Why should the firewall be outside the server, excepting these two items
- Take the performance impact of noise off of the server.
Add a physical layer between devices so they can be on separate subnets, then use ACL to prevent IP spoofing. This way, the IP address can be dependably used to verify which internal network the packets are from. (data from an internal network would be dropped if the IP address did not match, data from the web would be blocked if the IP address matched one of the internal networks).. This could probably be accomplished by using the alternate ethernet ports on the servers, but the separate device seems easier to manage.
Actually, I tend to think that source IP checks could be replaced with private keys and encryption handshakes, but I understand that this can be impractical.
Aside from that, it seems to me that the software firewall should be handling everything, including blocking off protocols, suppressing "connection refused", etc.
That leaves these
- The lack of a good software firewall solution (for example my windows PC should probably never be connected directly to the internet.
- Adding a second layer, in case the software firewall is mis-configured.
- "making up" for shortcomings in the software on board, for example a firewall might get automatically updated with the latest inspection rules,, but if the software is secure to begin with,, this should not be an issue.
Please enlighten me if I am missing something on the correct purpose of a separate device. I find that I think that the first two items are the only legitimate purpose. The rest is just making up for shortcomings of the server.