Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am tryig to figure out what would be the best gateway/firewall to host website. As i am a developer not sys admin can't decide on which way to go. Could you please suggest what would be the best?

Below are some options i have considered.

1> Microsoft TMG +All in one, VPN, gateway, firewall, IPS +Hardware scalability +Using this for my corp servers. ?Not sure good option for website firewall, haven't seen any one using it.

2> Cisco +++ -Costly

3> F5 +Great for load balancing ?Looks more for load balancing and ssl offloading but not sure how good of IPS if has any ?Still would require other gateway to vpn etc.

share|improve this question
Should probably be a wiki as its subjective and there's no true answer, just opinions. – KPWINC Aug 6 '09 at 20:46
F5's are cheap on EBay. – djangofan Aug 6 '09 at 21:17
up vote 1 down vote accepted

My experience is almost totally opposite to Cian's:

  • we currently recommend, and deploy, Netscreens for small installations -- SSG-5 firewalls are not too expensive and are really robust, and the Netscreen line scales up from there with more or less the same interface throughout (we've gone as high as a pair of clustered SSG-520 units). The phone and hardware replacement support is really good. Yes, there is a learning curve, but that will be true for anything.
  • the last time we looked at Checkpoint, we paid something ridiculous ($35K?) for something we couldn't make do anything. Support for the Checkpoint was even more. It was a huge loss for us. I can only assume that things have changed in the intervening years.
  • smoothwall is good if you are doing basic firewalling, but for anything remotely complex you are going to end up messing with the iptables rules yourself, at which point I wonder why one would bother with smoothwall.

The one thing I agree with is that PIX boxes are highly priced and extremely complex.

share|improve this answer

If you're stuck on having a firewall, don't go for a Cisco. PIX is amongst the most horrible pieces of software I've ever had the misfortune to deal with. Netscreen is not a whole lot better if you ever get into an anyway complicated set-up.

Checkpoint make some wonderful software, albeit expensive. As enterprise networking software goes it's by far the friendliest I've ever worked with as well. If you're a *nixy person, OpenBSD, with PF is a wonderful solution, that very easily scales to do fail over and the like. It does require a certain amount of work though, and is nothing as friendly as Checkpoint.

share|improve this answer

Using the Linux distro called SmoothWall ( ) is probably the cheapest and easiest.

You could buy a cheap-o $100 computer on EBay and an extra NIC card and your in business.

share|improve this answer
+1 for Smoothwall. I use it both at home and work. Free, easy to set up and manage. – John Gardeniers Aug 6 '09 at 23:42

Really depends on the scale of your website. I have some sites behind a Linksys 54G running DD-WRT with no problems.

share|improve this answer
Correct, but in my case reliability and security is more important as having client data that can't afford to loose open. So need to go for professional grade. – mamu Aug 6 '09 at 21:08

if you want a gui based ipcop is great and supports free openvpn plugins like zerina

if you want to use text based config then shorewall is pretty good - it is also good for securing the web server itself

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.