Recommendation for a Hardware Firewall

[MJD]

Looking for recommendations that for a hardware firewall that can auto-update a IP blacklist from subscription service like iblocklist.com.  Will also accept advice on how to possibly program an update list into a Ubiquiti Edge Router.  Although I would prefer to distribute the firewall tasks to a firewall specific device.  Thanks in advance!

[Jason S. Global Moderator]

we'll need more specifics to help narrow down a recommendation. What is your use-case? How many clients? What throughput? what budget? is this a commercial application? What size business?

[MJD]

Jason, I'm from the Cleveland area as well!  Well Cleveland/Akron area anyways.  To answer your questions, SMB, 200 clients, 1000 Mb, budget - would like to keep it under $3k.  Thanks!

[theefool]

Something like this?  https://community.ui.com/questions/Using-spamhaus-lists/4aa976c1-69eb-4970-85fe-57216c4aebe2

 

[MJD]

10 minutes ago, theefool said:

Something like this?  https://community.ui.com/questions/Using-spamhaus-lists/4aa976c1-69eb-4970-85fe-57216c4aebe2

 

Yes, that is very helpful, thank you!  I still would prefer a stand alone firewall, but will implement this if it comes down to it.  Thanks again!

[Mindovermaster Global Moderator]

If you are familiar with PfSense, you can put that on ANY hardware.

 

But, being a small business, you'd need to pay for it.

 

Isn't there some IT people in your business to help?

[Jason S. Global Moderator]

i think an option from Barracuda or Forcepoint might be in your ballpark. Their lower end models should be sufficient. The real money is not in the hardware, but in the subscription services. You'll want to get their automatic update subs and support.

[+BudMan MVC]

On 16/02/2021 at 11:12, Mindovermaster said:

But, being a small business, you'd need to pay for it.

Huh?  This is not true.. You can run pfsense FREE be it you home user or largest of largest Corporations..

 

Even with the new pfsense+ which is geared more towards business.  There is no cost to this as of yet, and if you have a netgate appliance it is included. And they have stated they will at somepoint release this to non netgate hardware.  Free for home/lab use was mentioned.  But no cost structure has been released if you want to run pfsense+ on your own hardware, and are a business..  So not clear how that will work out.

 

But you can always run the FREE community version on any hardware you have or even their own appliances.  For FREE, be it you have 1 or 100 of them.. Be it a some little tiny old work station pc, or a monster of a box that cost you 10K to build..

 

If you do not want to replace your current firewall.. You could always run pfsense on whatever hardware you have around.  Or purchase one of the netgate appliances.  They start at like $180 for the sg1100 model, which may be enough for what your wanting to do?  Then they ramp up to a $3k device..

 

No matter what you run it on, even a VM for example.  The build in alias system allows you to pull a list of IPs from anywhere you want pretty much to use in your firewall rules.  Or you could use the pfblocker package to help manage lists of IPs or domains or even ASNs to block traffic..

 

I would highly recommend taking a look to pfsense for sure - it should be easy to handle what you have described.

 

Where pfsense currently gets money is from the sale of their appliances, and support contracts for enterprise users..  But there is nothing saying you have to get a support contract or pay for a license for software.  Other than their new TNSR software - which is geared to moving lots of packets.. This is for corps needing to do stuff at 10gig plus, etc..

 

edit: example, I currently use pfblocker for some IP based block lists pulling geoip info (maxmind db) and couple public available lists..

 

pfblocker also has a lot of predefined lists you can pick and choose from if you want..

 

 

That is just the very top of the list of feeds you can choose from... Listing them all would be a very long image

 

[Mindovermaster Global Moderator]

35 minutes ago, BudMan said:

Huh?  This is not true.. You can run pfsense FREE be it you home user or largest of largest Corporations..

 

Even with the new pfsense+ which is geared more towards business.  There is no cost to this as of yet, and if you have a netgate appliance it is included. And they have stated they will at somepoint release this to non netgate hardware.  Free for home/lab use was mentioned.  But no cost structure has been released if you want to run pfsense+ on your own hardware, and are a business..  So not clear how that will work out.

 

But you can always run the FREE community version on any hardware you have or even their own appliances.  For FREE, be it you have 1 or 100 of them.. Be it a some little tiny old work station pc, or a monster of a box that cost you 10K to build..

 

If you do not want to replace your current firewall.. You could always run pfsense on whatever hardware you have around.  Or purchase one of the netgate appliances.  They start at like $180 for the sg1100 model, which may be enough for what your wanting to do?  Then they ramp up to a $3k device..

 

No matter what you run it on, even a VM for example.  The build in alias system allows you to pull a list of IPs from anywhere you want pretty much to use in your firewall rules.  Or you could use the pfblocker package to help manage lists of IPs or domains or even ASNs to block traffic..

 

I would highly recommend taking a look to pfsense for sure - it should be easy to handle what you have described.

 

Where pfsense currently gets money is from the sale of their appliances, and support contracts for enterprise users..  But there is nothing saying you have to get a support contract or pay for a license for software.  Other than their new TNSR software - which is geared to moving lots of packets.. This is for corps needing to do stuff at 10gig plus, etc..

 

edit: example, I currently use pfblocker for some IP based block lists pulling geoip info (maxmind db) and couple public available lists..

 

pfblocker also has a lot of predefined lists you can pick and choose from if you want..

 

That is just the very top of the list of feeds you can choose from... Listing them all would be a very long image

 

I thought it was free for home use, but wasn't for small-to-large business use. Guess I was wrong.

 

Anyway, follow what he says. ^

[+BudMan MVC]

^ many a company running pfsense.. All free - unless they get a support contract.  We run a few of their 3100's and a older 2440 in some branch locations.. Other than the cost of the box - there is no other cost.

[Mindovermaster Global Moderator]

1 hour ago, BudMan said:

^ many a company running pfsense.. All free - unless they get a support contract.  We run a few of their 3100's and a older 2440 in some branch locations.. Other than the cost of the box - there is no other cost.

Oh, OK. Support only, got it.