Firewall reccomendations - a few colocated servers behind a firewall

Question

I have to set up a few servers (4 right now, more in the future) behind a firewall. The data center would like to provide a single port with a block of IP addresses, and then I'll have the firewall forward the correct IP address to the correct server.

What are your recommendations for a reasonable firewall?

Some additional notes:

• All servers are low-traffic web servers.
• The connection to the data center network is gigabit, and I'm on a 6mb burst cap.
• I don't want something insanely hard to admin. I'm used to pfSense, which is very nice, but I'd rather not stick a whole additional 1U server in there for pfSense at this time.
• I'll be allocated a block of 8 or 16 IP addresses to be distributed among the servers.
• I'm not made of money, so please don't recommend anything $$$$$$$

Answer 1

Not sure what you expect that won't take up any rack space. :) But, you don't need a full 1U box to run pfSense. The little ALIX kits would suffice, and they come pre-installed. http://www.netgate.com/index.php?cPath=60%5F84

That's probably the smallest footprint box you're going to find that's truly suitable for a hosting environment, it's even smaller than your average SOHO Linksys/DLink/etc. There are people running pretty decent loads through those. Heck, we got Slashdotted on a web server behind a WRAP (the ALIX predecessor, 1/3rd its capacity) running pfSense and the site stayed up 100% of the time, and was as responsive as any other day.

If you need less than ~75,000 active simultaneous connections, and under ~85 Mbps of throughput, the ALIX is perfectly fine. It takes a huge amount of web traffic to get to that point, so that would be fine for you.

Answer 2

There is always the possibility of just using each computer's built-in firewall rather than a separate appliance.

If you are set on a firewall, the Netscreen line will probably do what you want -- even the entry-level SSG5 will do for "light" usage (up to 8K simultaneous connections), going up from there depending on your needs. However it is a hardware unit, which means you'll still need to find space in your rack for it.

Answer 3

There are some other advantages of having a gateway to your co-located computers. Whether it's an appliance of some sort or a computer.

Most gateway appliances use VIP's to expose the services behind the firewall. Most of these allow some simple load balancing between multiple computers inside the firewall. This makes managing your external IP addresses a little easier and in a pinch you can easily point traffic to a different computer internally.

From a security point of view most gateway appliances also have other functionality. So you can also run IDS, anti-x (spam, virus, malware). It will let you setup a VPN tunnel to access management interfaces without having to expose them to the internet. If your servers need segmentation it will also give you the ability to setup separate vlans with firewalls between.

We've been really happy with the Fortinet devices. They are cheaper and offer more functionality compared to the entry level devices from other vendors. The company was started by the same guy who started Netscreen and sold it to Juniper and they just went public so the company is well funded and healthy.

Answer 4

You could look at small SOHO firewalls\routers from Sonicwall, Netgear, DLink, etc.

http://www.sonicwall.com/us/products/UTM%5FFirewall%5FVPN.html

http://www.netgear.com/Products/RoutersandGateways.aspx

http://www.dlink.com/products/category/?cid=79

Answer 5

Given that any "appliance" in your price range is almost certainly going to be a 1RU server with some sort of firewall software in it anyway, what's wrong with just removing the middleman, installing a 1RU server, and going with what you know?

Edit (under duress): If your DC will charge you less for something that isn't a rack unit, stick an old desktop PC in the rack and put pfsense on that.