Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do I need a hardware firewall for my first dedicated server?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 11 posts

Ask HN: Do I need a hardware firewall for my first dedicated server?

#1

Post by potatofish »

I'm getting ready to deploy the first phase of my app on a dedicated machine. Phase I is not public, meaning it has no web site, other than the one I use to administrate the app, and it takes no connections other than SSH. I will be running the latest Ubuntu Server, and using UFW for the firewall.

Question is, should I spend the $50 that Softlayer asks for a 10Mbps hardware firewall? Is Ubuntu's firewall enough?

Re: Ask HN: Do I need a hardware firewall for my first dedicated server?

#4

Post by gojomo »

The software firewall is plenty. Make sure services on the ports that are open are as locked-down as possible: no brute-forceable passwords for SSH; conservative web server configuration and vigilant security updates of all software used.

Then spend the money saved on the hardware firewall on more frequent and offsite backups of crucial data.

Re: Ask HN: Do I need a hardware firewall for my first dedicated server?

#5

Post by potatofish »

yourabi wrote: post #3

A software firewall should be sufficient at first. It makes sense putting off any additional spending until the app is validated and you start to scale

So that means that the OS firewall is safe enough that I shouldn't worry about it being compromised? I suppose the HW firewall could also be compromised, but it does give a bit of extra piece of mind.

Re: Ask HN: Do I need a hardware firewall for my first dedicated server?

#7

Post by yourabi »

potatofish wrote: post #5
yourabi wrote: post #3

A software firewall should be sufficient at first. It makes sense putting off any additional spending until the app is validated and you start to scale

So that means that the OS firewall is safe enough that I shouldn't worry about it being compromised? I suppose the HW firewall could also be compromised, but it does give a bit of extra piece of mind.

In isolation yes - it is unlikely the vector of attack would (ever) be the firewall itself. In fact I think system level attacks are less likely than application level attacks (SQL injection, XSS..etc)

I think you really get some performance features (like SSL offloading...etc)

Re: Ask HN: Do I need a hardware firewall for my first dedicated server?

#9

Post by staunch »

bl4k wrote: post #6

Software firewall is fine for a single machine - plus the hardware firewall you were quoted would restrict your throughput to only 10Mbps - which is not a lot and would be maxed out with 4-5 concurrent users

In a typical web app scenario 10 Mbit is far more than sufficient to handle hundreds or thousands of active users. Only if you're serving up large static files (or similar) would 10 Mbit become a bottleneck, and even in that case with throttling you could give ~25 concurrent users sufficient speed to stream a video, etc.
Post reply on HN