Home Network Firewall Options
-
@Jason said:
Intel Xeon E5-xxx Quad with 8GB of ram and quad on board nic. NO SSD but that's not going to affect a router.
Something very very wrong was happening then...maybe the quad NIC? If I get a decent outbound line, I'll try sticking the same box on it and test it. See what the performance is like.
-
@Breffni-Potter said:
@Jason said:
Intel Xeon E5-xxx Quad with 8GB of ram and quad on board nic. NO SSD but that's not going to affect a router.
Something very very wrong was happening then...maybe the quad NIC? If I get a decent outbound line, I'll try sticking the same box on it and test it. See what the performance is like.
Nope wasn't the NIC.. Worked fine on Pfsense too. They were Intel NIC which are the best for firewalls. The CPU was just pegged out when trying to saturate 150mb, too much overhead with those UTM packages
-
@Jason - Well, if I ever get a connection like that, I'll have a play.
I really liked the Sophos when it was on, ran it for about a year, then retired it.
-
@Jason said:
@jyates said:
@JaredBusch said:
@Dashrender said:
PFSense is a good free option, but it requires you provide your own PC class hardware, and the power bill will probably be 10X or more than an ERX.
This right here.
pfSense is a great solution but requires hardware that will cost you more than an ERX ever will.
Drop another $80-$90 on an UAP-AC-LITE and you have a rock solid home network running basic enterprise hardware.
Sophos has the same options. Free, but requires a machine to run on.
https://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx
It's a resource hog...
Anything labelled UTM would be. UTMs really can't be used on anything but super slow connections. It's one of the many reasons many of us feel that the entire UTM concept is a silly and dead one.
-
@Breffni-Potter said:
I was getting 38 when I'm expected to get a 40 down line at home. 100+ MB is not common here yet.
This was with all the IPS, gateway AV, content filtering on.
Do you remember the spec of the machine? Mine was a core 2 duo, with 2 dedicated gigabit cards for in/out, though it did have a 32GB SSD.
150 up 150 down here ^_^
-
-
@scottalanmiller said:
@Jason said:
@jyates said:
@JaredBusch said:
@Dashrender said:
PFSense is a good free option, but it requires you provide your own PC class hardware, and the power bill will probably be 10X or more than an ERX.
This right here.
pfSense is a great solution but requires hardware that will cost you more than an ERX ever will.
Drop another $80-$90 on an UAP-AC-LITE and you have a rock solid home network running basic enterprise hardware.
Sophos has the same options. Free, but requires a machine to run on.
https://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx
It's a resource hog...
Anything labelled UTM would be. UTMs really can't be used on anything but super slow connections. It's one of the many reasons many of us feel that the entire UTM concept is a silly and dead one.
I've been running Sophos UTM on a 300/100Mbps connection at home (certainly not a slow connection) and easily get full bandwidth usage with everything turned on. Granted I'm running it on a Dell R210 II and it is a bigger resource hog, but for home, I want all of that turned on, especially with teenagers who don't care about sites they visit or what they download. In the SMB (closer to S than M or B of SMB anyway) I've found the UTM approach anything but silly. The simplicity of management is a huge bonus.
-
@NashBrydges said:
In the SMB (closer to S than M or B of SMB anyway) I've found the UTM approach anything but silly. The simplicity of management is a huge bonus.
The problem I find with UTMs is they need to be monitored and watched to be used properly. If an attacker is really trying to break in, do you want to hope the magic box works? Or is there monitoring to spot suspicious activity and react to it.
UTMs are a magic box that I'm seeing over-sold, I myself got suckered into buying one and actually, it provides no performance or security benefits to the organisation it protects because the monitoring and reacting that you need to do, is not being done.
-
I too went the way of the UTM last time. Sure it did website filtering, but management complained about it.. and DAMN, the vendor wanted 90% the original cost to renew the updates, etc.
I've dumped those and moved to ERLs.
The idea of the LANless design encourages us to do other things to secure our endpoints.
Removing admin rights from those teens machines should offer a fair amount of protection.
-
@Breffni-Potter said:
@NashBrydges said:
In the SMB (closer to S than M or B of SMB anyway) I've found the UTM approach anything but silly. The simplicity of management is a huge bonus.
The problem I find with UTMs is they need to be monitored and watched to be used properly. If an attacker is really trying to break in, do you want to hope the magic box works? Or is there monitoring to spot suspicious activity and react to it.
UTMs are a magic box that I'm seeing over-sold, I myself got suckered into buying one and actually, it provides no performance or security benefits to the organisation it protects because the monitoring and reacting that you need to do, is not being done.
Totally agree that they're too often seen as a magic box but that's a user problem, not a technology problem. I wouldn't recommend a UTM without the appropriate oversight.
-
So without a UTM device how are you monitoring the network and locking down the traffic?
I know there are other methods but a UTM seems to provide an easy way to accomplish this in an SMB environment
-
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
I know there are other methods but a UTM seems to provide an easy way to accomplish this in an SMB environment
Netflow on your router then another device (IDS/IPS) can look at traffic and modify to block it if needed. Ours is actually called a Network Behavior Anomaly Detection. There's open source ones too I'm sure.
-
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
I know there are other methods but a UTM seems to provide an easy way to accomplish this in an SMB environment
In the SMB, one idea floated is to move way from the LAN altogether to a LANless design. Don't trust the local or any network. Protecting people from the websites they visit is difficult at best and impossible at worst, it's a moving target, and normally good site can be hacked and and suddenly start dishing out bad stuff.
-
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
-
@NETS said:
I know there are other methods but a UTM seems to provide an easy way to accomplish this in an SMB environment
Sure, but a firewall is just as easy. So what's the benefit to the UTM? UTMs are costly and often introduce big bottlenecks to the network. In what way do you see them justifying their extra cost to purchase and maintain?
-
@Dashrender said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
I know there are other methods but a UTM seems to provide an easy way to accomplish this in an SMB environment
In the SMB, one idea floated is to move way from the LAN altogether to a LANless design. Don't trust the local or any network. Protecting people from the websites they visit is difficult at best and impossible at worst, it's a moving target, and normally good site can be hacked and and suddenly start dishing out bad stuff.
Not just in the SMB, but the SMB will lead here but the nature of being easier to be agile.
-
@wirestyle22 I've managed to kit out my home network entirly with Meraki gear I've acquired through webinars and cheap eBay sales. Currently using an MX60 which I picked up for £40 that included a little less than 1yr of the Advanced Security license on it.
-
We had a UTM applicance that was excellent for web filtering and sucked big time for IPS.
I cut the IPS off and ran Snort / Suricata for a few years in-line so I could actively block the attacks and things like P2P It was awesome. Sadly, our Badnwidth outpaced the hardware and we had it converted to an IDS out of band so it just monitored.
I am a HUGE believer in knowing what is going on on your network. Get something in place, even if it can only see what is going on and alert you.
-
@dafyre said:
I am a HUGE believer in knowing what is going on on your network. Get something in place, even if it can only see what is going on and alert you.
This.
-
I've been playing with my ERX. It's pretty amazing for $60. Looking into purchasing their UAP-AC-LITE as per @JaredBusch
