I have a router whose settings are not working. It has a built-in firewall that blocks the websites that I host on my local network, which I try to provide access for them on the internet via port forwarding. To make my website work, I have to disable the entire firewall of the router! Not even its DMZ settings work!
So, if I disable the router firewall completely and I setup my entire website application inside VirtualBox VMs, with all their traffic going through an Endian Firewall (https://www.endian.com/community/features/), will my host OS (that runs VirtualBox and the Endian Firewall VM) be vulnerable to remote network attacks? If yes (that I assume is the case), is there anything I can do to fix that (preferably without buying new hardware)?
This router is something I need to have in my network, because it provides VOIP services, so replacing it with a new one is probably not so doable. I guess that MAYBE, I could get a new router and plug my old VOIP router on the new one, hoping that the new router's firewall works correctly and that my VOIP continues to function in that new configuration (behind the new router). Then perhaps I won't be needing a firewall VM after all. I would just hook my website directly on the new router and trust its firewall. But I have no idea if that would work.
So, the questions are:
- Using the old router without firewall, is my host OS at risk (even if the host OS has its own software firewall)?
- If yes, is there anything I can do to fix/improve the situation?
- Is piping the old router after a new and better one (with a functioning and configurable firewall) gonna keep my VOIP router functional? Do I have to unblock any ports for this, to allow inbound traffic from the internet reach my inner router?
- If the above option is feasible, I guess it would be better to have an extra layer of protection with an Endian Firewall and not trust the router protection entirely, correct?
- Is using a bare-metal Hypervisor (like VMware ESXi) gonna be more secure than using a host OS that hosts VirtualBox?
- Does the answer to the previous question change based on weather I use a firewall (e.g. router firewall) before the server that hosts my VMs?
I am reposting my question here, after I was kicked on the butt at the Server Fault site: https://serverfault.com/questions/975172/trying-to-setup-a-somewhat-secure-server-network-with-buggy-and-cheap-hardware
I am quite flexible about the host OS. Right now it is a Windows machine running tons of software, but I could easily change that to something more secure (e.g. a Windows machine with only VirtualBox installed or a Linux machine with only VirtualBox installed).
My router does provide DHCP and DNS (although its DNS always felt a bit buggy), just I have most computers on a static IP in my local network.
My Endian Firewall VM is connected in bridged mode and all other VMs connect through that firewall, to the router and to the internet.
I have setup port forwarding for my site, but from my experience, enabling the DMZ for the host PC makes no difference. Only a complete disable of the firewall makes it work. Right now, I have a physical PC (not a VM) acting as a host for my app, just for testing purposes and to exclude other reasons for my site not working. But it still does not work without disabling the rooter firewall.
My router is an
ADB P.RG A4201G. The management UI seems buggy, so I think it is not a quality product. On top of that, my ISP seems to have "put their stamp" on it, since they have placed their logo on the management UI and I get no option to upgrade the firmware myself.
According to my ISP, there is no firmware update for my router, but I can't say I trust them much on this. I can't even see the current firmware version in order to verify this.