Best Physical Firewall

I've been subject to several attacts recently, and lots of messenger spam. I disabled the windows messenger but I'd still like a nice firewall between my computers and the internet.

Any brands that stand above the rest?

Linksys is owned by Cisco systems, one of the major players in networking. I'd look at their products. I generally find their products work pretty well.

A firewall does not mean that you should not also use a virus scanner. Firewalls don't protect against trojans or
viruses sent via e-mail.

Daniel

Definately not a good idea to compare Linksys and Cisco.. the only change that has happend since the purchase is that the Linksys routers have a Cisco logo on the box and the router now

IOS (Cisco's operating system for routers) and PIX OS (their firewall operating system) really don't have any relation to that running on the linksys routers

If you're just trying to block random crap from the outside, any cheap cablemodem/DSL router will do the job decent enough. I prefer NetGear and Linksys for consumer grade stuff, they do the job and they do it well, and seem to have the best firmware/software updates available. I stay away from D-Link now due to a horrible string of bad experiences every time I decided to save $5 again. You should be able to get a decent one at a store for less than $40, or $50-$75 with wireless built in depending on what you're looking for.



If you want the BEST hardware firewall, you're looking at a Cisco PIX firewall - they have small office ones in the $250-$400 range which will offer you the best intrusion detection and vpn endpoint capabilities for a small office.

I agree with myk, Any cheap router/switch with nat will do the trick. Some have so called built in Firewall software but the basic function of the router will prevent most issues. As for software firewalls they are junk. Don't waste your money. As for brand well I say do some research. Linksys is the most know brand. I Agree big deal Cisco owns them it AIN'T NO CISCO. The common Wireless Linksys are know to have issues with xboxlive and certain im clients so if you are big into either of those do some searching to make sure compatibility is there. My experience is I like Netgear better but if I am doing wireless setups Linksys normally has a better signal where as netgear was known to have overheating issues with some of their wireless models.

Here are a few things to consider for a home based hardware firewall.

Just using a NAT (Network Address Translation) enabled router/firewall will keep people from being able to initiate a connection inbound to your PC. That's quite a bit of mitigation right there.

The main thing to consider though is that many things can require inbound connections to work. If you want to run a webserver, some P2P applications, or something really important such as games like World of Warcraft, then you are going to need to learn how to configure port forwarding. That is really just telling the router/firewall what traffic is allowed to start connection from the outside (or Internet) and to which PC to send them.

Most devices have good instructions on how to do this and many software vendors even tell you specifically how to configure the main brands like Netgear or Linksys.

Moving up to a more sophisticated firewall that does more rigorous inspection of incoming packets won't be necessary if you're just doing normal PC stuff. If you are running a webserver, database server, or mail server however, the IDS features mentioned above can provide some valuable protection. Many of them look for common attacks such as directory traversal where I could try a link like http://www.yourwebsite.com/images../../ which would try and move me up a couple directories where I might be able to snoop on stuff I should not e able to see.

This is great stuff but you really must understand a lot about networking and applications as IDS requires thorough tuning or you'll be swamped with tons of alarms that might not be applicable to your setup. For instance I could launch and attack against an Exchange server that you don't even have. Your IDS if configured to watch for those would generate alarms even though you have nothing vulnerable to my attack.

Hope that helps. Maybe too much info??? :shrug:

I'd say +1 to the Linsys or Netgear boxes. They should be all you ever need for home and are well supported.

If you've got a spare old PC lying around, you could try the Astaro Security Appliance software - www.Astaro.com. It's free for non-commercial users.

I've got an old 300mhz IBM somewhere, I think that might do the trick.
If not Netgear seems to have good reviews

My brother is running Smoothwall on an old PC and it works very well.

Biker Bear said:

If you've got a spare old PC lying around, you could try the Astaro Security Appliance software - www.Astaro.com. It's free for non-commercial users.

Click to expand...

THAT'S WHAT I USE!
Astaro Security Gateway (ASG)
I've got 6.303 running on a Jetway Mini-ITX with the 3 port daughter card.
Small, quiet, awesome. 3 different types of VPNs, proxies, blah, blah, blah.
I've been running it since 2002/3

To respond to this, I should disclose that I work for Cisco. Also that I am not
speaking for them here.

Running an old PC as a firewall may seem attractive until you take a look at your
electric bill. 80-100 watts 24x7 adds up.

If you are looking at Cisco firewalls, you may want to consider the IOS-based ones
as well as the PIX. IOS firewall has surpassed the PIX in many areas.
I am currently using an Cisco IOS based firewall.

Among the cheap commodity firewalls, Linksys is better than most, but the real
value in certain models is the ability to run free open-source software in them.
Hyperwrt and Openwrt are free software distribtutions for the WRT54GL and a
number of other routers. These provide much more functionality than the stock
software. Openwrt is a linux distribution that can install in the flash of
a WRT54GL (but can use the usb disks on a WRTSL54GS if you have one).
Openwrt runs on a number of cheap commodity routers by different vendors.
I have openwrt running on a WRTSL54GS which I use as a file server and iTunes server.

myk said:

Definately not a good idea to compare Linksys and Cisco.. the only change that has happend since the purchase is that the Linksys routers have a Cisco logo on the box and the router now

IOS (Cisco's operating system for routers) and PIX OS (their firewall operating system) really don't have any relation to that running on the linksys routers

If you're just trying to block random crap from the outside, any cheap cablemodem/DSL router will do the job decent enough. I prefer NetGear and Linksys for consumer grade stuff, they do the job and they do it well, and seem to have the best firmware/software updates available. I stay away from D-Link now due to a horrible string of bad experiences every time I decided to save $5 again. You should be able to get a decent one at a store for less than $40, or $50-$75 with wireless built in depending on what you're looking for.



If you want the BEST hardware firewall, you're looking at a Cisco PIX firewall - they have small office ones in the $250-$400 range which will offer you the best intrusion detection and vpn endpoint capabilities for a small office.

Click to expand...

I'll second that.

Linksys have to have the worse networking products to ever grace this good earth.

Brands I would go for are.
ZyXEL
Netgear
USRobotics (only switches)
SMC
HP

A good quality router will be all you need for protection, just make sure it's ICSA labs certifide and ignore routers touting "DDoS protection" you can't defend against DDoS attacks.

Realize I'm pretty late to the party here! But for what it's worth, I've been running SMC model SMCBR18VPN for about a year now and it's served me pretty well. Among the nicer aspects of this router, it does have a SPI firewall in addition to the usual NAT... allows surprisingly flexible packet filtering... and supports dynamic DNS in the firmware. All in all, not bad!

I've yet to make a successful VPN connection but that's not a priority for me as I typically encrypt incoming traffic via SSH tunnel anyway... and the unit supports logging on a log server, but I've never gotten around to setting one up, so don't know how successful that is.

I would recommend this product.
:thumbsup:

For home use, I have been running a linksys WRT54G router/firewall for a few years now, and have had no issues.

I use Zone Alarm Pro for my firewall. Ive been using it for about a year now and 6 months with a Linksys wireless router. It works great for me.

I'm going to disagree with some of the above posters. You should run a hardware firewall to protect you from stuff coming in AND a software firewall to protect yourself from stuff trying to get out. Thats often your best way of detecting an intrusion: when it tries to call home.

I had a SmoothWall machine running a year ago, and it had been working for a good year before that. That old machine that ran it, had a long tough life. Shortly after getting it running, the CPU fan began making horrid sounds. So I wired and ducked tape a nice and quiet 80mm case fan to the base of the computer case, so that air would at least move around it. That fixed the machine for well over a year, then the PSU out of no where one day starting a terrible sound. Shut it off immediately after it began and never turned it back on. I just ripped the case fan out of it as it was a kinda expensive one, a few days ago.

None the less, SmoothWall was a well running program,

-Cameron

We switched my office network over to a sonicwall firewall from a symantec product and have been very happy.

A few vpn issues, but quickly resolved.

Marc

"THE BEST" physical firewall. Period!



:lolsign:

I"m using a D-Link very inexpensive wired router for myself right now. It works pretty good for internet sharing and lets me setup the necessary NAT stuff and other security.

I recently had the pleasure of setting up a linksys router for my sister in law. I've been setting up wireless and wired networking systems for 15 years. I've worked as a sysadmin and I can actually use the arp command from the unix command line and manually configure routing information. for years I ran a linux distribution for the ill fated alpha processor and manually configured my firewall on that machine by editing config files with vi. This is stuff I know and I couldn't get the dumb thing to work. It was like it was talking about a whole different intraweb. Honestly it took me an hour and a half to do what should have taken 10 minutes. (and with other models from other companies I've setup wireless networks, routers and firewalls with no difficulty) but I will NEVER allow any family member or friend who expects my help to ever touch another piece of their hardware ever again.

I could probably have reflashed it to the linux OS and set that up in less time than it took me to figure out how to setup the built in crapola. But if you're not interested in doing that, then dont buy one.

As far as the other, a real firewall will let you setup rules for incoming and outgoing traffic. Assuming you never get infected by anything (and since not a single machine behind my firewall runs windows thats a pretty safe bet for me) you also need to protect against outgoing connections. The zombied windows boxes now make an outgoing connection to a chat server or something else to report the infection and allow themselves to be used in DOS attacks and all sorts of other things. A regular NAT type router wont protect you from being used once your infected, but a real firewall, either a software one properly configured (and actually working which is hard to validate) or a real PC running as one can be setup to do that. But it isn't easy.

James S - please don't take this as a dig against you. What took you an hour to configure the router was looking through the pages and pages of options and fun commands you thought about playing with at home if you bought one. I did it too.


Please note that the linksys router, assuming you have a cablemodem with no login required, will just work when you plug it in, done.

Other than that, they also have an "I'm not computer literate, make my wireless network secure" button on the new wireless range which will configure your wireless, and the router, to all the same settings, instantly - it actually works.

Even if you have a WEIRD (having to log in to a DSL account when you use the internet) situation with PPPoE, its right on the first config screen - the only reason for a user to go past said first screen is to change advanced settings

I would propose that you try to use bittorrent for a few hours before you suggest anyone ever buy a D-Link router =)