A hardware firewall is a relatively simple piece of hardware, they are placed between the out side world (Usually the internet) and the section of the network you are needing to protect. They are specially built to block unwanted protocols and network activity from entering and/or leaving the protected network segment behind the firewall.

Firewalls use a configuration file that contains a set of rules, better known as an ACL (Access List). The ACL is much like any configuration file in the sense it contains all the information needed in order for your firewall to know what information to block and which to forward on to your back-end secure network.

One of the most important things to remember when you begin working with your first firewall is: ACL’s are read from the top down, so when you are configuring your firewall, always remember that a rule farther down in the list will NOT override an above rule. So if you block all access in line #1 and then allow access in line #2, line #2 will not allow access as in line #1 you already blocked it.

In many cases you will setup the firewall to block all incoming requests from the outside world beyond those you may want to have access. For instance, if you are running a web server you may want to block all access to the server (SSH especially) except for port 80 (http) and 443 (SSL). This way anyone trying to “hack” into your web server will have extremely little access to work with in order to breach your web server.

Now you may be wondering, “If I block all other ports, how am I going to access my server and/or network behind the firewall?” – This something that can be accomplished in a few different ways:

1) VPN – Virtual Private Network allows you to connect to your firewall via a special piece of software that adds your workstation to the network behind the firewall. You do not need to be on the actual network for this to work, only access to your firewall via the internet. So you can VPN in from your home PC over your internet connection.

Once you are logged into the VPN, your workstation or home PC will be virtually connected to your private network behind your firewall, therefore you will not have any ports or data being blocked or otherwise filtered by your hardware firewall.

2) Access List – Using the brief explanation above on what an ACL is, you may have already determined what you may need to do, however for those who may still be scratching your head, we will give some more details. So an ACL is a list of rules that firewall uses as its configuration file so it knows what to block and what not to. With that concept, you are able to configure your firewall to not block your connection to the network. So you can still block everything else from the outside world, while preserving your own access.

Now that we have a basic idea of what a hardware firewall is and what it does, we are going to take a look at who needs them and what additional security they provide over a software firewall.

Is a hardware firewall for me, in short everyone should have one, however they are not exactly a cheap thing to purchase. A good hardware firewall can range from a few hundred dollars to 10 of thousands, depending on how much throughput you will need to filter and the amount of connections you will need.

That in itself unfortunately filters out many of us, as the data we may need to protect just does not warrant the cost of the purchase. If you find yourself not able afford one, do yourself a favor and at the very least be running a software firewall on your machines.

If you do decide a firewall is worth the premium, you will have many new advantages open to you:

1) You will not be running a network appliance specifically built to protect your network from unwanted access.
2) You will now be able to access your back-end network via a VPN, allowing your to securely pass data back and forth between the network and your remote locations.
3) Access will now be filtered based on the rules you define, if you don’t want someone or something to have access, you can block it.
4) This point is one of the most advantages, you can have many many machines behind one physical firewall, so you can control how each machine communicates to the outside world.
5) Single point to control access.

While hardware firewalls are not the end all solution to network security, when used properly they the first major milestone in building up your network security and being able to rest easier at night.

If you are choosing to run a firewall for your network, you will first want to sit down with your hosting provider and go over your needs. As you will want to be sure you are getting a firewall that can meet your needs and have a skilled network team to set it up for you, as setting up a firewall is not the easiest thing.

Until next time, post your comments and ask question in our forums and we will be here to answer them.

————————————————————-

Lets go into detail of what each is:

Colocation:

Colocation is where you purchase a server (Dell, HP, IBM, SuperMicro, Home Build, etc.) and ship it to a data center of your choice. The data center in turn places your server in a rack and attaches it to their network. Once the datacenter has your server all setup, you will then be able to remotely access your server.

This option you will also need to own your own operating system license and be very familiar with computer hardware.

Dedicated Server:

A dedicated server is very similar to colocation, however instead of having to purchase a server and ship it to a data center, you merely rent the server from the data center. This option you will not need to have your own OS license or intimate knowledge of server hardware. You will have the same remote access to the server box as with your colocated server.

————————————————————-

Now that we have the basic idea of what the two are, we can begin to dive into the positives and negatives of each.

Colocation, The Good & Bad:

Positive Notes:

• Cheaper monthly cost, as you only need to rent space, power and bandwidth.
• You own your server hardware, you don’t have to rent it.
• You can have any server brand and hardware specification you desire.
• When done hosting, you can have the server shipped back to be resold.

Negative Notes:

• If your server has hardware issues, you will need to pay someone to troubleshoot (remote hands fees).
• You will need to ship replacement hardware to the DC or buy it from the DC.
• You are responsible for your server, the DC is only responsible for the network, power and space.
• Large upfront cost, as you have to buy the server box.
• You will have to own your OS license.

Dedicated Servers, Positives & Negatives

Positive Notes:

• You do not have any large upfront fee to buy a server, you only have to rent it.
• If the server has any hardware issues, it is up to the data center to fix it.
• You wont have to pay for replacement hardware, ship anything, etc. as it is up to the DC to repair any hardware issues.
• Widely available and hundreds of providers to choose from.
• You don’t have to own OS licenses.

Negative Notes:

• You are limited on the server hardware you can use (Each provider only offers so many options).
• Your monthly price will be higher, as you are renting the server, power, space and bandwidth.
• Upgrades can be more expensive than the going rate of hardware.
• May get locked into a lease period.

The above gives us a good idea on the good and bad of each, now onto the hard question, “Which one is right for me?”

Everyone’s answer is going to be different as it will greatly depend on your finances, hardware knowledge, and how much control you want to have over your server. Many people choose to go with a dedicated server everyday as you can easily purchase and it is on the provider to do all the hard work, however this is not the best option for everyone.

With dedicated servers, the “bigger” the server you buy, the more expensive your monthly payment will become. In many cases, it can be cheaper to purchase the server and colocate, however it will all depend how long you plan on keeping the server machine.

That brings on a all new question:

What is the life expectancy of a server? – Check our other blog posts for a in depth look!

That pretty much wraps up this look into the differences of Colocation and Dedicated servers, however I am sure many questions are still lingering. So post them up in the forums and we will get you answers!

Join the forum discussion on this post - (1) Posts

Today we are going to take a peek at what kind of Anti-Virus scanners we should be running on a dedicated server.

It will all depend on what you are using your dedicated server for, but in almost any case it would be foolish to not run a Anti-Virus software on it. As there are tons of Anti-Virus software options on the market it can be very hard to choose the version right for your needs.

It is suggested you stay away from the all in one security suites like you may be running on your home PC as they are very infectious and will most likely cause allot of issues in the long run, including locking you out of your server when you install it .

You will want to stick to a straight Anti-Virus, such as Norton Corporate or ClamAV.

Norton Corporate is a great solution if you are able to spend some money on it, it can be quite expensive if you have more than one server, however you will be receiveing a paid software which comes with support that you may need if you every run into issues. Norton also releases many updates to it AV software which will greatly help in keeping your server safe.

The downside, Norton is pretty much only good for Windows, if you are running a Linux server you will want look to ClamAV.

ClamAV (http://www.clamav.net) is a free Anti-Virus system that is specifically aimed to be used in a server environment and is perfect for your Linux based server. There is a Windows version of ClamAV, however they are no longer developing it, however you are still able to receive virus definition updates for it.

ClamAV is the perfect solution for any server host as it is very “light” and non-intrusive on the dedicated server.

There are tons of AV softwares on the market and using Google you will be able to easily locate one that is perfect for your needs. For this article we are giving Norton and ClamAV our choice award as they have long been the industry standard for anti-virus security.

Moving a little more forward as far as Anti-Spyware and additional software you would find in a security suite. In most cases you should have no need for them as you should not be opening emails and surfing the web on your dedicated server. Keep it smart and use your dedicated server for what it is designed for, hosting.

Cheers!

Join the forum discussion on this post - (1) Posts

It is very easy to do, you need only to SSH into your server and locate the following file: exim.conf

You should be able to locate the Exim configuration file within your “etc” folder: /etc/exim.conf

Once you have found the exim.conf you will need to open it with a text editor nano or pico will work fine.

pico /etc/exim.conf

Once you have it open you will want to locate the following: (If you are using nano, “ctrl + w” will allow you to search for it)

remote_smtp:
driver = smtp

You will need to add another line just below the “driver = smtp”, adding: interface = xxx.xxx.xxx : xxx.xxx.xxx.xxx

Once added, you should have this:

remote_smtp:
driver = smtp
interface = xxx.xxx.xxx

Make sure you replace the XXX with an IP on your server you would like to use. If you wish to use more than one IP you can separate them with a colon “:” like so:

remote_smtp:
driver = smtp
interface = xxx.xxx.xxx : xxx.xxx.xxx.xxx

Once you have edited the lines to match the above, you will need to save (ctrl + x) and then restart Exim.

service exim restart

Once Exim restarts you should now be sending emails out on the new IP address instead of the primary one on your server.

IMPORTANT NOTE:

If you are a CPanel user, you will need to need to make a slightly different edit than the above. In your conf file you will have lines like this:

remote_smtp:
driver = smtp
interface = ${if exists {/etc/mailips}{${lookup{$sender_address_domain}lsearch*{/etc/mailips}{$value}{}}}{}}

You will need only to remove the “interface = ${if exists {/etc/mailips}{${lookup{$sender_address_domain}lsearch*{/etc/mailips}{$value}{}}}{}}” and replace it to make it match:

remote_smtp:
driver = smtp
interface = xxx.xxx.xxx

The other thing you will need to be careful of, if CPanel makes an update to Exim it will change your settings. So you will need to re-edit the conf files every now and then to keep it running on the IP of your choice. At this time I am not aware of anyway around this, though there is allot of talk on the CPanel Forums.

Join the forum discussion on this post - (1) Posts

Looking at these terms it is pretty easily to draw a conclusion as to what they are, but for those who would like a little more information on what each is, please see below:

Managed:

A managed solution in short is a service in which the host takes care of and maintains the server for you, therefore allowing professionals to take care of the dirty work and keep your time free to keep working on your web site. A managed server is usually the best place to start for anyone new to a server side of things, however there are some downsides:

1. Managed servers are usually much more expensive than a normal server (You are paying for the techs time).
2. You may not have access to the root of the server and therefore you will have to rely solely on the host for everything beyond the basics of managing your web site.
3. You have to rely on your host for just about everything, beyond the basics.
4. You may be limited to what all you can do with your server, you may nto have full control.

With the above brief of downsides you can see if any of them worry you, but don’t get discouraged, there are upsides!

1. You don’t have to worry about knowing how to manage everything on the server, thats what you pay your host for.
2. If you run into issues, you can just lodge a complaint with your host and it is up to them to devise a solution.
3. You don’t have to get your hands dirty and waste time doing updates, installing additional software modules etc.
4. You can sleep at night! - This may sound weird, but when you run into your first major issue, it all makes sense.
5. The host takes care of the security of the server.
6. Many hosts include back up solutions are part of their managed services.

The above are just the basic outlines of a managed service, you will ALWAYS need to check with the host you plan to use to see what all they are responsible for managing, some do allot more than others!

Now onto the Unmanaged!

Unmanaged:

In short, unmanaged sounds very much like it is, the exact opposite of managed.

With an unmanaged servers you are on your own, sent a drift in the wild ocean with only a small life rope to tie you back to shore. You will be responsible for everything from the Operating System up. In the case of a unmanaged solution the host is only responsible for the server hardware and network, so they are there to fix the hardware if it breaks, do Operating System reloads, keep the network up and running, and some basic troubleshooting.

As long as you have access to the machine, it is all in your hands. This is the way most people tend to go with as it gives you the most versitility and allows you to learn and test allot on the server machine that you otherwise would most likely not be able to do on a managed server.

The ups and downs:

Ups:

1. The server is all yours, you install and control everything on it.
2. Extremely versitile, you can install what you want and when you want, no need to wait on anyone.
3. Cheaper! You don’t have to pay extra for the company to manage the server.

Downs:

1. If you get stuck or break some software on the server, it will be up to fix it.
2. You are responsible for everything from the Operating System up.
3. You have to run the updates, keep the server secure.
4. You will need to learn how to operate and control the server.

Don’t let the downsides scare you, a unmanaged server is a awesome place to begin as you will be able to work and learn without having to worry about limitations. If you are worried about the uptime of your web site over you learning, it is best to stay with a managed solution where uptime is the goal and learning takes the back seat.

The discriptions above are showing the extremes of each end of the environments, it will depend on each host as far as what all they will or won’t manage. Many hosts often go far beyond what the norm, but you will need to speak with each one to find what all they are responsible for and how far out of their way they will go to keep you running strong.

The biggest thing thing to understand from these descritptions is:

Every host is different! No two host will offer the same thing in their managed and unmanaged packages. You NEED to check with the host you are considering using to see what all they are responsible for. The above are just the basic outline of each and by no means what every host offers!

Join the forum discussion on this post - (1) Posts