Is this secure?

[Ungenious]

Today I'm using a NetGear router/firewall to secure my LAN. On the inside I have a number of clients and a fileserver which I access via SSH.

I am planning to reduce the pile of equipment and save some energy at the same time. To achive this I am thinking about having one single machine hosting both firewall and fileserver.

Using OpenBSD with PF and two network adapters this is of course techically possible, but is the solution equally secure as my current setup? I do not doubt that OpenBSD/PF is able to do a job even better than NetGear (if I set it up correctly) but what about having SSH-access from Internet directly into my firewall?

[ivanatora]

Two machines = two different systems to break in for a potential attacker. Even if your gateway becomes compromised, your file server will survive.
One machine = two different users to break in. For some people it is equal to the previous scenario, but IMHO breaking in a local user using some sort of local exploit is a hundred times easier than to attack a new system.
So using one machine is not secure as using two machines. But it is cheaper and simplier. So it is up to you to decide if you need so high-level of security. For a home/neighbourhood network I'd prefer one machine in order to reduce cost.

[BSDfan666]

Originally Posted by Ungenious

Using OpenBSD with PF and two network adapters this is of course techically possible, but is the solution equally secure as my current setup? I do not doubt that OpenBSD/PF is able to do a job even better than NetGear (if I set it up correctly) but what about having SSH-access from Internet directly into my firewall?

What about it? unless you have someone who needs to connect to your SSH server.. listen on your NAT address only.

[Ungenious]

Thanks both of you!

BSDfan666: I need to access my fileserver from outside home, consequently the firewall would end up with a door to the outside world.

[BSDfan666]

Originally Posted by Ungenious

Thanks both of you!

BSDfan666: I need to access my fileserver from outside home, consequently the firewall would end up with a door to the outside world.

Well.. if the remote location is static.. you could add a permanent rule to allow access from there.

If not, then.. disable password authentication and then use a public key approach.

Note; security through obscurity is always frowned upon.. but you could use an alternate port.. weed out some automated bots.