hardware for firewall

B

blarg

Limp Gawd
Joined
Jul 19, 2009
Messages
140
I'm planning on switching from a Sonicwall firewall / router to a Linux based appliance. I'm looking at what hardware to use for this. Right now I'm aiming at a 1U pizza box server with plenty of CPU and Memory to support VPN connections and VLANs.

Would most of you go with a solid state drive instead of a regular HDD? My second question are there other options for the hardware I ought to look at, like an appliance type box instead of a regular server?
 
cyr0n_k0r said:
Are you ruling out Cisco ASA's for any particular reason?
Click to expand...

I already have a firewall that requires a new license fee for every feature I want to use. I'm going open source on generic hardware that can be imaged from any X86 box to another.
 
SSD is not necessary as RAM and CPU is mostly used for its functions.

We use a combination of ISA and Watchguard for our VPNs. I know that is not the answer you are looking for, but just to give you an idea what others use.

You do not need a high powered computer for a firewall even with VPN, but you did not specify what services you will be running or the amount of concurrent connections which is all needed to make an educated decision.
 
First...what distro are you considering?
I use the enterprise grade drives if I can, WD or Seagates upper models.
 
YeOldeStonecat said:
First...what distro are you considering?
I use the enterprise grade drives if I can, WD or Seagates upper models.
Click to expand...

I'm considering PFsense, Endian or Smoothwall. I need to support IPS, 1 - 5 VLAN's about 20 VPN users and it will be doing content filtering for 200 connections. It's gonna have to do NAT translation for video conferencing and it's possible that I might do my 200 connections as proxy connections if I can get whatever firewall to talk to Active Directory for content filter reporting. Running a DMZ will be part of the config as well.

I don't want to go too small on this box because it will be on a 5 year upgrade cycle and needs to last a while and be robust enough for new services.
 
horndog said:
distro is not as important as the user configuring it :)
Click to expand...

Depends what his needs are. What if the distro doesn't support some of his companies needs? Also some distros support running on this and that for hardware, while others do not.

So taking into consideration the selected distro...you can then move onto hardware that the distro has a proven track record of supporting. And select your hardware according.

Also taking into consideration the bandwidth, number of users, and other services the distro will be providing.

When you go shopping for shoes...you don't just go and pickup any old shoe that's on the shelf...you select one that's designed for what you need (sneaker, workboot, hiking, etc)...and you select one that fits you properly (not some kids size 5 if you're a 6 foot 6 grown male)
 
blarg said:
I'm planning on switching from a Sonicwall firewall / router to a Linux based appliance. I'm looking at what hardware to use for this. Right now I'm aiming at a 1U pizza box server with plenty of CPU and Memory to support VPN connections and VLANs.

Would most of you go with a solid state drive instead of a regular HDD? My second question are there other options for the hardware I ought to look at, like an appliance type box instead of a regular server?
Click to expand...

Based on your first post and second post later in the thread, I recommend the one-two punch of pfSense and Untangle in transparent mode. It'll require two boxes, but is very secure and gives you all the reporting you could want.

The pfSense box doesn't need to be very powerful but the Untangle one does.

You mentioned a 1U server but no other parameters. So I don't know if cost, low power or low noise are priorities. Without those factors, I'd say just buy a couple Dell or HP 1U servers and be done with it.

If you want your servers to be....well, more "open source" as well, then you could consider some Supermicro boards and cases from NewEgg. I've also had good luck with IDOTpc.com, or Logic Supply for smaller stuff.
 
I'll 2nd what Valnar is suggesting. 2 Servers one with Pfsense as the gateway and untangle in bridge mode. The only thing I wish untangle would do is VLANs


And will also say to invest in the super micro servers. They are not bad servers for what they need to run.
 
Last edited:
I've got a couple of these in production running pfSense. They do well, though I'm not using content filtering, so you may want to increase the RAM & CPU for that:

SUPERMICRO CSE-503-200B
SUPERMICRO MBD-PDSBM-LN2+-O
Celeron E1200
Kingston 1GB DDR2 ECC

Pretty inexpensive, half-depth 1U, Intel onboard NICs, the perfect firewall box ;). If you're doing a lot of VPN, an accelerator card might be a worthwhile addition.

I would normally recommend the ALIX boards, but I don't think they're up to the task of content filtering or heavy VPN (though you can add a miniPCI accelerator for that).
 
These are great answers guys thanks for all the responses. As far as the hardware requirments question goes I can get away with something thats up to 3U tall. Power noise and price really arnt a huge issue on this. I'm thinking my max price would be around 4k

I'm going to start looking at untangle. Another suggestion someone gave me was to use firewall builder and export to Linux and just use straight up IPchains. Has anyone tried this, it sounds like a lot more administration than an appliance type distro so I'm probably going to rule it out.
 
blarg said:
These are great answers guys thanks for all the responses. As far as the hardware requirments question goes I can get away with something thats up to 3U tall. Power noise and price really arnt a huge issue on this. I'm thinking my max price would be around 4k

I'm going to start looking at untangle. Another suggestion someone gave me was to use firewall builder and export to Linux and just use straight up IPchains. Has anyone tried this, it sounds like a lot more administration than an appliance type distro so I'm probably going to rule it out.
Click to expand...

I used fw builder and just hated it.. That was because I don't have a good grasp on how to use linux in ip chains. Use a distro.. It writes all of that for you without having to learn something.


http://www.newegg.com/Product/Product.aspx?Item=N82E16816101262

Here is a super micro I've been keeping my eye on. Max one of them out at 2 gb for untangle and the other one you could do in 1 gb or less for pfsense..

Someone else chime in and put your thoughts in, but that is my 2 cents
 
If you want to do it 'by hand', I'd suggest the Shorewall scripts. Lots of functionality, nice configuration files and they work well.

But like the others, I prefer the appliance approach.
 
Another vote for pfsense here. I was a smoothwall user, but I wanted to move to newer hardware and pfsense was a great fit.
 
blarg, I know that Iron Systems sells some servers that are based on Supermicro boards and use the Supermicro cases too. You just pay a little more to basically have them put it together for you. The AR series would be perfect for a firewall.

keenan said:
I've got a couple of these in production running pfSense. They do well, though I'm not using content filtering, so you may want to increase the RAM & CPU for that:

SUPERMICRO CSE-503-200B
SUPERMICRO MBD-PDSBM-LN2+-O
Celeron E1200
Kingston 1GB DDR2 ECC
Click to expand...
keenan, Any idea of how much power that setup uses? I'm looking at upgrading my ALIX board for home.
 
You must log in or register to reply here.
Back
Top