Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is having local firewalls enabled on machines actually necessary if you run hardware based firewalls like pfsense or a netgear fvs338 and use that to control in/out bound connections?
I personally do not see how a firewall locally adds any type of protection (assuming no infections happen) other then just another layer of ACL.
Host based firewalls aren't necessary if you have a dedicated network firewall.
However, defence in depth is always a good thing to practice. Host based firewalls allows you a more fine grained control on a machine to machine basis as well as allowing you to filter traffic coming from internal networks. This can be a great asset in preventing a single compromised machine on your network from compromising the rest of your network.
In a well-designed operating system with adequate maintenance, there is no process which runs and offers services and implies various activities except those that are strictly necessary for what the system administrator and user intend the machine to do.
Unfortunately, desktop OS have grown way past the point where such an efficient simplicity could be realistically achieved. You have to cope with OS including a lot of undocumented elements and activities, some of which implying network activity, in particular listening to incoming requests on some port and thus offering a service to outsiders. It is a good idea to make an inventory of what is running on your machine and try to track such unwanted elements (look at the list of process, also see the open ports with netstat -a, and so on).
However, it is also a good idea to enforce a strict in/out policy for everything related to networking, in case you did not make a full cleansing. A firewall is something which enforces this in/out policy. Your external hardware firewall will trap all activity which goes through it but it may not see activity related to the local network (and Windows systems do that a lot, with all the NetBIOS stuff). A local firewall, being local, can see every single byte that enters of exit the machine, so it is more thorough for detecting unwanted activity.
On the other hand, an external firewall will be more efficient at blocking attacks which target the implementation of low-level network protocols directly; the local firewall gets to act only after the IP packet has been received and some processing already occurred in the OS kernel, so it is a bit too late for the kind of attack which exploits buffer overflows in the kernel. In that sense, the external firewall and the local firewall complement each other. They both can do things that the other cannot, even though there is some partial overlap in their respective functionalities.
Host based firewalls are the only firewalls that have access to what process is trying to access the network. It does depend on how restrictive you can be with the hardware firewall, but unless it is really restrictive, malware within the network could likely pretend to be a legitimate service or even use a legitimate service's protocol to communicate out. In these cases, a host based firewall will have a much better chance of stopping the threat.
It won't help any if the malware uses the actual process for a service that is authorized, but if the malware starts trying to send it's own e-mail or Skype messages or something, then a host based firewall will prevent it unless the process is authorized.
So, while a good hardware firewall may reduce the benefit of host based firewalls, it doesn't remove it entirely.
