I’ve been running my server without a firewall for quite some time now, I have a piped instance and snikket running on it. I’ve been meaning to get UFW on it but I’ve been too lazy to do so. Is it a necessary thing that I need to have or it’s a huge security vulnerability? I can only SSH my server from only my local network and must use a VPN if I wanna SSH in outside so I’d say my server’s pretty secure but not the furthest I could take it. Opinions please?

    • Elvith Ma'for@feddit.orgEnglish
      11·
      5 days ago

      Instead of thinking with layers, you should use think of Swiss cheese. Each slice of cheese has some holes - think of weaknesses in the defense (or intentional holes as you need a way to connect to the target legitimately). Putting several slices back to back (in random order and orientation) means that the way to penetrate all layers is not a simple straight way, but that you need to work around each layer.

      • null_dot@lemmy.dbzer0.comEnglish
        44·
        4 days ago

        I’ve heard this analogy before but I don’t really care for it myself.

        It creates a mental image but isn’t really analogous.

        In the case of a firewall on a server behind a NAT, ports forwarded through the NAT are holes through the first several slices.

        • Elvith Ma'for@feddit.orgEnglish
          31·
          4 days ago

          If done correctly, those may only be open from the internet, but not from the local network. While SSH may only be available from your local network - or maybe only by the fixed IP of your PC. Other services may only be reachable, when coming from the correct VLAN (assuming you did segment your home network). Maybe your server can only access the internet, but not to the home network, so that an attacker has a harder time spreading into your home network (note: that’s only really meaningful, if it’s not a software firewall on that same server…)