Firewall/VPN/Router for a dedicated webserver

Question

We are collocating a dedicated web server and a database server and need to put them behind a firewall/router.

The router should also allow VPN connection to it so we can easily reach and manage the servers behind it.

Assuming that the traffic on the site will reach 10,000 daily visitors in the first 6 months, what kind of router we should choose?

Can a low end router support this traffic or the number of visitors have a big impact on the choice of router?

Do you have any suggestion? Can you suggest a few routers and tell me why they are suitable for this?

Your help is really appreciated :)

Answer 1

You want a router or a firewall? I'm confused! I don't think that word means what you think it does.

I think you're looking for a firewall. The Cisco RV042 "Dual WAN" is "prosumer" gear, at best. Further, I don't see why you'd want "dual WAN" functionality if you've got a single connection from the co-lo provider.

The Cisco ASA-5505 (see http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product%5Fdata%5Fsheet0900aecd802930c5.html) is a fairly capable little firewall, and is spec'd at supporting traffic flows of 150Mb/sec (though I've never benchmarked it). It'll fit within your budget, though you're going to want to get SMARTnet coverage (renewed annually) if you intend to get relacement / support if it fails. It will terminate user-to-site and site-to-site VPN tunnels with a variety of protocols.

Ultimately, the specific configuration of your firewall device (and server computers behind it) is going to determine "how secure" you are. You can't buy "security" by putting in some device / program / system. You need to turn off unneeded services, use strong authentication mechanisms, limit connectivity to administrstive interfaces to trusted source addresses, log the heck out of anomalous traffic, configure your server software and applications in a secure manner, and continue investing in staying current with patches, updates, and configuration. You can't wave a magic wand and "be secure".

Answer 2

I agree with Evan in that you may not be aware of just what a router is.

A simple, yet extremely effective, solution is one of the Open Source firewalls, such as Smoothwall (my personal choice). It will provide the firewall and VPN facilities you require. With the Guardian add-on you can have a fully reactive, rather than passive, firewall. As for scale, it depends on what hardware you decide to use for it.

Whichever way you go you need to be aware that security systems are like antivirus software. You can't just install it and expect it to do its job properly. It will need to be maintained and updated. If you are not in a position to handles this on your own seek expert advice (as in get someone to do it for you).