Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Let's say that our first firewall has some vulnerability and a malicious person is able to exploit it. If there's a second firewall after it, he/she should be able to stop the attack, right?
Also, what will be the side-effects? I mean, would this slow the traffic or not? What are other possible effects like this one?
Here is what I mean for configuration:
There are both advantages and disadvantages having two firewalls. While firewalls are not commonly exploited, they are prone to denial of service attacks.
In a topology with a single firewall serving both internal and external users (LAN and WAN), it acts as a shared resource for these two zones. Due to limited computing power, a denial of service attack on the firewall from WAN can disrupt services on the LAN.
In a topology with two firewalls, you protect internal services on the LAN from denial of service attacks on the perimeter firewall.
Of course, having two firewalls will also increase administrative complexity - you need to maintain two different firewall policies + backup and patching.
Some administrators prefer to only filter ingress traffic - this simplifies the firewall policy. The other practice is to maintain two seperate rulesets with both outbound and inbound filtering. If you need an opening from LAN to WAN, you will have to implement the rule on both firewalls. The rationale behind this is that a single error will not expose the whole network, only the parts the firewall is serving directly. The same error has to be done twice.
The main disadvantage is cost and maintenance, but in my opinion the advantages outweighs these.
As a rule, No.
Firewalls aren't like barricades that an attacker has to "defeat" to proceed. You bypass a firewall by finding some path through that isn't blocked. It's not so much a matter of how many obstacles you put up but rather how many pathways through you allow. As a rule, anything you can do with two firewalls (in the same spot) you can do with one.
Now, if you're putting the firewalls in different places for different reasons, that's another story. We can't all collectively share a single firewall.
Are two firewalls better than one ? There are two perspective to that from a hacker point of view it doesn't matter as they look for open ports for exploitation. From a network administrator point of view firewall do create a single point of failure. Using Multiple firewall can provide redundancy if an active device firewall fails then service traffic is switched to backup firewall. Depending upon the type of firewall deployed there must be synchronization between two firewalls before link switchover. Furthermore Multiple Firewall can be deployed in.
Source : White Paper Stateful failover Techniques
There is potentially a scenario in which firewall software has a bug that causes it to allow traffic through which it shouldn't. In that case, there might be a benefit to having a second firewall behind the first running different software, on the assumption that the different software does not suffer from the same bug.
But how common are firewall bugs? My feeling is that they are not common enough to justify the additional complexity of this setup, which raises the risk of misconfiguration, and causes you to waste time that might be better spent securing the services behind the firewall.
highly confidential data is not simply a case of deploying multiple firewalls. Defense-in-depth is required from the policy/management level to the technical configuration of the server software, taking care to avoid the implicit assumption that internal traffic is trusted (often a bad premise for deriving a security policy). If the data is so highly confidential as to be disastrous if it leaked, you'd be looking at more than just "putting in a firewall"; right up to formal verification of the server software, for instance.
– Cosmic Ossifrage
Jul 2 '14 at 13:35
Features and capabilities differ a lot between firewalls, so you can not simple ask if two firewalls would be better than a single one. I guess that you have a limited budget, so it might be better to get a single, but more capable firewall for the same money, than two cheaper firewalls, which even combined have less capabilities than the more expensive appliance.
But, if you have enough money it might be a good idea to combine capable devices from different vendors, so they get together a more secure system. Of course, it will not only cost more money to buy these firewalls, but also to maintain them. Each of them will have a different interface, slightly different capabilities or at least different ways to achieve the same thing. So you have to get administrators which are fluent in all these different models, maybe have to find some way to combine the different logs and alerts from the different firewalls etc.
So yes, it will be more secure, but only if you have the money to buy capable devices and administrators. If you are on a limited budget I would suggest to better get the best single device and administrator you can get for your money.
I agree with tylerl's answer above. However, reading the comments under that answer, there's contention where there shouldn't be... which is caused by confusion I hope to clear up. And then explain why I think two firewalls are not better than one for the question asked.
Point of contention: can a firewall be exploited? One group says no, while others say yes.
Here's the important question to ask: can you administer the firewall on the network?
For argument's sake, I setup a Linux box as a firewall to manage traffic between the internet and my home network (wired + wi-fi). I also configure it such that the firewall machine is NOT on the network, so the only way to make changes to the firewall rules is to physically logon to the machine.
In this administration un-networked configuration it is impossible to exploit my firewall from the internet or from my home network. To exploit it you would first need to break into my house and access the machine physically.
As pointed out by several people, the firewall aspect is simply a barricade that decides what traffic gets let in - there's nothing exploitable about that part.
But if I reconfigured my setup so the firewall machine so it is also connected to the same home network and made accessible via SSH, then I will be taking a risk. Any attacker that gets into my home network (through whatever ports that were open from the firewall) could then utilize some SSH exploit to get in the firewall machine.
Let's say that our first firewall has some vulnerability and a malicious person is able to exploit it.
This implies your first firewall box was connected to a network accessible to attacker, and there was some accessible service like SSH to exploit.
If there's a second firewall after it, he/she should be able to stop the attack, right?
Depends - is your second firewall box also connected to a network accessible to the attacker? If so, then sure it could be exploited by a savvy attacker as well.
In reality I would not expect seasoned admins to make such rookie mistakes.
Multiple Firewalls are definitely better than one. I use three. Behind the first is the DMZ with "honey pot" which monitors traffic, has the Email Proxy, Browser Proxy, and the Internet servers; all SE Linux. Honey Pot information helps in creating the Black List for the second firewall. Behind the second firewall is the Intranet servers, printers, and low security (Windows) computers. Behind the third firewall, which has a White List, is manager level computers and servers. Between Monitoring, three different fire walls, a Black List and a White List you create a very secure network. The key is the Honey Pot which lets you know who is trying to attack you so you can adjust the Black list and rules to protect your Intranet data. Public Email is via a Linux Proxy which is connected to remotely. Attachments have to be downloaded remotely then can be retrieved after scanning, if needed. In over 4 years, I haven't had a virus beyond the DMZ, unless its still unknown. So far, viruses were all caught at the Proxy Servers as soon as downloaded. Browsing is via a Proxy machine also, nothing is downloaded directly off the Internet behind the 2nd or 3rd firewall. Ports are reassigned above 1024 so the 2nd and 3rd Routers are almost Black Holes. New customer information is pulled to more secure servers daily. All management machines are Linux. Initially, setting up and Black Listing is time consuming, once the big offenders (Microsoft, Google, and NSA) are locked out things are easy to maintain.
