101
Do I really need a firewall for my server? (sopuli.xyz)
submitted 1 year ago by to c/selfhosted@lemmy.world
59 comments fedilink hide all child comments
 

I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 year ago (2 children)

Assuming it's not a 1-1 NAT it does make for a functional unidirectional firewall.

That's like saying a router and firewall are the same thing. NAT appears to be a "firewall" because it's usually deployed with one. NAT itself has no filtering functions the way you're describing.

Now, a pure router in the sense of simply offering a gateway to another subnet

A "pure" router, as you put it, understands upstream subnets and routing tables. NAT does not, and is usually overlayed on top of an existing routing function.

You can set up NAT between two subnets as an experiment with no iptables and it will do its job.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 1 year ago (1 child)

    In practice a stateful NAT is the same as a stateful Firewall. I've never heard of a NAT that isn't a Firewall. A port forward is the same as a Firewall allow rule.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago

    What you might call a stateful NAT is really a 1-1 NAT, anything going out picks up an IP and anything retuned to that IP is routed back to the single address behind the NAT. Most home users a many to one source nat so their internal devices pick up a routable IP and multiple connections to a given dest are tracked by a source port map to route return traffic to the appropriate internal host.

    Basically yes to what you said, but a port forward technically is a route map inbound to a mapped IP. You could have an ACL or firewall rule to control access to the NAT but in itself the forward isn't a true firewall allow.

    Same basic result but if you trace a packet into a router without a port forward it'll be dropped before egress rather than being truly blocked. I think where some of the contention lies is that routing between private nets you have something like:

    0.0.0.0/0 > 192.168.1.1 10.0.0.0/8 > 192.168.2.1

    The more specific route would send everything for 10.x to the .2 route and it would be relayed as the routing tables dictate from that device. So a NAT in that case isn't a filter.

    From a routable address to non-route 1918 address as most would have from outside in though you can't make that jump without a map (forward) into the local subnet.

    So maybe more appropriate to say a NAT 'can' act as a firewall, but only by virtue of losing the route rather than blocking it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -1 points 1 year ago

    NAT in the sense used when people talk about at home is a source nat, or as we like to call it in the office space a hide address, everyone going to the adjacent net appears to be the same source IP and the system maintains a table of connections to correlate return traffic to.

    The other direction though, if you where on that upstream net and tried to target traffic towards the SNAT address above the router has no idea where to send it to unless there's a map to designate where incoming connections need to be sent on the other side of the NAT so it ends up being dropped. I suppose in theory it could try and send it to everyone in the local side net, but if you get multiple responses everything is going to get hosed up.

    So from the perspective of session state initiation it can act as a firewall since without route maps it only will work from one side.

  • permalink
  • fedilink
  • source
  • parent