Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to set up a few servers (4 right now, more in the future) behind a firewall. The data center would like to provide a single port with a block of IP addresses, and then I'll have the firewall forward the correct IP address to the correct server.

What are your recommendations for a reasonable firewall?

Some additional notes:

  • All servers are low-traffic web servers.
  • The connection to the data center network is gigabit, and I'm on a 6mb burst cap.
  • I don't want something insanely hard to admin. I'm used to pfSense, which is very nice, but I'd rather not stick a whole additional 1U server in there for pfSense at this time.
  • I'll be allocated a block of 8 or 16 IP addresses to be distributed among the servers.
  • I'm not made of money, so please don't recommend anything $$$$$$$
share|improve this question
    
What is "insanely hard to admin"? OpenBSD's PF is a solid, low cost alternative (used by F5 iirc, or used to). –  OMG Ponies Nov 20 '09 at 21:21
    
What's also not clear to me is if the IPs on the webservers are visible to the internet (not behind NAT). If so, you'll want to use a transparent firewall: dalantech.com/fusionbb/showtopic.php?tid/71026 –  OMG Ponies Nov 20 '09 at 21:23

5 Answers 5

up vote 5 down vote accepted

Not sure what you expect that won't take up any rack space. :) But, you don't need a full 1U box to run pfSense. The little ALIX kits would suffice, and they come pre-installed. http://www.netgate.com/index.php?cPath=60%5F84

That's probably the smallest footprint box you're going to find that's truly suitable for a hosting environment, it's even smaller than your average SOHO Linksys/DLink/etc. There are people running pretty decent loads through those. Heck, we got Slashdotted on a web server behind a WRAP (the ALIX predecessor, 1/3rd its capacity) running pfSense and the site stayed up 100% of the time, and was as responsive as any other day.

If you need less than ~75,000 active simultaneous connections, and under ~85 Mbps of throughput, the ALIX is perfectly fine. It takes a huge amount of web traffic to get to that point, so that would be fine for you.

share|improve this answer
    
Incidentally, how about VPN? Curious if one of the ALIX units would hold up for us with 4 or 5 OpenVPN server instances running on pfSense over a fairly low-bandwidth (<5mbps) WAN connection. Our current install does fine, but it's on a 2GHz P4 box. Back on topic, +1 for cheap hardware and free software. pfSense is the bee's knees. –  nedm Nov 21 '09 at 6:43
    
Wow, this is more or less exactly what I'm looking for. Which ALIX box are you using? There appear to be quite a few options on that page, but the hardware specs seem pretty similar. Is the only difference how many PCI/LAN slots they have? –  Keith Palmer Dec 17 '09 at 14:03

There is always the possibility of just using each computer's built-in firewall rather than a separate appliance.

If you are set on a firewall, the Netscreen line will probably do what you want -- even the entry-level SSG5 will do for "light" usage (up to 8K simultaneous connections), going up from there depending on your needs. However it is a hardware unit, which means you'll still need to find space in your rack for it.

share|improve this answer
    
Even cheaper would be a netscreen 5gt -- 80mb/s and 8k connections and about $200 on ebay. They even support netscreen 6.2. Instead of buying support, just buy a couple of them... –  chris Nov 20 '09 at 18:31

There are some other advantages of having a gateway to your co-located computers. Whether it's an appliance of some sort or a computer.

Most gateway appliances use VIP's to expose the services behind the firewall. Most of these allow some simple load balancing between multiple computers inside the firewall. This makes managing your external IP addresses a little easier and in a pinch you can easily point traffic to a different computer internally.

From a security point of view most gateway appliances also have other functionality. So you can also run IDS, anti-x (spam, virus, malware). It will let you setup a VPN tunnel to access management interfaces without having to expose them to the internet. If your servers need segmentation it will also give you the ability to setup separate vlans with firewalls between.

We've been really happy with the Fortinet devices. They are cheaper and offer more functionality compared to the entry level devices from other vendors. The company was started by the same guy who started Netscreen and sold it to Juniper and they just went public so the company is well funded and healthy.

share|improve this answer
    
I miss read that line in your question about pfsense....I agree with what womble said. If you're already comfortable with a solution go with that. Unless you're not happy with pfsense....but any firewall/gateway is going to have some complexity involved. –  3dinfluence Nov 20 '09 at 15:38

You could look at small SOHO firewalls\routers from Sonicwall, Netgear, DLink, etc.

http://www.sonicwall.com/us/products/UTM%5FFirewall%5FVPN.html

http://www.netgear.com/Products/RoutersandGateways.aspx

http://www.dlink.com/products/category/?cid=79

share|improve this answer
    
I thought about SonicWall too, but their SOHO stuff usually has a concurrent connection limit that might make his situation... undesirable. =) –  Wesley Nov 20 '09 at 18:00

Given that any "appliance" in your price range is almost certainly going to be a 1RU server with some sort of firewall software in it anyway, what's wrong with just removing the middleman, installing a 1RU server, and going with what you know?

Edit (under duress): If your DC will charge you less for something that isn't a rack unit, stick an old desktop PC in the rack and put pfsense on that.

share|improve this answer
    
@womble: you've posed a question to his question and not an answer. This would have been better as a comment to his question. –  joeqwerty Nov 20 '09 at 15:15
    
I don't have enough space/cash for another entire 1U, so this isn't an option. –  Keith Palmer Nov 20 '09 at 15:26
    
@joeqwerty: No, it's answer in the form of a question. @superwormy: Any hardware is going to cost you a at least a rack unit to house. –  womble Nov 20 '09 at 15:38
    
@womble: No, it's not going to. Do you house servers in the same data center I do? I guess not, you don't even know what data center it is. I am being charged a separate fee if it's a small appliance vs. a full 1U. –  Keith Palmer Nov 20 '09 at 16:06
    
My, aren't we defensive. Perhaps you should edit your question to accurately describe your requirements, if you're going to get shirty every time someone makes a reasonable assumption. –  womble Nov 20 '09 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.