3
votes

I have to set up a "secure" network for my boss. For now, I have a ADSL router linked to a switch. All users are connected to this switch. Security is obviously bad. I want to put a server between the ADSL router and the switch. This server will, I think, be a bridge. But it has to be a firewall, a proxy and a web content filter. There are about 20 users (who use a lot the Internet for surfing no downloading).

What kind of hardware should I use for the server ? Of course, I need two NICs.

  • How many RAM would be enough ?
  • Is the bridge solution a good one in term of performance ? (perhaps NAT, or static route ...)
  • Should I use Debian or NetBSD ? I read that NetBSD is good for that kind of job
  • SHould th server be the router for the lan or I keep the ADSL router ?

Thank you for your answers.

PS : Sorry for my poor english

11 Answers 11

Reset to default
7
votes

I have the exact the same problem as you but for a slighty bigger network.

I would suggest you to use Pfsense which is based on BSD and is configured via an extremely powerful yet simple and clear web interface. It is firewalling a zones of 70 servers on a Celeron 3Ghz processor with 2GB of RAM (largely unused).

Configuring it as a transparent bridge was the most efficient setup as it allowed to modify practically nothing on the actual architecture.

I therefore suggest you either get one nice Dell server (low end will be far enough) for reliability of the hardware components and install pfsense on it. Or you can reuse two older servers on PFsense with redundancy (CARP) which is really simple to configure.

3
  • 2
    I also strongly recommend pfSense (pfsense.org). It is a mostly out of the box solution that is pre0hardened. I would disagree with the need for a nice server though. It was originally designed to run on embedded systems with a 100 MHz Pentium and 128 MB of RAM (specs listed as the current minimum requirements). I would recommend going at 1Ghz and 256MB of RAM.
    – TrueDuality
    May 28, 2009 at 13:35
  • I would also like to note that the more traffic you intend to put through it and the more addons you install will increase those requirements.
    – TrueDuality
    May 28, 2009 at 13:36
  • 1
    Well let's say that good hardware makes sure you don't get random crashes... Old PSU tends to be less efficient also. I hate having 15 people's internet connection relying on prehistoric hardware :-)
    – Antoine Benkemoun
    May 29, 2009 at 6:06
1
vote

I would suggest something similar to Antoine, get a nice low-end Dell Server. 2-4GB RAM should be more than plenty. Install SHorewall as a 2 interface bridge on Debian (my Server OS of choice) - Firewall Install Squid and SquidGuard as your proxy and blacklist (can block ads as well, which users like!)

Shorewall will route the traffic and should be set as your machines default gateway. I would also recommend installing Apache on it and serving your proxy details via a proxy.pac, and/or WPAD.dat file if you are a windows house.

0
votes

I expect that a reasonably modern computer (Pentium 4+) with ~1 to 2 GB of RAM should be sufficient to maintain your current user set and expand well for the future. It's ridiculous how many small tasks you can run off of "old" hardware these days, particularly when using a Linux or BSD-based OS. Just keep the non-essential tasks to a minimum (such as a graphical server).

I'd say go pick the operating system that you're most familiar with; they can both handle that job well. BSD probably has less overhead, but if it comes down to "I read about BSD in an article but I have experience with Debian", I'd recommend that you go with the OS you're familiar with. You can always experiment with BSD on a non-production system.

It would probably be easiest if you set the new computer up as both the router and the firewall, but by keeping it as a bridge, you're adding an extra layer of firewall between the users and the web. Either method should be sufficient to handle the bridging and web content filter you need.

2
  • Thank you for that precise answer ! I'm more confortable with Debian. So, I try with this OS.
    – Kortex786
    May 28, 2009 at 13:24
  • Using this method is a fun/challenging method but most likely won't be as reliable as PFsense.
    – Antoine Benkemoun
    May 29, 2009 at 6:08
0
votes

As an alternative to "rolling your own", consider the appliance vendors. Over the years, I used a number of "White Box" distributions and been quite satisfied.

http://en.wikipedia.org/wiki/List_of_Linux_router_or_firewall_distributions

There are two big benefits to you:

  1. These purpose built distributions take a lot less of your time to get locked down and running

  2. Management drudgery can be handed off more easily

The distributions I have seen clearly state the minimum requirements for your white box. Go 1.5x to 2x those recommendations.

0
votes

I would recommend using OpenBSD as the OS since it includes an excellent firewall application (pf). For the proxy/webfilter, I would use Squid, which can be built from the ports tree very easily.

The advantages of pf are that it's easily one of the most robust firewall packages out there, with traffic shaping/prioritization. And OpenBSD is arguably one of the most secure of the OpenSource *nixes.

Your hardware requirements won't be very high with the number of users and the Internet connection you've specified. Any recent workstation with the appropriate number of interfaces will be more than adequate. In fact, buying two cheap systems would let you take advantage of the built in failover available with OBSD and pf.

0
votes

You can always run a hardware firewall. I've used them in the past, look into Netgear's FVS338 or FVX538, they seem very cheap and can do most of the things you want to run. You'd hook up your ISP to the WAN port and then run a connection from the Netgear's LAN to your switch.

Hope this helps

0
votes

Unless you are doing real contentfiltering ala dansguardian, you will not be able to find PC hardware that won't hack that. My old SmoothWall on my home net was a P3-266/256Mb of RAM! As has been said any entry level server will do, HP ML110 or something?

0
votes

Untangle (a linux distro from www.untangle.com) running on a relatively new box (dual core with 1GB RAM) is a great option.

0
votes

Untangle seems to be the best to solve my problem. There are hardware requirements on the web site, but I wonder if there are some special hardware that will be better in a router mod ? Special NIC or MotherBoard ?

1
  • Avoid nvidia NICs, theyre pretty naff. Intel ones work well - if a little uninspiring :) If you're doing loads of VPN, h/w crypto would be "fun" - but its literally that - just for fun - in most applications.
    – Tom Newton
    Jun 10, 2009 at 14:12
0
votes

So based on your description, you need: firewall => cpu usage, proxy = ram/disk, web content filter = cpu usage I think every standard server with 2ghz and 2gb ram sould be enough.

0
votes

I have experience of running 20 users through exactly such a home grown system using OpenBSD, with the cheapest Athlon64 processor available, 1GB of ram (because 512mb was more expensive...) and two network cards. My previous experience had been with Linux, but i used OpenBSD for this as its security track record is impressive. Expect a bit of a learning curve with your pf.conf file.

The PC has been rock solid stable, with no hints of a performance bottleneck.