Home Network Firewall Options
-
@scottalanmiller said:
@JaredBusch said:
@scottalanmiller said:
@wirestyle22 said:
I'm really impressed at EdgeOS. I can't talk its praises enough. For $60 I can't see anything else comparing.
It's VyOS, which took over from Vyatta when that went away. We've been using some form of that for over a decade now. It's been consistently awesome.
It is NOT VyOS. It is Vyatta. I know we have had this conversation before. I wish you would keep your facts straight.
References: http://vyos.net/wiki/EdgeOS & http://community.ubnt.com/t5/EdgeMAX/edgemax-vyatta/m-p/391382#M4533
I have no memory of having discussed this.
It's a competing fork to VyOS? That seems odd. Why maintain two competing forks?
http://mangolassi.it/topic/1714/tonight-s-project-ubiquiti-router-for-home/15
-
@JaredBusch said:
@scottalanmiller said:
@JaredBusch said:
@scottalanmiller said:
@wirestyle22 said:
I'm really impressed at EdgeOS. I can't talk its praises enough. For $60 I can't see anything else comparing.
It's VyOS, which took over from Vyatta when that went away. We've been using some form of that for over a decade now. It's been consistently awesome.
It is NOT VyOS. It is Vyatta. I know we have had this conversation before. I wish you would keep your facts straight.
References: http://vyos.net/wiki/EdgeOS & http://community.ubnt.com/t5/EdgeMAX/edgemax-vyatta/m-p/391382#M4533
I have no memory of having discussed this.
It's a competing fork to VyOS? That seems odd. Why maintain two competing forks?
http://mangolassi.it/topic/1714/tonight-s-project-ubiquiti-router-for-home/15
Okay, I did not respond to that and it was not directed at me, while I try to read things, I might easily have missed that.
-
@scottalanmiller said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
I look at UTM's as a single device that can easily secure and monitor and a variety of network traffic with minimal effort. Running a regular ERX works but you lose the malware, mail filtering and IPS features of a UTM. Sure there are other methods of gaining those features back but not on a single box. For SMB that single box is a big sell.
If you use a Edge router how are you adding back in the other security features that a UTM or Nextgen firewall offers?
-
@NETS said:
@scottalanmiller said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
I look at UTM's as a single device that can easily secure and monitor and a variety of network traffic with minimal effort. Running a regular ERX works but you lose the malware, mail filtering and IPS features of a UTM. Sure there are other methods of gaining those features back but not on a single box. For SMB that single box is a big sell.
If you use a Edge router how are you adding back in the other security features that a UTM or Nextgen firewall offers?
Take Cover!
-
@wrx7m said:
@NETS said:
@scottalanmiller said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
I look at UTM's as a single device that can easily secure and monitor and a variety of network traffic with minimal effort. Running a regular ERX works but you lose the malware, mail filtering and IPS features of a UTM. Sure there are other methods of gaining those features back but not on a single box. For SMB that single box is a big sell.
If you use a Edge router how are you adding back in the other security features that a UTM or Nextgen firewall offers?
Take Cover!
I fully expect it. Possibly even looking forward to the rousing discussion that takes place because of it.
-
@NETS The summary of past discussions:
UTM is a waste of money
Use separate boxes for specific uses - Firewall, proxy
Use endpoint protections for AV
Don't log/block websites/categories unless it is to prevent malware (even then, use a service like Open DNS)I don't necessarily endorse all comments
Edit- I almost forgot - The performance is almost always better when you separate the roles.
-
@wrx7m said:
@NETS The summary of past discussions:
UTM is a waste of money
Use separate boxes for specific uses - Firewall, proxy
Use endpoint protections for AV
Don't log/block websites/categories unless it is to prevent malware (even then, use a service like Open DNS)I don't necessarily endorse all comments
A good "do it all in one box" solution saves an imperial buttload of time though, good grief.
+1 to Fortigate; you may be expensive but you work darn well for us.
-
@MattSpeller I do like my Sophos too. Although, I am starting to see the benefit to having fewer things running on the same box. Troubleshooting might actually be easier. "Is it a proxy issue or firewall rule? Could be either."
-
@wrx7m said:
@MattSpeller I do like my Sophos too. Although, I am starting to see the benefit to having fewer things running on the same box. Troubleshooting might actually be easier. "Is it a proxy issue or firewall rule? Could be either."
Just remember that sometimes the grass isn't really greener haha. I would love to do all these boxes myself and learn a bunch of new junk but that'd be a huge chunk of time I don't have.
-
@NETS the point is not to always separate or always to use an all in one. The point of every IT solution should be to find the correct solution to the problem.
Very rarely is an UTM actually ever required when you break all the pieces down and look at what they do and what the business needs.
I have never needed a full UTM at a single client.
The good place to find the need is in libraries and education. They have laws or ordinances mandating things and vendors have provided solid solutions for them.
-
Are you guys using actual server hardware to make the devices to fill those roles?
-
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
-
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
-
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
They're all virtual right? So what does it matter, hardware agnostic. That said, a solid server box is definitely preferred.
-
@travisdh1 said:
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
They're all virtual right? So what does it matter, hardware agnostic. That said, a solid server box is definitely preferred.
What if the company has a ton of remote sites like mine? Wouldn't that be a pretty big cost?
-
@wirestyle22 said:
@travisdh1 said:
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
They're all virtual right? So what does it matter, hardware agnostic. That said, a solid server box is definitely preferred.
What if the company has a ton of remote sites like mine? Wouldn't that be a pretty big cost?
Only if you have a reason to need one at every site. If you get to a LANless design then you don't really need the security appliances at every location, and if you're still running traditional LAN and VPN then you only need the one at the head office.
-
@travisdh1 said:
Only if you have a reason to need one at every site.
In other words - only if you need those UTM services at every site.
If you get to a LANless design then you don't really need the security appliances at every location,
I still really like the idea of a hardware firewall (though I suppose a firewall VM would be fine) between you and the internet whenever possible.
and if you're still running traditional LAN and VPN then you only need the one at the head office.
This assumes you have the bandwidth to bring all internet traffic back to the home office for filtering before going out to the internet. I don't know anyone who does that anymore.
-
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
-
@Dashrender said:
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
Not at every site. What I'm going to do is install a Squid proxy at one specific location because we have two client computer labs there. It's extremely vulnerable with the developmentally disabled clicking on anything and everything--not that I would expect anything but that in this situation. So I basically block everything except YouTube and a few educational websites that they use daily. I do this only for their computers and have standard content policies in place for the others.
I'm getting rid of my Sonicwalls in favor of Ubiquiti Security Gateways but I lose content filtering basically.
-
@wirestyle22 said:
@Dashrender said:
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
Not at every site. What I'm going to do is install a Squid proxy at one specific location because we have two client computer labs there. It's extremely vulnerable with the developmentally disabled clicking on anything and everything--not that I would expect anything but that in this situation. So I basically block everything except YouTube and a few educational websites that they use daily. I do this only for their computers and have standard content policies in place for the others.
I'm getting rid of my Sonicwalls in favor of Ubiquiti Security Gateways but I lose content filtering basically.
yep - I was in the same boat 4 months ago. Though - just wondering, why the USGs vs the ERLs?
