This. It’s unnecessary but it’s another layer.
Comment on Do I really need a firewall for my server?
Fizz@lemmy.nz 2 weeks ago
Disclaimer, I’m not a network professional im only learning. But you dont need ufw since your router firewall should be able to filter majority of the traffic. But in security there is a concept of layers. You want your router firewall then your device firewall to provide multiple layers incase something slips through one layer.
So to give a simple answer, it depends how secure you want your network to be. Personally I think UFW is easy so you may as well set it up. 5sec of config might stop a hacker traversing your network hoping from device to device.
null_dot@lemmy.dbzer0.com 2 weeks ago
elvith@feddit.org 2 weeks ago
Instead of thinking with layers, you should use think of Swiss cheese. Each slice of cheese has some holes - think of weaknesses in the defense (or intentional holes as you need a way to connect to the target legitimately). Putting several slices back to back (in random order and orientation) means that the way to penetrate all layers is not a simple straight way, but that you need to work around each layer.
null_dot@lemmy.dbzer0.com 2 weeks ago
I’ve heard this analogy before but I don’t really care for it myself.
It creates a mental image but isn’t really analogous.
In the case of a firewall on a server behind a NAT, ports forwarded through the NAT are holes through the first several slices.
elvith@feddit.org 2 weeks ago
If done correctly, those may only be open from the internet, but not from the local network. While SSH may only be available from your local network - or maybe only by the fixed IP of your PC. Other services may only be reachable, when coming from the correct VLAN (assuming you did segment your home network). Maybe your server can only access the internet, but not to the home network, so that an attacker has a harder time spreading into your home network (note: that’s only really meaningful, if it’s not a software firewall on that same server…)
agile_squirrel@lemmy.ml 2 weeks ago
I have about 20 services on my machine so I’m going to need to open a ton of ports (ssh, SSL, multiple higher number ports since some services require several ports). At that point, what is the point of a firewall if so many ports are open? With so many ports open, it seems like a firewall doesn’t add much security vs the complexity it adds.
swab148@lemm.ee 2 weeks ago
Sounds like you could use a reverse proxy.
Jakeroxs@sh.itjust.works 2 weeks ago
That doesn’t count as a firewall though no? I use traefik as my reverse proxy (and like one thing on nginx that also goes through traefik ultimately) but I still put crowdsec on top
swab148@lemm.ee 2 weeks ago
No, but putting a bunch of those services behind a reverse proxy would lower the amount of open ports. It would also have the side effect of making firewall configuration easier, since you don’t need rules for all those ports anymore.
Fizz@lemmy.nz 1 week ago
If someone exploits a service on the machine they can then connect outside that machine on any port. Ufw would prevent this. The router firewall would also likely prevent this unless they used an open port of the router or upnp was enabled.
eldain@feddit.nl 2 weeks ago
I recommend fail2ban to stop the automated attacks that are the background noise of the internet. It will set your firewall to block certain ip’s for a while, especially ports 21/22 are getting hammered with dictionary login attempts. And port 80 and 8080 for example get constantly version checked to see if you are vulnerable with an old apache, old dokuwiki etc, so don’t expose more than you need to and maybe learn about ssh tunnels and close a few.
I once installed ossim in a small network with a server and it showed me it is war out there, scripts flying everywhere.
lud@lemm.ee 2 weeks ago
Also get rid of password authentication if you can.
agile_squirrel@lemmy.ml 1 week ago
My server is only available on my LAN and via a VPN. Is fail2ban applicable? Or is it mainly for public facing servers?
eldain@feddit.nl 1 week ago
Only public facing ports, maybe your openvpn login. But that means you are already firewalled up and your attack surface is tiny, good 👍
JubilantJaguar@lemmy.world 2 weeks ago
it depends how secure you want your network to be. Personally I think UFW is easy so you may as well set it up
IMO this attitude is problematic. It encourages people (especially newbies) to think they can’t trust anything, that software is by nature unreliable. I was one of those people once.
Personally, now I understand better how these things work, there’s no way I’m wasting my time putting up multiple firewalls. The router already has a firewall. Next.
Appoxo@lemmy.dbzer0.com 2 weeks ago
IMO this attitude is problematic. It encourages people (especially newbies) to think they can’t trust anything, that software is by nature unreliable. I was one of those people once.
IMO: Exactly the reverse. That’s how we get clients clicking and agreeing to everything presented without for once thinking critically.
In 6 working years (MSP) I had probably less than 10 occurrences of clients questioning a security concept from their own action.
If we didnt protect them from their own stupidity, the amount of cyber breaches would explode…Just recently:
A client: I clicked on the box that is asking me for domain credentials.The client didnt say what type of window it was or what happened before/after.
The client juat contacted us, because the pc wouldnt connect to the network and thus was unusable… >_>JubilantJaguar@lemmy.world 2 weeks ago
Possibly it’s about personality types. I was only going on my own experience. Of always being told by a chorus of experts “Oh no you don’t want to do that!” and ending up being terrified to touch anything. When I now know that I usually had nothing to be afraid of, because dangerous things tend to be locked down by design, exactly as they should be.
Appoxo@lemmy.dbzer0.com 2 weeks ago
Until they arent.
They are experts because they knew what clicking the wrong button might do.
E.g.: Database admins using the wrong script with a miscconfigured argument or a backup admin responding to a failover, tripple checking every setting to not create a problematic failover and then still clicking the wrong button causing an outage because some random behaviour caused an overload.It happens. And best case you were better (double or tripple) safe than sorry.
mr_jaaay@lemmy.ml 1 week ago
To follow up on this, I’d look to network segmentation as another useful security barrier. I’ve just started playing around with VLANs, but the way I plan on setting things up is to have individual VLANs for services, management and IoT, with the LAN for all other user-land devices. On top of this you add strict firewall rules to what can talk to what, on which ports, etc. So all devices on the network can do DNS queries to my two DNS servers, for instance, but things from my services VLAN can’t reach anything outside of this VLAN…
farcaller@fstab.sh 2 weeks ago
This is the best answer. Your router protects you from the outside, but a local firewall can protect you from someone prodding your lan from a hacked camera or some other IoT device. By having a firewall locally you just minimize the attack surface further.