# Re: Firewall really necessary? **URL:** \ **Category:** NGINX\ **Created:** [April 13, 2008, 6:07am UTC](https://www.ruby-forum.com/t/re-firewall-really-necessary/134632 "2008-04-13T06:07:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [April 13, 2008, 6:07am UTC](https://www.ruby-forum.com/t/re-firewall-really-necessary/134632/1 "2008-04-13T06:07:17Z")
In my humble opinion… It is always best to have a firewall between you and the outside world. In some circumstances, two firewalls back to back is even better (make sure the two are from different manufacturers…) The folks at [http://www.metasploit.com/](http://www.metasploit.com/) work on tools which exploit open ports and even with so few ports available, your system could be used as a “zombie” tool by malicious people. So, put a firewall in, or install some kind of syslog filter/analyser which will at least notify you of weird things going on… Daniel ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [April 14, 2008, 3:32am UTC](https://www.ruby-forum.com/t/re-firewall-really-necessary/134632/2 "2008-04-14T03:32:03Z")
On 4/12/08, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > “zombie” tool by malicious people. > > So, put a firewall in, or install some kind of syslog filter/analyser which > will at least notify you of weird things going on… > > Daniel pf, for instance, also has the ability to ‘scrub’ packets (normalize them) before they are handed up to the rest of the stack. ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [April 14, 2008, 7:08am UTC](https://www.ruby-forum.com/t/re-firewall-really-necessary/134632/3 "2008-04-14T07:08:20Z")
On Sun, 2008-04-13 at 18:22 -0700, eliott wrote: > > ports and even with so few ports available, your system could be used as a > > “zombie” tool by malicious people. > > > > So, put a firewall in, or install some kind of syslog filter/analyser which > > will at least notify you of weird things going on… > > > > Daniel > > pf, for instance, also has the ability to ‘scrub’ packets (normalize > them) before they are handed up to the rest of the stack. pfsense is really amazing, if you can afford to put in a separate box. I’m not a huge BSD fan, but there’s nothing like it on Linux (or anywhere else for that matter) Regards, Cliff ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [April 14, 2008, 7:39am UTC](https://www.ruby-forum.com/t/re-firewall-really-necessary/134632/4 "2008-04-14T07:39:55Z")
On 4/13/08, Cliff W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > > > > them) before they are handed up to the rest of the stack. > > pfsense is really amazing, if you can afford to put in a separate box. > I’m not a huge BSD fan, but there’s nothing like it on Linux (or > anywhere else for that matter) The original thread post mentioned FreeBSD, and pf has been ported from OpenBSD to FreeBSD for a while now. For the record, I think pfsense is also _very_ cool, and utilizes pf ‘under the hood’.