1

I have to set up a few servers (4 right now, more in the future) behind a firewall. The data center would like to provide a single port with a block of IP addresses, and then I'll have the firewall forward the correct IP address to the correct server.

What are your recommendations for a reasonable firewall?

Some additional notes:

  • All servers are low-traffic web servers.
  • The connection to the data center network is gigabit, and I'm on a 6mb burst cap.
  • I don't want something insanely hard to admin. I'm used to pfSense, which is very nice, but I'd rather not stick a whole additional 1U server in there for pfSense at this time.
  • I'll be allocated a block of 8 or 16 IP addresses to be distributed among the servers.
  • I'm not made of money, so please don't recommend anything $$$$$$$
Improve this question
2
  • What is "insanely hard to admin"? OpenBSD's PF is a solid, low cost alternative (used by F5 iirc, or used to).
    – OMG Ponies
    Nov 20, 2009 at 21:21
  • What's also not clear to me is if the IPs on the webservers are visible to the internet (not behind NAT). If so, you'll want to use a transparent firewall: dalantech.com/fusionbb/showtopic.php?tid/71026
    – OMG Ponies
    Nov 20, 2009 at 21:23

5 Answers 5

Reset to default
5

Not sure what you expect that won't take up any rack space. :) But, you don't need a full 1U box to run pfSense. The little ALIX kits would suffice, and they come pre-installed. http://www.netgate.com/index.php?cPath=60_84

That's probably the smallest footprint box you're going to find that's truly suitable for a hosting environment, it's even smaller than your average SOHO Linksys/DLink/etc. There are people running pretty decent loads through those. Heck, we got Slashdotted on a web server behind a WRAP (the ALIX predecessor, 1/3rd its capacity) running pfSense and the site stayed up 100% of the time, and was as responsive as any other day.

If you need less than ~75,000 active simultaneous connections, and under ~85 Mbps of throughput, the ALIX is perfectly fine. It takes a huge amount of web traffic to get to that point, so that would be fine for you.

Improve this answer
2
  • Incidentally, how about VPN? Curious if one of the ALIX units would hold up for us with 4 or 5 OpenVPN server instances running on pfSense over a fairly low-bandwidth (<5mbps) WAN connection. Our current install does fine, but it's on a 2GHz P4 box. Back on topic, +1 for cheap hardware and free software. pfSense is the bee's knees.
    – nedm
    Nov 21, 2009 at 6:43
  • Wow, this is more or less exactly what I'm looking for. Which ALIX box are you using? There appear to be quite a few options on that page, but the hardware specs seem pretty similar. Is the only difference how many PCI/LAN slots they have?
    – Keith Palmer Jr.
    Dec 17, 2009 at 14:03
1

There is always the possibility of just using each computer's built-in firewall rather than a separate appliance.

If you are set on a firewall, the Netscreen line will probably do what you want -- even the entry-level SSG5 will do for "light" usage (up to 8K simultaneous connections), going up from there depending on your needs. However it is a hardware unit, which means you'll still need to find space in your rack for it.

Improve this answer
1
  • Even cheaper would be a netscreen 5gt -- 80mb/s and 8k connections and about $200 on ebay. They even support netscreen 6.2. Instead of buying support, just buy a couple of them...
    – chris
    Nov 20, 2009 at 18:31
0

There are some other advantages of having a gateway to your co-located computers. Whether it's an appliance of some sort or a computer.

Most gateway appliances use VIP's to expose the services behind the firewall. Most of these allow some simple load balancing between multiple computers inside the firewall. This makes managing your external IP addresses a little easier and in a pinch you can easily point traffic to a different computer internally.

From a security point of view most gateway appliances also have other functionality. So you can also run IDS, anti-x (spam, virus, malware). It will let you setup a VPN tunnel to access management interfaces without having to expose them to the internet. If your servers need segmentation it will also give you the ability to setup separate vlans with firewalls between.

We've been really happy with the Fortinet devices. They are cheaper and offer more functionality compared to the entry level devices from other vendors. The company was started by the same guy who started Netscreen and sold it to Juniper and they just went public so the company is well funded and healthy.

Improve this answer
1
  • I miss read that line in your question about pfsense....I agree with what womble said. If you're already comfortable with a solution go with that. Unless you're not happy with pfsense....but any firewall/gateway is going to have some complexity involved.
    – 3dinfluence
    Nov 20, 2009 at 15:38
0

You could look at small SOHO firewalls\routers from Sonicwall, Netgear, DLink, etc.

http://www.sonicwall.com/us/products/UTM_Firewall_VPN.html

http://www.netgear.com/Products/RoutersandGateways.aspx

http://www.dlink.com/products/category/?cid=79

Improve this answer
1
  • I thought about SonicWall too, but their SOHO stuff usually has a concurrent connection limit that might make his situation... undesirable. =)
    – Wesley
    Nov 20, 2009 at 18:00
0

Given that any "appliance" in your price range is almost certainly going to be a 1RU server with some sort of firewall software in it anyway, what's wrong with just removing the middleman, installing a 1RU server, and going with what you know?

Edit (under duress): If your DC will charge you less for something that isn't a rack unit, stick an old desktop PC in the rack and put pfsense on that.

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged .