HN Explorer

Ask HN: Do I need a hardware firewall for my first dedicated server?

6 points by potatofish ↗ HN
I'm getting ready to deploy the first phase of my app on a dedicated machine. Phase I is not public, meaning it has no web site, other than the one I use to administrate the app, and it takes no connections other than SSH. I will be running the latest Ubuntu Server, and using UFW for the firewall.

Question is, should I spend the $50 that Softlayer asks for a 10Mbps hardware firewall? Is Ubuntu's firewall enough?

10 comments

[ 6.7 ms ] story [ 32.2 ms ] thread
andrewtj
The only practical thing I can see it doing for you is giving you extra administrative overhead.
yourabi
A software firewall should be sufficient at first. It makes sense putting off any additional spending until the app is validated and you start to scale
potatofish
So that means that the OS firewall is safe enough that I shouldn't worry about it being compromised? I suppose the HW firewall could also be compromised, but it does give a bit of extra piece of mind.
yourabi
In isolation yes - it is unlikely the vector of attack would (ever) be the firewall itself. In fact I think system level attacks are less likely than application level attacks (SQL injection, XSS..etc)

I think you really get some performance features (like SSL offloading...etc)

gojomo
The software firewall is plenty. Make sure services on the ports that are open are as locked-down as possible: no brute-forceable passwords for SSH; conservative web server configuration and vigilant security updates of all software used.

Then spend the money saved on the hardware firewall on more frequent and offsite backups of crucial data.

bl4k
Software firewall is fine for a single machine - plus the hardware firewall you were quoted would restrict your throughput to only 10Mbps - which is not a lot and would be maxed out with 4-5 concurrent users
staunch
In a typical web app scenario 10 Mbit is far more than sufficient to handle hundreds or thousands of active users. Only if you're serving up large static files (or similar) would 10 Mbit become a bottleneck, and even in that case with throttling you could give ~25 concurrent users sufficient speed to stream a video, etc.
staunch
No. You're infinitely more likely to get in trouble by running crappy or out of date software. Worry about that and little else.
famfam
Enlighten me, what's all this talk of firewalls? Am I just a caveman for doing everything with iptables?
[dead] wendroid
1) move your ssh to another port, scanners will find it but you really get hammered on 22

2) if you can, require a certificate to connect rather than a password

3) disallow root to ssh and then IPban anyone who tries to login as root

I use this http://www.maht0x0r.net/denial.html

I wrote it a long time ago, I might do it slightly different now but it's been running for 5 years or so.