Does a router add security to front-end servers?

Question

I'm pursuing the reason behind why routers add security to a domain of a server architecture and front-end HTTP and HTTPS servers.

Architecture: Assume I get a static IP of 100.100.100.100 from an ISP and I set up the following in the server room:

 IP -> Server 1 (HTTP/HTTPS) <-LAN-> Switch(Server 2(Web App), Server 3(DB))

For serving all visitors, I close all ports not related to HTTP/HTTPS. So now, if I add a router between IP and server 1, which firewall rules will help me with respect to the security aspects of things? Does it just add another unnecessary level of complexity? Or am I mistaken and missing something huge here?

Answer 1

It's true that some people do what you suggest, but security should be layered. Under typical circumstances, you will probably have more ports open on your server since you will want to be able to connect to the server to maintain it.

An external firewall helps protect the rest of your network, too, and it can provide secure connectivity for other devices. A firewall can have many rules, and dedicate its computing resources to protect your whole network, rather than burdening your server's processing, freeing your server to perform it's main processing task. There are also next generation firewalls which can look deeper into the traffic to recognize application-layer protocols, traffic patterns, malware, attacks, etc., and it helps to have a dedicated box for that. Intrusion detection and prevention are hot topics today.

Think about this: the bad guys will always find a way in if they are determined enough. Putting in layers of security will make their job more difficult, and you can make it difficult enough that you discourage all but the most determined. You have to weigh the risks with the resources that you are willing to put into securing your network. If you don't have much to lose, then it may not make much sense to spend a lot of time and money protecting it, but we are seeing more companies get into financial and legal trouble from data breaches (customers and governments are suing and even leveling criminal charges for data breaches).

Answer 2

Adding something that can do a first layer of filtering is not without its advantages.

Whether you need a router or a dedicated firewall is another matter.

Either solution (router or firewall) may provide other functionality, not necessarily 'purely' security related, that still makes your service more resilient (a means of doing load-balancing, packet inspection, null-routing, etc). All this can be done in other ways, but it can be useful to have a box that makes this easier.

One thing I haven't seen mentioned so far is that Such a system isn't just for ingress filtering, but also egress: having a box dedicated to ensuring what leaves your network is at least vaguely legitimate is something you probably want to consider at some stage.

Currently, if Server1 is compromised, you may not be able to find out what left the network, or to where. Since Server1 exposes software to the world at large, that's definitely a consideration, I think. A router removes that issue to a point (until, of course, the router/firewall is compromised.... turtles all the way).

Edit: should really read all other comments more thoroughly before making rash statements.

Answer 3

There's multiple answers. None of which I personally consider critical, but they make sense in their entirety and especially when considering costs and benefits.

1. Prevent configuration errors: Router/Firewalls let you open the ports you really need to the internet. Maybe you need more access from inside of the network. You can block it at the router level, but leave the server itself "open".

2. Layered security: you can have a server in the DMZ which doesn't have access to the internal network. But on the same internet IP you want to have an access to your internal network. If the former is hacked, hackers posess access to this particular server, but not to other ones. This is assuming you have a second line of defense "behind" the initial router and server.

3. Last but not least, you can configure on your firewall what goes out of the net. If you know, this particular server should only ever send packets to internet server X, you can restrict that.

4. The router could send multiple IPs to multiple internal devices. Still your firewall rules stay on one physical machine.

In general you are right, there is not much additional benefit in the sense of security to adding a dedicated router/firewall between the internet and your primary server(s). There's still a small benefit in using a dedicated hardware appliance in contrast to a general-purpose computer. All Linux/Unix distributions can basically do the same on one machine. And we still have a service separation in that the firewall is in the kernel while the application is usually in userspace.

The question then becomes maintainability. Which IP addresses and TCP ports do you allow through to your network and where to (in case of multiple hosts).

Also a dedicated firewall/router/appliance may help you in capturing traffic that is coming into and out of your network as a central point of capture.

TL;DR

For small networks or single hosts it is perfectly sufficient to have a iptables/pfSense firewall on the host, for larger networks there are many different small benefits, that make the use of a central firewall/router useful.

Answer 4

No. Router ACL's can turn off / disable unnecessary types of traffic to the point of protocol and port number. The application / server is the more important element to focus on. Also remember that security also includes availability of a resource (see DDOS attacks).

If you have a secret to keep do not store it in any format, including ink on paper.

greater than 80% of all new malware and intrusion attempts are exploiting weaknesses in applications, as opposed to weaknesses in networking components and services.

See Next Generation Firewall