A hardware firewall is a relatively simple piece of hardware, they are placed between the out side world (Usually the internet) and the section of the network you are needing to protect. They are specially built to block unwanted protocols and network activity from entering and/or leaving the protected network segment behind the firewall.

Firewalls use a configuration file that contains a set of rules, better known as an ACL (Access List). The ACL is much like any configuration file in the sense it contains all the information needed in order for your firewall to know what information to block and which to forward on to your back-end secure network.

One of the most important things to remember when you begin working with your first firewall is: ACL’s are read from the top down, so when you are configuring your firewall, always remember that a rule farther down in the list will NOT override an above rule. So if you block all access in line #1 and then allow access in line #2, line #2 will not allow access as in line #1 you already blocked it.

In many cases you will setup the firewall to block all incoming requests from the outside world beyond those you may want to have access. For instance, if you are running a web server you may want to block all access to the server (SSH especially) except for port 80 (http) and 443 (SSL). This way anyone trying to “hack” into your web server will have extremely little access to work with in order to breach your web server.

Now you may be wondering, “If I block all other ports, how am I going to access my server and/or network behind the firewall?” – This something that can be accomplished in a few different ways:

1) VPN – Virtual Private Network allows you to connect to your firewall via a special piece of software that adds your workstation to the network behind the firewall. You do not need to be on the actual network for this to work, only access to your firewall via the internet. So you can VPN in from your home PC over your internet connection.

Once you are logged into the VPN, your workstation or home PC will be virtually connected to your private network behind your firewall, therefore you will not have any ports or data being blocked or otherwise filtered by your hardware firewall.

2) Access List – Using the brief explanation above on what an ACL is, you may have already determined what you may need to do, however for those who may still be scratching your head, we will give some more details. So an ACL is a list of rules that firewall uses as its configuration file so it knows what to block and what not to. With that concept, you are able to configure your firewall to not block your connection to the network. So you can still block everything else from the outside world, while preserving your own access.

Now that we have a basic idea of what a hardware firewall is and what it does, we are going to take a look at who needs them and what additional security they provide over a software firewall.

Is a hardware firewall for me, in short everyone should have one, however they are not exactly a cheap thing to purchase. A good hardware firewall can range from a few hundred dollars to 10 of thousands, depending on how much throughput you will need to filter and the amount of connections you will need.

That in itself unfortunately filters out many of us, as the data we may need to protect just does not warrant the cost of the purchase. If you find yourself not able afford one, do yourself a favor and at the very least be running a software firewall on your machines.

If you do decide a firewall is worth the premium, you will have many new advantages open to you:

1) You will not be running a network appliance specifically built to protect your network from unwanted access.
2) You will now be able to access your back-end network via a VPN, allowing your to securely pass data back and forth between the network and your remote locations.
3) Access will now be filtered based on the rules you define, if you don’t want someone or something to have access, you can block it.
4) This point is one of the most advantages, you can have many many machines behind one physical firewall, so you can control how each machine communicates to the outside world.
5) Single point to control access.

While hardware firewalls are not the end all solution to network security, when used properly they the first major milestone in building up your network security and being able to rest easier at night.

If you are choosing to run a firewall for your network, you will first want to sit down with your hosting provider and go over your needs. As you will want to be sure you are getting a firewall that can meet your needs and have a skilled network team to set it up for you, as setting up a firewall is not the easiest thing.

Until next time, post your comments and ask question in our forums and we will be here to answer them.

Today we are going to take a peek at what kind of Anti-Virus scanners we should be running on a dedicated server.

It will all depend on what you are using your dedicated server for, but in almost any case it would be foolish to not run a Anti-Virus software on it. As there are tons of Anti-Virus software options on the market it can be very hard to choose the version right for your needs.

It is suggested you stay away from the all in one security suites like you may be running on your home PC as they are very infectious and will most likely cause allot of issues in the long run, including locking you out of your server when you install it .

You will want to stick to a straight Anti-Virus, such as Norton Corporate or ClamAV.

Norton Corporate is a great solution if you are able to spend some money on it, it can be quite expensive if you have more than one server, however you will be receiveing a paid software which comes with support that you may need if you every run into issues. Norton also releases many updates to it AV software which will greatly help in keeping your server safe.

The downside, Norton is pretty much only good for Windows, if you are running a Linux server you will want look to ClamAV.

ClamAV (http://www.clamav.net) is a free Anti-Virus system that is specifically aimed to be used in a server environment and is perfect for your Linux based server. There is a Windows version of ClamAV, however they are no longer developing it, however you are still able to receive virus definition updates for it.

ClamAV is the perfect solution for any server host as it is very “light” and non-intrusive on the dedicated server.

There are tons of AV softwares on the market and using Google you will be able to easily locate one that is perfect for your needs. For this article we are giving Norton and ClamAV our choice award as they have long been the industry standard for anti-virus security.

Moving a little more forward as far as Anti-Spyware and additional software you would find in a security suite. In most cases you should have no need for them as you should not be opening emails and surfing the web on your dedicated server. Keep it smart and use your dedicated server for what it is designed for, hosting.

Cheers!

Join the forum discussion on this post - (1) Posts

Ever needed to boot to a USB Flash/Thumb drive and the Bios just dosen’t support?

Well, now it no longer matters. You can now boot to USB, even on the oldest servers and worksations using a boot loader that fits on a CD, Floppy, Hard Disk and more!

I am speaking of “Plop”, a free available bootloader allowing you to boot to interfaces that are unsupported by the bios!

Link: http://www.plop.at/en/bootmanagerdl.html

I came across this wonderful when looking for a way to load OS’s onto older servers that do not support booting to a USB drive and they don’t have a internal dvd-rom. I used the ISO and burned the bootable CD-Rom and it worked perfectly.