Home / server / Questions / 403791
Accepted
Tom
Asked: 2012-07-01 14:59:29 +0800 CST

Is it necessary to have firewalls rules between trusted nodes communicating on their backend interfaces?

  • 772

I have 6 nodes that have internet access on eth1 and private access to one another on eth0. Currently I have firewall rules for eth0, for things like memcached and NFS. Is this necessary? It's a real headache as NFS for example communicates on loads of different ports, and I recently introduced glusterfs which needs more still. Is the headache of figuring out what backend ports to unblock worth the security enhancement?

I should mention that I will of course still have a firewall rule on eth0 to block servers owned by others in the same datacenter.

Thanks

nfs iptables

3 Answers

  1. Best Answer

    It's a pain, I agree. You can do without (as long as you still block everything else on eth0, which you already indicated).

    The only risk is: If 1 of your 6 servers get compromised it is easier for the "bad guy" to get onto the other 5.
    They are likely running the same OS with the same vulnerability as the first server so the attacker is probably also able to compromise them via eth1 in the first place.
    But if those 6 servers are different OS or have different services exposed on eth1, then the additional FW on eth0 might be able to prevent an attacker getting access on the other 5.

    Regardless which choice you make: I do hope you have different accounts/passwords setup for those machines. You probably have SSH enabled on eth0 anyway. If an attacker gets an account on 1 he can just ssh into the next box if they are the same. Sometimes userid/password authentication on top of key-based authentication is a good idea.

    • 1

  2. If every server is allowed to contact every other server on every open port, then the firewalls are not actually doing anything and you might as well use a blanket accept. If there is some internal traffic which is not allowed then it depends on the consequences of those restrictions being bypassed compared to the management effort.

    • 0

  3. Opening ports for NFS and glusterfs need not be a headache.

    Glusterfs uses many ports but it is a known and finite list so can be scripted. NFS can be configured to use specific ports (in /etc/sysconfig/nfs on RHEL and similar NFS servers) rather than random ones.

    • 0