@armaclaren said in How to protect webservers / help make the ultimate setup:
and only port 80 and 443 were allowed in.
You are aware of the fact that all TCP and UDP request are blocked right at your door step, the WAN IP.
TCP traffic using destination 80 and 443 are passed.
Attacks, garbage and other noise will come in on 80 and 443.
You could parse or inspect '80' traffic on pfSense but .... who uses 80 (clear http requests) these days ? Close to nobody.
Traffic on port 443 could be inspected if you go the HAproxy way.
Still, a great deal of your security plans have to be realized on the web server itself. The firewall can be at best a filter.
@armaclaren said in How to protect webservers / help make the ultimate setup:
SSL certificates for HTTPS
With plain http you site will not be indexed by any search engine these days. https is a must. Server port 80 = http has become close to depreciated (but keep it up for now).
Free certs from Letenscrypt or other sources are all the same. You could stand out by using a green one (if that notion still exists today).
@armaclaren said in How to protect webservers / help make the ultimate setup:
configure that to monitor your network for malware
Your web server should be on a separated LAN segment, using a dedicated NIC on pfSense that is normally called a DMZ. On that network there isn't even a switch. Just the NIC of pfSense and on the other side your web server.
Monitoring malware on a RJ45 cable is ..... useless.
If something happens to your web server your other devices on other LANs won't risk anything.
Your web server should react on valid https page requests. That's it. It should not accept files (executables ?) and the like.
Common web servers like nginx and apache2 are all rock solid these days without the need of any special tools. The default set-up will do.
If you accept that visitors upload files, you have to deal with them, pretty old school these days. There are some very good examples available on the net about how to do so - and how not to do so.
Btw : web servers belong on web servers devices like a VPS or even a dedicate server that you rent from companies who do thus that.
For me, hosting a public server behind an ISP type IP is not possible.
I'm using a couple of them, for 20 years now. On these servers I do not use a firewall. I never found it useful to block ports that aren't opened = used = being served. And if some one comes in as root, the firewall is the first to fall anyway.
I do use a tool like fail2ban, that blocks IP's if these are emitting suspected requests or are abusing (so, I do use the firewall after all^^)
mail server : same story.
