Let's say that our first firewall has some vulnerability and a malicious person is able to exploit it. If there's a second firewall after it, he/she should be able to stop the attack, right?

Also, what will be the side-effects? I mean, would this slow the traffic or not? What are other possible effects like this one?

Here is what I mean for configuration:

  • Firewall 1 → Firewall 2 → Network
  • Firewall 1 is different from Firewall 2
  • 1
    @naught101 Better use socks with holes in different places as a metaphor, since condoms are known for tearing from friction against each other. I suppose two firewalls could also have trouble working together. Commented Jul 4, 2014 at 1:26
  • It would be nice to know of a concrete instance where two firewalls in series actually saved the day or conversely were of no help whatsoever against a well-crafted attack. Due to the nature of the beast, the first case is likely to be rare and undocumented, the second case is is likely to have occurred quite a few times (e.g. via successful drive-by download attack). Commented Sep 16, 2014 at 15:08
  • @user1306322, Why will two firewalls have trouble working together? Isn't the encapsulation supposed to be transparent?
    – Pacerier
    Commented May 22, 2015 at 11:07

8 Answers 8



There are both advantages and disadvantages having two firewalls. While firewalls are not commonly exploited, they are prone to denial of service attacks.

In a topology with a single firewall serving both internal and external users (LAN and WAN), it acts as a shared resource for these two zones. Due to limited computing power, a denial of service attack on the firewall from WAN can disrupt services on the LAN.

In a topology with two firewalls, you protect internal services on the LAN from denial of service attacks on the perimeter firewall.

Of course, having two firewalls will also increase administrative complexity - you need to maintain two different firewall policies + backup and patching.

Some administrators prefer to only filter ingress traffic - this simplifies the firewall policy. The other practice is to maintain two seperate rulesets with both outbound and inbound filtering. If you need an opening from LAN to WAN, you will have to implement the rule on both firewalls. The rationale behind this is that a single error will not expose the whole network, only the parts the firewall is serving directly. The same error has to be done twice.

The main disadvantage is cost and maintenance, but in my opinion the advantages outweighs these.

  • No, the main disadvantage is that you've added another single point of failure in your network. Commented Jul 5, 2014 at 23:30
  • Also, point of note, but almost all industry-grade firewalls in the market nowadays can handle a DMZ setup with only a single firewall box by maintaining different networks on different ethernet ports. Commented Jul 5, 2014 at 23:39
  • 3
    If you worry about single points of failures, redundancy is the option. In this case, single points of failures are not "random", as it is initiated by malicious intent. What is worst? A denial of service disrupting the whole network, or just the external network? Commented Jul 6, 2014 at 22:06

As a rule, No.

Firewalls aren't like barricades that an attacker has to "defeat" to proceed. You bypass a firewall by finding some path through that isn't blocked. It's not so much a matter of how many obstacles you put up but rather how many pathways through you allow. As a rule, anything you can do with two firewalls (in the same spot) you can do with one.

Now, if you're putting the firewalls in different places for different reasons, that's another story. We can't all collectively share a single firewall.

  • 1
    This is why I give a specific situation in my question. Let's say that an attacker have some exploit for this firewall and he is able to bypass it. In this case I think that the second FW will be able to prevent the attack. Commented Jul 1, 2014 at 16:54
  • 40
    As a rule, you don't exploit a firewall. There's no code you can download that will defeat Juniper firewalls or Cisco firewalls. You bypass a firewall by tunneling your traffic over connections that the firewall is already configured to allow.
    – tylerl
    Commented Jul 1, 2014 at 17:16
  • 3
    @Kiwy you will find that 99.99% of those vulnerabilities are created by already open connections in particular configurations, there is no way to physically hack a firewall that is actively blocking you. You attack a connection that already accepts you.
    – Sammaye
    Commented Jul 3, 2014 at 18:01
  • 5
    Sigh, _ Firewalls aren't like barricades that an attacker has to "defeat" to proceed_ except in all the movies and TV episodes I've seen that mention them falling one by one. For a giggle, see strangecharmed.com/internet/become-a-tv-hacker-in-3-seconds
    – Andy Dent
    Commented Jul 4, 2014 at 2:00
  • 3
    @Tylerl I think the NSA would disagree, it's entirely possibly to download software (to the firewall) that'd compromise it.
    – NPSF3000
    Commented Jul 6, 2014 at 1:32

Are two firewalls better than one ? There are two perspective to that from a hacker point of view it doesn't matter as they look for open ports for exploitation. From a network administrator point of view firewall do create a single point of failure. Using Multiple firewall can provide redundancy if an active device firewall fails then service traffic is switched to backup firewall. Depending upon the type of firewall deployed there must be synchronization between two firewalls before link switchover. Furthermore Multiple Firewall can be deployed in.

  1. Active-Standby Mode (Having Backup firewall in place)
  2. Load Balancing (Both Firewall in active mode)

Source : White Paper Stateful failover Techniques

enter image description here

  • Although a valid opint, the question stipulates firewalls "after" each other, and not in a HA setup.
    – ndrix
    Commented Jul 3, 2014 at 10:02
  • @m1ke I agreed and my answer was to address the problems with OP current Firewall configuration.
    – Ali Ahmad
    Commented Jul 3, 2014 at 11:54

There is potentially a scenario in which firewall software has a bug that causes it to allow traffic through which it shouldn't. In that case, there might be a benefit to having a second firewall behind the first running different software, on the assumption that the different software does not suffer from the same bug.

But how common are firewall bugs? My feeling is that they are not common enough to justify the additional complexity of this setup, which raises the risk of misconfiguration, and causes you to waste time that might be better spent securing the services behind the firewall.

  • Well it mainly depend on what you secure. If I must secure server with highly confidential data, in this case it will be better to use two. Commented Jul 2, 2014 at 7:23
  • 2
    @user3395407 for completeness, I note that securing a server with highly confidential data is not simply a case of deploying multiple firewalls. Defense-in-depth is required from the policy/management level to the technical configuration of the server software, taking care to avoid the implicit assumption that internal traffic is trusted (often a bad premise for deriving a security policy). If the data is so highly confidential as to be disastrous if it leaked, you'd be looking at more than just "putting in a firewall"; right up to formal verification of the server software, for instance. Commented Jul 2, 2014 at 13:35

Features and capabilities differ a lot between firewalls, so you can not simple ask if two firewalls would be better than a single one. I guess that you have a limited budget, so it might be better to get a single, but more capable firewall for the same money, than two cheaper firewalls, which even combined have less capabilities than the more expensive appliance.

But, if you have enough money it might be a good idea to combine capable devices from different vendors, so they get together a more secure system. Of course, it will not only cost more money to buy these firewalls, but also to maintain them. Each of them will have a different interface, slightly different capabilities or at least different ways to achieve the same thing. So you have to get administrators which are fluent in all these different models, maybe have to find some way to combine the different logs and alerts from the different firewalls etc.

So yes, it will be more secure, but only if you have the money to buy capable devices and administrators. If you are on a limited budget I would suggest to better get the best single device and administrator you can get for your money.


I agree with tylerl's answer above. However, reading the comments under that answer, there's contention where there shouldn't be... which is caused by confusion I hope to clear up. And then explain why I think two firewalls are not better than one for the question asked.

Point of contention: can a firewall be exploited? One group says no, while others say yes.

Here's the important question to ask: can you administer the firewall on the network?

For argument's sake, I setup a Linux box as a firewall to manage traffic between the internet and my home network (wired + wi-fi). I also configure it such that the firewall machine is NOT on the network, so the only way to make changes to the firewall rules is to physically logon to the machine.

In this administration un-networked configuration it is impossible to exploit my firewall from the internet or from my home network. To exploit it you would first need to break into my house and access the machine physically.

As pointed out by several people, the firewall aspect is simply a barricade that decides what traffic gets let in - there's nothing exploitable about that part.

But if I reconfigured my setup so the firewall machine so it is also connected to the same home network and made accessible via SSH, then I will be taking a risk. Any attacker that gets into my home network (through whatever ports that were open from the firewall) could then utilize some SSH exploit to get in the firewall machine.

Let's say that our first firewall has some vulnerability and a malicious person is able to exploit it.

This implies your first firewall box was connected to a network accessible to attacker, and there was some accessible service like SSH to exploit.

If there's a second firewall after it, he/she should be able to stop the attack, right?

Depends - is your second firewall box also connected to a network accessible to the attacker? If so, then sure it could be exploited by a savvy attacker as well.

In reality I would not expect seasoned admins to make such rookie mistakes.


There is a dual approach concept in IT security, where you have either an Eggshell concept with one hardened firewall, but break the shell you get into the core (we see a lot of vulnerabilities exploited on firewalls nowadays, see latest FG issue in 2020) or the better approach in my opinion, the onion approach, with several layers of security. Stack 2 HA redundant firewall layers and a DMZ in between is a good approach.. Firewalls should be of different models/vendors


Multiple Firewalls are definitely better than one. I use three. Behind the first is the DMZ with "honey pot" which monitors traffic, has the Email Proxy, Browser Proxy, and the Internet servers; all SE Linux. Honey Pot information helps in creating the Black List for the second firewall. Behind the second firewall is the Intranet servers, printers, and low security (Windows) computers. Behind the third firewall, which has a White List, is manager level computers and servers. Between Monitoring, three different fire walls, a Black List and a White List you create a very secure network. The key is the Honey Pot which lets you know who is trying to attack you so you can adjust the Black list and rules to protect your Intranet data. Public Email is via a Linux Proxy which is connected to remotely. Attachments have to be downloaded remotely then can be retrieved after scanning, if needed. In over 4 years, I haven't had a virus beyond the DMZ, unless its still unknown. So far, viruses were all caught at the Proxy Servers as soon as downloaded. Browsing is via a Proxy machine also, nothing is downloaded directly off the Internet behind the 2nd or 3rd firewall. Ports are reassigned above 1024 so the 2nd and 3rd Routers are almost Black Holes. New customer information is pulled to more secure servers daily. All management machines are Linux. Initially, setting up and Black Listing is time consuming, once the big offenders (Microsoft, Google, and NSA) are locked out things are easy to maintain.

  • 1
    I'm not seeing anything here that couldn't be done with just a single firewall and well-written rules.
    – Mark
    Commented Feb 14, 2018 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .