Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance

Question

Why should the firewall be outside the server, excepting these two items

• Take the performance impact of noise off of the server.

• Add a physical layer between devices so they can be on separate subnets, then use ACL to prevent IP spoofing. This way, the IP address can be dependably used to verify which internal network the packets are from. (data from an internal network would be dropped if the IP address did not match, data from the web would be blocked if the IP address matched one of the internal networks).. This could probably be accomplished by using the alternate ethernet ports on the servers, but the separate device seems easier to manage.

  Actually, I tend to think that source IP checks could be replaced with private keys and encryption handshakes, but I understand that this can be impractical.

Aside from that, it seems to me that the software firewall should be handling everything, including blocking off protocols, suppressing "connection refused", etc.

That leaves these

• The lack of a good software firewall solution (for example my windows PC should probably never be connected directly to the internet.
• Adding a second layer, in case the software firewall is mis-configured.
• "making up" for shortcomings in the software on board, for example a firewall might get automatically updated with the latest inspection rules,, but if the software is secure to begin with,, this should not be an issue.

Please enlighten me if I am missing something on the correct purpose of a separate device. I find that I think that the first two items are the only legitimate purpose. The rest is just making up for shortcomings of the server.

Answer 1

The point of a separate device is to reduce the likelihood of exploitation. Any service you run on a device may have a vulnerability which an attacker could exploit.

A firewall's job is literally to make access control decisions to traffic based on a set of rules. If it also ran an ftp server for example, an attacker could try to exploit that ftp server escalate to controlling the firewall and then modify the access control rules to allow anything in or out.

While using netstat can help, and to really lock down an environment you could run access controls on every device, in practice it is easier to place controls on those devices which pass traffic into and out of a network.

Most corporates these days do have limited controls on every endpoint - antivirus, blocking of certain websites, firewalls to prevent split tunnelling etc., but not to the same degree.

Answer 2

One reason for a separate device is so that you can remove everything that is not strictly required for the safe operation of the firewall. This reduces the number of possible attacks on the device which increases security.

Answer 3

There are many good software firewalls that run as separate devices. The issue is "separate device" more than anything else.

The point of a separate device is that it's a single point of control for the entire network.

For example, let's say that somebody plugs in a notebook computer into the network. If there is no firewall device, it's open to the Internet as well as open to the local Internet, and a hacker can exploit that to hop into your network.

Technically, you don't really need a firewall on a server: just run netstat, and disable all ports that aren't supposed to be opening and listening. The reason you have a separate firewall device providing central control is that you often make mistakes doing that, more than in the firewall.

As you might expect, for big corporations, firewalls rulesets become so big and error prone that they become a single point of failure rather than a single point of control.