say i have a standard iptables firewall setup on a router - DROP all incoming INPUT/FORWARD, allow in related/established connections, internal LAN interface & specific other ones if necessary. if i were to duplicate this setup on a standalone machine & connect it to the internet directly, is there any difference in the level security provided by iptables? e.g., a system with 1 ethernet connection with default DROP policies.

i was debating with someone about this, who said that it was always a bad idea to connect any machine directly to the internet, no matter how good the firewall. i was saying that, with iptables, you're using the same exact firewall whether it's on a Linux router or on a Linux machine standalone.

The difference between a router and an end point is that a router is a single purpose device: it just routes traffic. This means that you can use a router to, for example, protect end points by regulating (limiting, scrubbing, denying) traffic. In case of say a DoS attack this wouldn't burden the end point with spending CPU cycles on what traffic to accept or drop next to actually providing services but have an edge router bear the full brunt. That's a good thing performance-wise. Also having a router in front of end points allows removes the risk of an end points host-based firewall as a single point of failure. That said, given a similar Linux router and a Linux end point, the firewall itself on each device can be the same functionality and security-wise.

thanks. makes sense that a DoS occurring at a router would leave the endpoint machines unaffected CPU-wise, but i would think you would end up with the same effect; the host would lose internet access either way, whether it was because its router was being overloaded, or the host itself was being overloaded.