Rather than wasting your time with unnecessary administration look to either
a Netscreen 5GT which you can get on eBay for approx $400, or buy yourself a
linksys or netgear SOHO firewall. These are going to be substantially less
and will offer you most of the features of the netscreen. With either a
Netscreen, Linksys, or Netgear solution you will be able to get your
firewall up and running in less than an hour.
One thing that many have not mentioned in their replies, with home baked
firewalls you have no vendor support. So depending upon your IT staffing
resources it might be wise to go with a vendor solution.
Netgear/Linksys
Pros: Easy admin, reasonably price sub $200
Cons: Generally no capability for remote VPN access, slower throughput than
Netscreen, allows usually only one IPSEC passthru connection
Netscreen 5GT approx $400
Pros: Highly configurable, GUI administration, allows for VPN remote access.
Good passthru rates for multiple IPSEC outbound connections. Allows for
multiple zones (DMZ, internet, Intranet)
Cons: A little more complicated to configure.
-Spyro
_____
From: Kheno vRs [mailto:vrsnet@gmail.com]
Sent: Thursday, May 04, 2006 1:06 AM
To: rmillisl@millis-it.com
Cc: firewalls@securityfocus.com; security-basics@securityfocus.com
Subject: Re: What firewall for small medical research lab
I prefer m0n0wall, as it can be used on a pc or a hardware device. You can
testrun it and later replace it by a hardware device. On a pc, you just put
in the cd-rom and a floppy disk, boot, answer 3 questions (wich network card
is lan wan, lan ip range, lan subnet) and reboot. Then you can open a
webclient as you are doing with a commercial hardware device. Very easy. I'm
running monowall on a old K6 333Mhz with 96Mb ram and flash hard disk. Using
almost every function, I haven't had any problem configuring nor downtime.
It's based on FreeBSD. The cons of a pc based system is symply the moving
parts. But on a old downclocked cpu you can remove the fans and replace
harddisk with an flash disk.
Netgear is somewhat difficult and I have some serious problems with it at
the moment, so I wouldn't recommmend it. (netgear ng5 - http av engine locks
up the device every 2 day's)
