firewall recommendation

[zerochilly]

Hi, I'm in the market for a new firewall and I'd like to hear the community recommendations.

I have checked out a bunch of hardware firewalls and I think I have narrowed it down to Fortigate and Zyxel. I would like a fully featured hardware firewall that has VPN capabilities so I can connect remotely, but I would also not like to have to purchase a yearly support contract (cisco and fortinet).

I have used a few different manufacturers firewalls in that past, but i have no loyalty to any particular brand. I just need something for my home office and would not like to have to subscribe to something in order to get updates until the product is end-of-life.

My home internet is 100mbps and i have a separate wifi AP. So whatever firewall I get does not need wifi.

What would you all suggest I look into? I really love the fortigate firewalls but I will not spend $300+ for the firewall and then another $250 for a 3-year contract for updates for it. I think I can do much better by purchasing something in the same price range that includes updates, and then purchase some other device in 3 years that will have more features.

Thanks for your help!

 

[Motley]

Ya the fortigate is overkill for home network firewall.

Get an Ubiquiti USG Unified Secure Gateway. I just recently got one, and its great. Its a small package but built well. Plenty fast for your 100mb connection (I have 200mb int).

You can control it with either using ssh CLI, or the Ubiquiti controller web.

What I like about it, is the DPI (deep packet inspection), and the web controller software you can see all the stats. Free updates, no support contract.

Oh and its cheap too, only paid $111 for it. https://www.amazon.com/gp/product/B00LV8YZLK/ref=ox_sc_sfl_title_1?ie=UTF8&psc=1&smid=A2BCS1LJ2I36L4

 

[zerochilly]

excellent, thank you for the recommendation. i have one on the way now

 

[Motley]

excellent, thank you for the recommendation. i have one on the way now

Sweet, let us know what your experience is with it. If you need any config, command help, etc. It runs Linux, but has similar commands to Junos.

After you get it setup.

To create a User based vpn connection. Using the Controller software.

Go to settings, Network. Add new network.

 

[zerochilly]

i'm familiar with linux and bsd just rusty.

i read somewhere that i can put the controller software on an amazon AWS server.... do you know anything about that? Or is it okay to run on one of my pc's at home? if the controller goes down/offline/etc i presume that the firewall retains its config and still works.. fingers crossed!

 

[Motley]

Yes just run the controller software on your pc at home. Its only needed for changes, and monitoring, so everything on the USG will run with your current settings.

Also you can ssh to the USG, without needing the controller software.

 

[RandyG]

What also was helpful for me with learning the USG command line commands is to pull down the Vyatta command line reference. It's based on the Vyatta framework. Not all commands work but quite a few do.

 

[boss6021]

i'm familiar with linux and bsd just rusty.

i read somewhere that i can put the controller software on an amazon AWS server.... do you know anything about that? Or is it okay to run on one of my pc's at home? if the controller goes down/offline/etc i presume that the firewall retains its config and still works.. fingers crossed!

Yes, you can run it on AWS, and yes the config is retained. I currently have my home controller on this exact setup, and it's been flawless.

https://help.ubnt.com/hc/en-us/arti...UniFi-Cloud-Controller-on-Amazon-Web-Services

 

[zerochilly]

well so far i've been impressed with this USG! right now i have the controller running on a windows pc but would like a more permanent solution so maybe AWS is the ticket.

i have not tried setting up the VPN yet but it looks like it should be fairly straightforward.

oh, and for anyone else new to this, my unit came with the Lan1 and Wan1 ports, and a third port (not VOIP like in the docs) for Lan2/Wan2. don't make the mistake and think that even if you configure the port as Lan2, that it means "Lan1, port 2" lol. It took me a while to realize that it's really a whole separate Lan on Lan2....

 

[Motley]

Very nice, glad you like it. Its a pretty nice and cheaper solution than that fortigate you were considering.

Yep those Lan ports are basically like separate vlans.

 

[MrGuvernment]

free - old gear and pfsense or OPNSense

 

[zerochilly]

heh, i thought about pfsense but i decided against it because i knew that i'd be constantly tinkering with it and ultimately have it down more than up lol.

 

[73ChargerFan]

I'm a home user with 75mb/s cable service, and need to upgrade my firewall / router as well. Looking at Ubiquity USG, but the EdgeRouter X is half the price and seems to be more powerful... Reading their forums, it looks like a refresh is coming next month. So much to read!

 

[zerochilly]

I'm a home user with 75mb/s cable service, and need to upgrade my firewall / router as well. Looking at Ubiquity USG, but the EdgeRouter X is half the price and seems to be more powerful... Reading their forums, it looks like a refresh is coming next month. So much to read!

funny you should mention that, i came back just now to post the same thing. wondering what everyone thinks of their EdgeRouter line? the ER lite is still around $100 but does not need the controller app to configure - it has its own web interface and CLI of course. for $100 i'm considering buying it to play with, and putting the USG in my parents' house.