101
Do I really need a firewall for my server? (sopuli.xyz)
submitted 1 year ago by to c/selfhosted@lemmy.world
59 comments fedilink hide all child comments
 

I've been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I've been meaning to get UFW on it but I've been too lazy to do so. Is it a necessary thing that I need to have or it's a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I'd say my server's pretty secure but not the furthest I could take it. Opinions please?

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 year ago (1 child)

In practice a stateful NAT is the same as a stateful Firewall. I've never heard of a NAT that isn't a Firewall. A port forward is the same as a Firewall allow rule.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago

    What you might call a stateful NAT is really a 1-1 NAT, anything going out picks up an IP and anything retuned to that IP is routed back to the single address behind the NAT. Most home users a many to one source nat so their internal devices pick up a routable IP and multiple connections to a given dest are tracked by a source port map to route return traffic to the appropriate internal host.

    Basically yes to what you said, but a port forward technically is a route map inbound to a mapped IP. You could have an ACL or firewall rule to control access to the NAT but in itself the forward isn't a true firewall allow.

    Same basic result but if you trace a packet into a router without a port forward it'll be dropped before egress rather than being truly blocked. I think where some of the contention lies is that routing between private nets you have something like:

    0.0.0.0/0 > 192.168.1.1 10.0.0.0/8 > 192.168.2.1

    The more specific route would send everything for 10.x to the .2 route and it would be relayed as the routing tables dictate from that device. So a NAT in that case isn't a filter.

    From a routable address to non-route 1918 address as most would have from outside in though you can't make that jump without a map (forward) into the local subnet.

    So maybe more appropriate to say a NAT 'can' act as a firewall, but only by virtue of losing the route rather than blocking it.

  • permalink
  • fedilink
  • source
  • parent