8

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough?

I'm running a VPS with Rackspace on their cloud offering. It's running Windows Server 2008. I don't believe there are any other firewalls between it and the outside world. I've got a few things on there ranging from my blog through to a couple of client websites. None of which are eCommerce but I'm sure the clients would like their data kept private.

Improve this question
2
  • Suitable for running? Yes. Sufficient on its own? Rarely. Can you describe a little more?
    – Jeff Ferland ♦
    Oct 12, 2011 at 14:05
  • I think we need a bit more information to make an informed opinion. Which version of Windows, how will it be managed, by sole protection do you mean no other firewalls between it and your clients, etc? What is the criticality of the asset and what types of threats are you trying to protect it against?
    – Scott Pack
    Oct 12, 2011 at 14:43

4 Answers 4

Reset to default
5

I guess it is up to you and your experiences. We (the company I'm working for) are using Windows Firewall. As far as I know, a lot of small enterprises are running Windows Firewall. It is "only" a firewall, and is therefore not more secure than what you make it yourself. Consider it ACL (Access Control Lists) you specify what traffic you allow and what you do not.

I can recommend these two sites for you, if you consider using Windows Firewall.

This one is a "How to configure windows firewall in a small enterprise:
http://technet.microsoft.com/en-us/library/cc875816.aspx

And this one is a textfile provided by Microsoft with an Introduction to Advanced Configuration of Windows Firewall:
Introduction to Windows Firewall with Advanced Security

Improve this answer
3

I'm not sufficiently familiar with the Windows firewall, but I think it does not allow really fine-grained control but only "Please allow WWW". Hence, it is only suitable for beginners, IMO. But there are more fundamental problems to consider:

If the underlying Windows system has a problem, chances are that both, the firewall and the webserver, become compromised, allowing the adversary to extend his influence as he likes. Especially if they reside on the same machine.

In contrast, you could significantly reduce the attack surface if you deploy a BSD-based firewall in front of the Windows server. BSD has much less bugs/month and the packet filter would be able to prevent the exploitation of bugs on the windows box or at least restrict/monitor communication.

Due to the reduced code base, update rate and bug rate, the BSD box also adds only minimal maintenance overhead once it is deployed. If you have someone familiar with Linux/iptables it may also be worth looking into a specialized Linux distribution, such as Shorewall, or strip down your favorite Linux distribution.

Improve this answer
2
  • The firewall, at least on modern server instances, is fairly configurable. One might need to use GPOs or other non-clicky interfaces, though.
    – Scott Pack
    Oct 16, 2011 at 1:02
  • Hi, I don't really understand how it can be more secure. If the Windows box is so compromised that the attacker can mess with Windows's firewall, how can an external firewall help ? Do you suggest that this external firewall should also block parts of "output" traffic, i.e from the Windows server to the Internet ? A malware on a Windows box that as access even to one port could do whatever it wants through this port.
    – Hey
    Aug 10, 2016 at 11:58
2

It sounds like your firewall and webserver are on the same machine -- this increases your attack surface.

You need to quantify the assets that you are protecting, then you can determine the amount of money to spend protecting them.

Improve this answer
1
  • Host based firewalls work like that. Network based firewalls protect VLANs from accessing each other. Host based firewalls (also knowns as HIPS) can protect the host itself from any access even on the same LAN segment.
    – security_obscurity
    Nov 1, 2015 at 6:51
2

I would say no, it is not. Your firewall is running on the same server that is providing content or resources and that is considered to be bad practice. The attack surface available to an attack is to large.

What we did to get around this is to book a small CentOS Linux machine in addition to the Windows machine, setup IPTables as a firewall and use Nginx to proxy all port 80 and 443 web requests through to IIS on the windows machine.

The web app users get a response from a Ngix server and there is a proper layer of security and control BEFORE they even see IIS.

That's my .02$

SG

Improve this answer
2
  • 1
    "The attack surface available to an attack is to large." please explain: what is the attack surface, and how larger is it?
    – curiousguy
    Jun 19, 2012 at 20:22
  • @curiousguy: Essentially, the problem is that with the Windows server exposed to the Internet, everything on the server that is listening to network traffic - which is a lot of stuff, though most of it will only listen to internal or even loopback traffic - is separated from the Internet only by firewall software that itself is part of the server's attack surface. By placing a dedicated firewall (possibly plus load balancing) box in front of the web server, you can have a minimal Internet-reachable attack surface, and defense in depth (because the Windows box is still firewalled too).
    – CBHacking
    Nov 1, 2015 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.