• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Need advice on a dedicated firewall for my setup...

K

k1114

Golden Member
After a recent bout of DOS attacks (flooding mainly) and other issues, I've decided it's time to step up my home security. Currently, here is my setup:

Cable modem (serving ~25mbps)
Linksys router w/DD-WRT
24 port gigabit switch
~16 devices (12 wired, 4 wireless) and more on the way

I understand that NAT alone provides reasonable protection, but I want something that handles active intrusion prevention (similar to snort under *nix), which I know is more than my router can handle. Ideally this device would be in front of the router, since I really like the router's internal features and would prefer to continue using it for wireless (I don't want my wireless devices in front of the firewall device).

I've looked at several products, and I'm torn between software (on dedicated hardware) and traditional hardware implementations. I like pfsense and m0n0wall, but I'm concerned about constantly doing maintenance. I also like the look of some of the retail products out there, especially since eBay is flooded with cheap stuff from Juniper, Watchguard, Sonicwall, etc, but I worry that without a subscription these devices won't be worthwhile. Power consumption is a moderate concern and rackmount is preferred (I have around 8U free). Budget is maybe $50-150?

Any thoughts on the type of device I should be looking for? Or even a specific model? I'm new to dedicated firewalls (aside from the old PIX-501) and somewhat lost.
 
Last edited:
Astaro is free for home use, you just need to provide the hardware.

Untangle is also free, again you need to provide the hardware.
 
Cisco PIX 501, can get one for under $100 on ebay and they are rock solid. Hell, for over 100 you can get a PIX 525 which will be more than any "normal" person would need.
 
yinan said:
Cisco PIX 501, can get one for under $100 on ebay and they are rock solid. Hell, for over 100 you can get a PIX 525 which will be more than any "normal" person would need.
Click to expand...

The PIX 501 and 525 are simple packet filters, which any generic firewall can do. The OP is specifically looking for a firewall with IPS functionality.
 
I hope you realize that any device you install, no matter what it is, is useless against a DoS attack if that attack consumes all available bandwidth on your connection. An attack like that can only be mitigated by dropping the packets upstream before they saturate the downstream bottleneck.
 
Pheran said:
I hope you realize that any device you install, no matter what it is, is useless against a DoS attack if that attack consumes all available bandwidth on your connection. An attack like that can only be mitigated by dropping the packets upstream before they saturate the downstream bottleneck.
Click to expand...

Yes I do. I understand that certain types of DOS (and particularly DDOS) attacks are simply unstoppable since they consume virtually all available bandwidth on my segment. I'm just looking to step things up in general and prevent weak DOS attempts from single end users, which are currently enough to cause problems that they shouldn't. I also like the idea of using snort via pfsense for the public block lists and such.
 
So I've secured a nice 4U case and it looks like I'll be building something. It's between untangle and pfsense, so I have some reading up to do 🙂
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top