0

I am tryig to figure out what would be the best gateway/firewall to host website. As i am a developer not sys admin can't decide on which way to go. Could you please suggest what would be the best?

Below are some options i have considered.

1> Microsoft TMG +All in one, VPN, gateway, firewall, IPS +Hardware scalability +Using this for my corp servers. ?Not sure good option for website firewall, haven't seen any one using it.

2> Cisco +++ -Costly

3> F5 +Great for load balancing ?Looks more for load balancing and ssl offloading but not sure how good of IPS if has any ?Still would require other gateway to vpn etc.

2
  • Should probably be a wiki as its subjective and there's no true answer, just opinions.
    – KPWINC
    Aug 6, 2009 at 20:46
  • F5's are cheap on EBay.
    – djangofan
    Aug 6, 2009 at 21:17

5 Answers 5

1

My experience is almost totally opposite to Cian's:

  • we currently recommend, and deploy, Netscreens for small installations -- SSG-5 firewalls are not too expensive and are really robust, and the Netscreen line scales up from there with more or less the same interface throughout (we've gone as high as a pair of clustered SSG-520 units). The phone and hardware replacement support is really good. Yes, there is a learning curve, but that will be true for anything.
  • the last time we looked at Checkpoint, we paid something ridiculous ($35K?) for something we couldn't make do anything. Support for the Checkpoint was even more. It was a huge loss for us. I can only assume that things have changed in the intervening years.
  • smoothwall is good if you are doing basic firewalling, but for anything remotely complex you are going to end up messing with the iptables rules yourself, at which point I wonder why one would bother with smoothwall.

The one thing I agree with is that PIX boxes are highly priced and extremely complex.

1

If you're stuck on having a firewall, don't go for a Cisco. PIX is amongst the most horrible pieces of software I've ever had the misfortune to deal with. Netscreen is not a whole lot better if you ever get into an anyway complicated set-up.

Checkpoint make some wonderful software, albeit expensive. As enterprise networking software goes it's by far the friendliest I've ever worked with as well. If you're a *nixy person, OpenBSD, with PF is a wonderful solution, that very easily scales to do fail over and the like. It does require a certain amount of work though, and is nothing as friendly as Checkpoint.

1

Using the Linux distro called SmoothWall ( http://smoothwall.org/ ) is probably the cheapest and easiest.

You could buy a cheap-o $100 computer on EBay and an extra NIC card and your in business.

1
  • +1 for Smoothwall. I use it both at home and work. Free, easy to set up and manage. Aug 6, 2009 at 23:42
0

Really depends on the scale of your website. I have some sites behind a Linksys 54G running DD-WRT with no problems.

1
  • Correct, but in my case reliability and security is more important as having client data that can't afford to loose open. So need to go for professional grade.
    – mamu
    Aug 6, 2009 at 21:08
0

if you want a gui based ipcop is great and supports free openvpn plugins like zerina

if you want to use text based config then shorewall is pretty good - it is also good for securing the web server itself

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .