Best firewall solution?

What would you recommend for a firewall solution for the following situation:

* Small business, direct response marketing
* All-windows 2000 shop, 2000 server gateway
* App. 12 PCs, 12 more within the month

From the short discussion I had today with their lone IT guy they have around a dozen system running Windows 2000 accessing the net through 2000 Server and there is no firewall in place. Budget is a major priority of course, and I'm wondering if a cheap software based firewall on their gateway would be sufficient. Or if a hardware based firewall would be worth it, and why. I am also restoring about a dozen more PII and PIII systems for them which will be on the network soon.

A software firewall might do but I would STRONGLY recomend a strong cisco router, they are quite the best when it comes to stuff like this:)

If money's tight, SmoothWall is a great Linux-based router & firewall solution. Throw it on an old box with two network cards in it and you've got fully-functional NAT router & pretty good firewall. Add a third NIC for a real DMZ.

You don't want to run the "gateway" server as a firewall, because if someone compromises that computer, they're on your network. You want to make sure your firewall is NOT a computer that participates in LAN functions.

Whether it's by Cisco, SmoothWall, or anyone else, GET A FIREWALL IN PLACE NOW! :eek:

Absolutely get a firewall in there. The Smoothwall does look slick. Great low cost alternative to the Cisco router.

Quote:

---

Originally posted by SkyDog
If money's tight, SmoothWall is a great Linux-based router & firewall solution. Throw it on an old box with two network cards in it and you've got fully-functional NAT router & pretty good firewall. Add a third NIC for a real DMZ.

---

This is one option I thew out, since I use a Slackware box at home as a NAT router and firewall. I haven't tried Smoothwall, just looked at it a hundred times thinking 'I'll try this someday'. They are concerned because they are an all MS shop and I think it's weird for them to think Linux. Perhaps the price tag will convince them otherwise though.

Quote:

---

You don't want to run the "gateway" server as a firewall, because if someone compromises that computer, they're on your network. You want to make sure your firewall is NOT a computer that participates in LAN functions.

---

Hehe, really good point. :) So a hardware firewall or get another box in there with a software firewall. I was shocked they don't have a single thing running... even more surprised they aren't all infected with msblaster by now.

I was also looking at SonicWall, something we use at my regular employer's location. Don't know much about it though. Now before diving in and trying Smoothwall out, does it have a fairly good web-based interface for non-Linux users? I'm actually installing something on a PII which I'll be turning into my new home router, perhaps this is the time to try.

Thanks for the helpful input!

Quote:

---

Originally posted by Tekime
They are concerned because they are an all MS shop and I think it's weird for them to think Linux. Perhaps the price tag will convince them otherwise though.

---

Since the box won't be participating in LAN functions, it shouldn't matter to them what OS it's running. Besides, I don't know of a single MS shop that also uses Windows for routing/firewall functions because so many attacks are aimed at Windows boxes.

Quote:

---

Originally posted by Tekime
Now before diving in and trying Smoothwall out, does it have a fairly good web-based interface for non-Linux users? I'm actually installing something on a PII which I'll be turning into my new home router, perhaps this is the time to try.

---

The web interface is very slick -- possibly the best thing about the software. You can take a look at some screenshots HERE. A little Linux knowledge wouldn't hurt when setting up SmoothWall, but even most newbies should be able to figure it out pretty easily. You don't need to know Linux at all to administer the firewall via its web interface, but you will need to know some about TCP/IP. ...but that's true no matter what OS your router/firewall is running.

If you're up to experimenting with different options, there's another fairly popular Linux router out there called IPCop that you can use if you need support for multiple WAN IP addresses (like if you were hosting multiple Internet domains behind your firewall).

I'm liking the idea of Smoothwall more and more. :) As long as they can handle basic administration without calling me every day for help, it should be sufficient. It will save them a bunch of money and they have about a dozen PII & PIII machines I'm restoring. I would imagine one of these would be perfect for the job; heck mine is a PPro 233.

I grabbed the .ISO and I'll probably fire up my K6-2 and give it a try first. I have a fair bit of GNU/Linux experience -- I use Gentoo on one of my desktop boxes and Slack on my server. I'm no guru but if you can make it through Gentoo installation I'm sure Smooth will be a breeze ;)

Now I would imagine a little extra RAM might be helpful, think a PII-300 with 256MB C2 PC100 SDRAM and a 4GB Fireball would cut it? It would be too bad if this system bit the dust though, which is one thing that concerns me with older hardware.

Again, many thanks :)

edit: And regarding IPCop, they aren't hosting a single domain so I don't think they would need the extra functionality.

Quote:

---

Originally posted by Tekime
...think a PII-300 with 256MB C2 PC100 SDRAM and a 4GB Fireball would cut it?

---

Easily. 256 MB RAM might even be overkill.

By the way... I hope these "direct response marketing" people don't have anything to do with spam, junk mail, or spyware. Otherwise, leave 'em without a router. ;)

and give the IP address to us so we can "assist" them:D

Quote:

---

Originally posted by SkyDog
By the way... I hope these "direct response marketing" people don't have anything to do with spam, junk mail, or spyware. Otherwise, leave 'em without a router. ;)

---

Haha, not a chance! Believe me, I'd leave them wide open. :) The name might be misleading, they pretty much sell self improvement products, and on top of that they take mostly incoming sales -- so they aren't the jerks who call you halfway through dinner to interview you about your pants buying habits.. :D

I'll check out Smoothwall on my own time first, but I'll probably throw this out there as a good option. Personally, I'd love to see more Linux boxen making their way into businesses.

PS. On a side note, I just realized we've got SkyDog, AirR' and flyer1, is this Sharky's 3rd Technical Air Brigade or something? :p

I got in there and looked at their equipment room. They have cable going to a LinkSys BEFSR81 DSL/Cable router and LinkSys EZXS88W switch. The BEFSR81 has some limited firewall capabilities; but probably not enough, eh?

I have a Pentium Pro which I can sell them cheap, I'd imagine this is fast enough with 128MB SDRAM?

I can't find much info on how secure the BEFSR81 is, and whether they should upgrade now, or really upgrade now.

With 12 systems and 12 more on the way, it is time to do some planning. How much security do they need, how much is their data worth to them? What does the fine print in the insurance policy say about data storage? How many systems will they have next year? And it goes on and on.

With 24 systems SBS would be the way to go. Not only will it address the fire wall issue, it will give them proper network security and user management. It will also allow for much more flexibility for IT improvements as the business grows. The limiting factors would be the 50 client limit and the single domain model.

From a security standpoint, that BEFSR81 is adequate so long as you don't forward any ports. It does have a few security weaknesses, though -- it doesn't do adequate logging for a business, and doesn't identify potential attacks.

I've been playing with IPCop (a Linux firewall distro similar to SmoothWall), and I'd strongly recommend you take a look at it. It's a piece of cake to install, works really well, and has Snort intrusion detection software built right in. If you donate some decent hardware to the router box, you can also use it as a caching web proxy to improve web browsing response times.

...and best of all, it's free. :)

Thank you for the replies, I'm trying hard to weigh the options and consider their budget and requirements. Their plans have changed a little bit though - the 12 systems they wanted to add are too old to even waste time on. Pentium 200MHz Optiplex Gn+ with no RAM. Replacement modules are about $100 per 128MB so they are most likely being ousted in favor of a few (3-4) new Duron systems which I quoted for about $180.

While SBS might be a good thing to have, they aren't able to spend $700+ on it. I'm definitely concerned with the future of their network, but in all honesty I don't think their needs will change all that much over the next few years. Their primary concern now is to secure their network and get around 20 systems running for general office use and Internet access, on a really tight budget.

So, basically, the BEFSR81 is not a firewall, but it provides some of the functionality of a firewall by denying all packets that aren't forwarded? Since the primary function of the network is to provide Internet access and file & print sharing, there is no need for forwarding and as such I think the Linksys is probably going to suffice as a basic firewall. I'll probably recommend they invest in a box running Smoothwall or IPCop, but with the BEFSR81 in place they shouldn't be a wide open target or anything, right?

Thermo I hadn't thought about insurance policies demanding certain security measures, this is something I might bring up to them. They certainly have critical data (customer details, credit cards, etc.).

I threw that PPro together last night, didn't get a chance to install anything yet, though. I think I might give IPCop a try, it looks a little more robust and it's been recommended to me a few times now.

Now if they are willing to get IPCop in there, would you stick it between the BEFSR81 and the cable line or just replace the router altogether?

Quote:

---

Originally posted by Tekime
Now if they are willing to get IPCop in there, would you stick it between the BEFSR81 and the cable line or just replace the router altogether?

---

You would just replace the router altogether. There's no need to have two NAT routers.

You could still use the BEFSR81 as a switch if you need its ports. Just turn off its DHCP server and leave its WAN port disconnected.

Great, thanks. Maybe I'll just trade the work for the router, save them some money and get a new toy :)

To be honest, I wouldn't replace the broadband router with a desktop PC (or even a server) running a firewall application. Hard disks die with alarming regularity.

I prefer solid state devices. They are more reliable, have virtually no OS to "crack", have optimized CPU's in stead of general purpose ones (which REALLY help when you want to set up something like IPSec VPN's), and take up a lot less room.

For firewall functionality at a decent price, with Windows clients, I recommend Sonicwall gear. They have a unit to fit most budgets.