. The general consensus seemed to be that if you were to hook your computer (say a Windows desktop machine) directly to the internet with no router or firewall, that it would very quickly get compromised. This seems to (at least intuitively) make sense, as a computer is running lots of software, where any application could have some vulnerability. Things might be patched or not.

So here is where my question is: If the pfsense firewall essentially running a full OS (FreeBSD), then what makes it any more secure than a desktop machine plugged directly into a firewall? The firewall is loaded with software like VPN servers, DHCP servers, cert CA, DNS resolvers, firewall filtering, logging, admin interfaces (the web gui), and so on, so it's not like it is running a particularly lean configuration. In addition, desktop machines update very quickly, while the firewall OS hasn't been updated in over 5 months.

In fact, I wonder if running a firewall like this simply increases the amount of attack vectors compared to something much simpler like the NAT on a basic router. This also means that if the firewall is compromised, all those services mentioned before would also now be compromised.

0
3

The general consensus seemed to be that if you were to hook your computer (say a Windows desktop machine) directly to the internet with no router or firewall, that it would very quickly get compromised.

Modern Windows systems have a built-in firewall which severely restrict access, at least if the computer is declared as being in a public (and thus insecure) network. So it is actually not that bad as what you've read.

On the other hand most attacks today against users of desktop machines are not directly attacking the machine from the outside. Instead the user "invites" the attacker when reading mails or surfing the web, i.e. it explicitly downloads potentially malicious code to the computer in the form of mail attachments, alleged browser plugins, alleged software updates or similar. Basic firewalls like pfsense are not designed to protect such attacks at the application level, i.e. they provide none or only rudimentary protection.

Are firewalls based on linux secure?

Just using Linux does not make a firewall magically secure - but it also does not make it magically insecure. And FreeBSD is not Linux anyway (but also not implicitly secure or insecure).

... what makes it any more secure than a desktop machine plugged directly into a firewall? The firewall is loaded with software like VPN servers, DHCP servers, cert CA, DNS resolvers, firewall filtering, logging, admin interfaces (the web gui), and so on, so it's not like it is running a particularly lean configuration.

True. And especially if these services are facing the internet or are indirectly accessible from the internet (like with CSRF attacks) they can be a problem. Critical bugs in VPN stacks and WebGUI's of Firewalls actually happen.

In fact, I wonder if running a firewall like this simply increases the amount of attack vectors compared to something much simpler like the NAT on a basic router.

Just to protect a desktop computer, a firewall like pfsense if likely overkill on one side and not sufficient on the other. In such a scenario it will not add much value compared to some simple router, as long as this router is actually secure. And like you said it can actually increase the attack surface.

It is different though with more complex networks and/or with more need (and expertise) to monitor and control what happens. For example one might want to separate IoT devices from the rest of the network, have a network wide VPN, have a server accessible from outside but separated from the inside, have more visibility in the traffic etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.