|
The short answer is no. I personally believe that host, or in this case
server-based software, firewalls are good as a backup but not
as a primary line of defense. You are much better off having a firewall
separate from your server. The reason for this is that if your firewall
is part of the server it is protecting, attacks are reaching the machine.
If it is a separate firewall, you have the chance to stop the attack before
it ever gets to the server.
If you are still going to look for a software-based firewall, I would
look into the NetFilter project (http://www.netfilter.org). Another
good piece of software is the Okena StormSystem series
(http://www.okena.com). While not a firewall per se, it is an intrusion-prevention system.
You might also want to investigate some of the DSL/cable router/firewall
boxes from Linksys, D-Link or NetGear. They may have sufficient capability
to allow access on ports 80 and 443 only (if you provide only Web services).
That alone is not good enough though. You need to ensure that you still have the
latest patches for your server software. You need to ensure that none
of your CGI scripts can be exploited and much more. Firewalls are just the
start.
For more information on this topic, visit these other SearchSecurity.com resources:
David Strom's Security Tool Shed: Industrial-strength firewall/router/hub for small networks
Best Web Links: Firewalls
Featured Topic: Firewall management
|
