How to Find the Best Firewall Option for Business

How do you protect yourself and your business online? This is an integral question that you need to set before, during and after your deployment goes online.

In looking at options for Linux, CSF (ConfigServer Firewall) is our preferred option as it provides proven security and a more friendly interface through cPanel which for a lot of web hosting users is an ideal mix.  CSF at its core is an SPI iptables firewall, otherwise known as a Stateful Firewall, and is a highly scalable solution that is comprehensive, straight-forward and very flexible to configure.   Here is a link to the feature set of the firewall, and most good web hosting companies will offer this at no cost.

Some Pitfalls
When looking at software firewalls like CSF, there are some potential pitfalls that can occur when using a software based-firewall. For starters, the firewall is on the server itself and if you are carrying a lot of traffic, your server may not be able to handle the amount of traffic that your business is experiencing.   Its direct affect in the case of web hosting, is that your server’s ability to handle the incoming traffic is taken away because it has to spend time processing traffic coming into the server through the firewall before it can handle the actual connections.

A second potential drawback that can occur is that if your operating system firewall is not configured correctly, it is possible for your server to become completely inaccessible and in some cases even more vulnerable to attacks than it was before.   In looking at the scenario, a malicious user could gain access to a web site hosted on your server and ultimately gain access to an administrator’s account and modify your firewall to give them access.

One of the most significant benefits is that a hardware firewall takes the load off of the server.  This includes activities like processing firewall rules, controlling traffic (including the ability to have a predetermined amount of concurrent connections), application layer protection and deep logging features.  Though similar in functionality to software firewalls, the dedicated hardware option tends to be much more robust in its ability to block certain types of traffic.  In addition, for web hosting customers who have multiple servers, hardware firewalls are better able to handle the traffic for multiple servers and can differentiate between what traffic is allowed to one server but not to another.

Cisco ASA Firewalls
Let’s look deeper into a very popular line of hardware firewalls – Cisco ASA firewalls.  In the case of the Cisco ASA firewalls, they can provide a 1-to-1 NAT-based firewall solution, where machines behind the firewall maintain internal IP addresses, and can be accessed through a public IP address.  Here is a sample diagram of a NAT setup as demonstrated on Wikipedia:

This provides further security to your network by concealing your internal network, thereby making it harder for a malicious user to look at your network.

Another great feature is that Cisco ASA firewalls can provide transparent firewall functionality.  Cisco defines a transparent firewall as a “Stealth Firewall” that allows the firewall to connect to the same network on its inside and outside ports.  Though hidden, a transparent firewall still interprets the data and will restrict traffic unless explicitly permitted in the access list.  This type of configuration is a great option for users who already have a pre-existing network because the end users do not need to re-address IP. This simplifies the configuration as there is no translating involved. The public server IP address is the one being configured.

Many firewall appliances, including the Cisco ASA series and Juniper SSG series, provides advanced features and allows for further functionality as a VPN access point. In turn, it can provide access to an end-users internal network in a secure and reliable fashion, again taking more load off of the servers.

What is the best firewall option?

The best option depends entirely on the individual requirements for your web hosting solution.  If you don’t have much experience in securing a server for use on the Internet or you are the administrator of a low-traffic website, we would typically recommend a software-based firewall.  But if you have multiple machines or you are an experienced system administrator with higher security requirements for your servers/network, we would recommend a hardware firewall solution.  Of course, there is always a third option.

In the end, all of these options possess user friendly interfaces and provide security. You have to assess your own comfort level when making your choice, but overall, our aforementioned options are great solutions to help you keep your data secure. For more comprehensive security, you can implement both solutions and have something to fall back on, in the event that a personal computer gets compromised and a malicious user tries to infect your servers behind your firewall!

Ultimately, no matter why type you go with - some security is better than no security.