Do I need a firewall

[JediSthlm]

Howdy all

I have a question. I run a few services just for fun at my home server. The services are httpd, ftp, ssh, mysql, and mail. The box I´m running is behind a router so I open the ports for the services on the router. My question is, do I need to run a firewall on the box also? Or is it quite alright with the router blocking all ports except the ones that I have opened?

Thanx,

JediSthlm

[Hayl]

if the router is blocking everything then no you don't need a firewall on that box.

[JediSthlm]

Thanx for fast answer, I do block all ports except the one I use for the services, for example httpd I have port 80 open. Right?

[chrism01]

Well, it may seem a bit overkill, but most serious security guys will tell you that defence in depth is best. You never know when someone's going to find a vulnerability in your router. Its been known to happen eg even CISCO boxes have been hacked.
If you're talking to the internet, I'd recommend a firewall on the server.
Just my opinion of course ;)

[Zoist]

Won't do any harm.

[Seminole]

It's safer and something else to spend time learning :) Try it, you may just like it. Your NAT router wouldn't block outbound attempts from your computer to the network though. If you somehow got infected with a trojan that wanted to call home, you wouldn't have a clue it was happening and your router will pass it along as valid info.

That's why firewalls are not overkill even if you have a NAT router.

The odds are that you are safe, but you never know... I have some sniffer software running and snort rules to report any suspicious activity to me.
Seems to be working fine although I do have to modify my rules a bit for my games. Seems that Q3 and UT2003 are getting recognized and reported as a bad thing. :)

[JediSthlm]

Thanx for your answers, learing is a good thing, I´ll probably add a firewall as soon as possible.

JediSthlm

[beley]

I'd probably setup a firewall on the box also... just for extra protection. Never hurts... you have door locks but you might also get a home security system - too much security is never a bad thing :D

[Darknight]

Can someone add some suggestions for Firewall software?
What you use and how you like it?
(Possibly some problems/solutions for configurations)

[beley]

iptables or ipchains

[chrism01]

As beley said/implied, do it by hand. Its the only way to be sure. Iptables is superceding ipchains, so use that in preference, although ipchains does the job.
See the HOWTOs at www.tldp.org (the Linux Doc Proj). that's where i learned. :)