Firewall recommendation

Mikey · 4 Nov 2010 at 10:10

Looking at getting a small Netscreen / Fortigate firewall for home, any particular recommendations?

Already work with Netscreen, Sidewinder and cisco ASAs at work, but they are enterprise level.

Tempted with a Netscreen 100 or a Fortigate 60.

On a Sky broadband connection with the sky standard router and I want the 2nd hardware layer etc.

KIA · 4 Nov 2010 at 11:30

pfSense on an ALIX?

Kona* · 4 Nov 2010 at 12:35

fluff said:
pfSense on an ALIX?

+1

It's what I use at home, it has all of the enterprise level features without the enterprise price

Cost ~£100 in total (including shipping from Switzerland) for the board, enclosure, wireless card, pigtail cable, antenna & CF card.

Mikey · 4 Nov 2010 at 12:44

Will google the above.

Seen a Netscreen 100 for a reasonable price

anything I don't mind · 4 Nov 2010 at 13:19

pfsense!

use the beta v2 and put it on another pc with two nics.

http://snapshots.pfsense.org/

JIM_BOB7813 · 4 Nov 2010 at 13:30

Kona* said:
+1

It's what I use at home, it has all of the enterprise level features without the enterprise price Cost ~£100 in total (including shipping from Switzerland) for the board, enclosure, wireless card, pigtail cable, antenna & CF card.

Those things look good but!

It says on their site

Because of the high complexity, bureaucracy and cost of registration, PC Engines cannot accept orders from EU end users until further notice. Please order from EU based distributors.

And I presume you had to pay VAT/import duty? How much was delivery?

Kona* · 4 Nov 2010 at 22:19

JIM_BOB7813 said:
Those things look good but!

It says on their site

And I presume you had to pay VAT/import duty? How much was delivery?

Ohh I didn't notice that! We order them through work for our own products so I simply tagged an extra kit on to one of our orders.

They have distributors in the UK but I can't mention them as they sell the same stuff as OcUK, you will find what you want by Googling "ALIX Rackmount Chassis" though

The prices are ever so slightly higher to cover delivery and for the convenience of ordering from the UK but it's still cheaper than buying a enterprise-class firewall!

Mikey · 6 Nov 2010 at 13:55

Ideally after an appliance I've decided

anything I don't mind · 7 Nov 2010 at 12:38

what spec do those appliances have ?

Antec ISK 300-65 Mini ITX Case Black 65W PSU
Intel S775 Intel NM10 Atom mITX DDR2

These two you can get for about £120 and all you need to buy is another low profile network card and 2gb ddr2 ram (£35), find a cheap hd from some where and then put pfsense on it.

Mikey · 1 Jun 2011 at 15:41

What's people's thoughts on Zyxel firewalls?

Still haven't done anything about this, not after a adsl firewall

Ev0 · 1 Jun 2011 at 16:37

I quite like the Fortigate units from what I've seen of them.

Mikey · 1 Jun 2011 at 16:40

Ev0 said:
I quite like the Fortigate units from what I've seen of them.

Ah yes forgot about those, installed a few many years back when I was working for a reseller.

GaryH-21 · 1 Jun 2011 at 20:53

I've got OpenBSD on a box and use it's PF firewall

Although it means having to learn the conf file, there's plenty of examples around!

deano · 1 Jun 2011 at 21:19

fluff said:
pfSense on an ALIX?

ecksmen · 1 Jun 2011 at 21:46

Smoothwall... just to annoy people, but pfsense also gets a good nod.

Any of:

smoothwall
ipcop
monowall
pfsense
untangle

depending on througput old hardware is the way forward. 2GHZ and 1GB ram will be overkill unless you run lots of applications on them.

Ev0 · 2 Jun 2011 at 08:43

Mikey said:
Ah yes forgot about those, installed a few many years back when I was working for a reseller.

I've never had direct hands on with one apart form a bit of playing, but the guys that manage our network here use them for our guest access networks and also on a couple of projects for other businesses we've worked on.

Seem reliable enough and seem to do the job nicely.

They've also tried the Cyberoam products as well which I remember them saying were a decent enough cheaper alternative, but you lose out on a few things. I forget what though!

edscdk · 2 Jun 2011 at 09:00

stop being paranoid jsut use a standard NAT router...

a virus will get on your PC from an exploit when you browse a web site or an email attachment / friends external drive or you will be tricked into installing it your firewall will not help it will jsut use power and complicate your life...

even if you manage to stop the virus calling home (which is not likley as it will only connect out on http) its still on your PC and still needs removing

if you want toys bell and stuff maybe consider getting one of the routers that can be upgraded to one of the open source firewall thingies tomatoe?

http://en.wikipedia.org/wiki/Tomato_(firmware)

ecksmen · 2 Jun 2011 at 10:59

edscdk said:
stop being paranoid jsut use a standard NAT router...

a virus will get on your PC from an exploit when you browse a web site or an email attachment / friends external drive or you will be tricked into installing it your firewall will not help it will jsut use power and complicate your life...

even if you manage to stop the virus calling home (which is not likley as it will only connect out on http) its still on your PC and still needs removing

if you want toys bell and stuff maybe consider getting one of the routers that can be upgraded to one of the open source firewall thingies tomatoe?

http://en.wikipedia.org/wiki/Tomato_(firmware)

This is the whole point of using a decent firewall, they offer inline transparent virus scanning of web content. Sure, it doesn't protect you against a friends USB drive. Not to mention snort with gaurdian active response for IPS.

Firewalls are only good for saying what type of traffic is allowed, not what is within the traffic.

Mikey · 3 Jun 2011 at 08:40

ecksmen said:
This is the whole point of using a decent firewall, they offer inline transparent virus scanning of web content. Sure, it doesn't protect you against a friends USB drive. Not to mention snort with gaurdian active response for IPS.

Firewalls are only good for saying what type of traffic is allowed, not what is within the traffic.

Correct as I was about to say this too.. Virus Scanning, content inspection, HTTPS inspection, IPS, IDS and so on.

Essentially I also wanting to have my other net devices in the DMZ
Sky +
Vodafone Sure Signal
Sony Blu Ray

As they're not PC related and I have no reason to trust them

Fortinet
Watchguard
Juniper Netscreen
Sidewinder - prob not due to ££
Cisco ASA if I can find one cheap enough

These are just a few I've thought about

Final other reason is to allow my brother to SSL VPN from Dubai

Further research this weekend, but it's got to be pretty quiet too...

Ev0 · 3 Jun 2011 at 09:52

As said see what kind of price the Cyberoam stuff comes out at, they are pretty new I think and similar (a bit cheaper) to Fortigate devices.

I know a good reseller too