Sunday, March 9, 2008

Which is the BEST hardware Router/Firewall to monitor in/out traffic?

Post Made By YeOldeStonecat over at wilderssecurity.com:

Or if you want something with a bit more power, build yourself a *nix distro router...take a mid-range P3 or higher, with 2x NICs...and install one of the many *nix router distros out there.

There are many of them out there...some stronger in certain areas than others, and a growing number that bring full UTM features (Unified Threat Management). These UTM features are the ones I'm really interesting in..and using at a few clients with good success. The UTM distros add antivirus scanning of all web, mail, and ftp traffic, as well as spam removal of web traffic. Some add ad/spyware blocking of browser traffic as well. And beefier intrusion detection via Snort.

Some of the basic *nix router distros....

IPCop...one of the more popular ones, has a big development/support community with lots of add-on packages.
You can add UTM functionality to it with the add-on called Copfilter

m0n0wall

Smoothwall

pfSense...built on m0n0wall...with stronger QoS features

Clark Connect is a cool distro for a small business, sort of an open source *nix version of Microsoft Small Business Server

vyatta

For some of the UTM distros....in addition to the Copfilter build of IPCop listed above....

Endian...one of my favorites..built on top of IPCop..with the features of Copfilter...bundled into one tight package

Comixwall

Astaro

Untangle...this one is fantastic...I've built a few...using them in production...very powerful. Lots of features...even blocking of IM traffic and peer to peer traffic.

On the basic distros...all you need is an older PC...P2 or so, moderate RAM, a pair of NICs..and you're good to go. For the UTM distros..you want a bit more power...mid range or higher P3, 512 megs of RAM...Untangle likes to go above 1.0GHz and a gig of RAM.


Well I guess I have even more options to check out now.....

No comments: