RE: What firewall for small medical research lab

You're going to get some answers that hail back through the holy war of
"OS vs firmware" firewalls.

I worked for a hospital, securing their network.  We used the Cisco PIX
line, and it worked well.  But, Linux or FreeBSD can do anything the PIX
can do, with less expensive hardware to boot.

That said, in both cases, you have to watch your patches.  Cisco has had a
slew of exploits that had to be handled the last few years, just as the
OSs had.

Firmware operating systems simply ship with fewer options that you can
turn on, hence the perception that it's harder to secure the general
purpose OS.  Unfortunately, library exploits (buffer overruns, etc) have
more or less tanked the argument.

What you might consider more than firmware vs OS is this: stateful packet
filter firewall (of your choice) as your outer perimeter.  Then, put a
proxy-firewall inside of that (Borderware, Raptor, etc).  That protects at
two levels of exploits: network and application.

If you have reliable hardware (I'd consider new stuff under warranty) and
the knowledge to build an OS based firewall, do it.  If not, make your
choice based on budget and availability of a consultant to help you.

I'll tell you this, the PIX syntax is simpler than IPTables.  From what
I've heard, the packet filter engine used by FreeBSD is simpler as well.

Whatever you do, restrict your traffic in both directions (which
eliminates your Netgear and Linksys solutions).

Just some thoughts...

Sincerely,

Bryan S. Sampsel
LibertyActivist.org