Hardware firewall - how to buy?

Posted on 2004-10-16
Medium Priority
Last Modified: 2013-11-16
I am looking to buy a firewall, but I have no clue how to choose one. I do not want a software firewall since I plan to have a server. I want a hardware firewall immediatly following by DSL connection so everything is blocked accept what I want. My needs are basic: I do not want VPN, and I do not plan to have VPN ever. I just want a hardware firewall to block everything accept port 80 (for a website on my server), port 1494 (I believe that is the port for a Citrix client - like www.gotomypc.com). Maybe even allow FTP for authorized users only, but that is all. Spam blocking and virus scan a plus, but I already run A-V on my machines, and I never accept e-mails with attachments - period. I am not firewall savy, so please take that into concideration. I have already looked at the Cisco and Watchguard websites, but they all seem like overkill for what I need.

Any suggestions would be helpful. Basically looking to lock down everything comming in accept for what I want to allow while still having a web server (no e-commerse) - and of course still be able to surf the net.

Question by:sofsoldier
  • 2
  • 2
LVL 79

Expert Comment

ID: 12332548
Take a look at some of these firewall appliances. Any one of them would suit you well. I particularly like the Cisco PIX 501, and the Linksys RV082.
Low-end firewall appliances

Linksys RV082:


Adtran Netvanta


Watchguard Firebox

PIX 501

D-LINK w/DMZ port

On the other hand, you might be just as well served with a basic broadband router. Most all of them include stateful packet inspection firewall and let you forward specific ports. Some even help enforce AV use. I personally use Linksys WRV54G because I need the VPN functions and the wireless. $50 will get you something like this: http://www.linksys.com/products/product.asp?grid=34&scid=29&prid=433
Just saw an add that would get you a D-Link for $9.99 (after instant savings, plus mail in rebates)

Author Comment

ID: 12334064
You did sme research - I appreciate it. Is there any reason why Netgear or Symantec was not a part of your list?

Also, the lower end Linksys, Netgear, D-Link all have the packet filtering and DOS protection, and feature some basic VPN and IpSec; what would be the difference between these and say the Cisco Pix 500, or teh Watchguard series?

Forgeting VPN, is AV imbedded in the firewall a good thing to have even though AV is running on all the machines on the network? And is there a dfifference is quality in the SPI or DOS protection between the low cost models and the more expensive ones?

Thanks again,
LVL 79

Accepted Solution

lrmoore earned 2000 total points
ID: 12335264
I've never had good luck with Netgear, and the Symantec gateway products are good, but they combine anti-virus and firewall, and  I thought it might be more than you need.

The Cisco PIX has very different capabilities and uses a proprietary Adaptive Security Algorithm vs stateful inspection. It also has VPN capabilities (with client) that none of the others can match. It also has built in intrusion detection and DoS protection that most others don't. You can also create multiple public IP to private IP static nat mappings where many others only allow you one single public IP and you must use individual port mapping. Not good if you have two web servers, both needing port 80..

I'm a firm believer in letting individual products do their job. I don't like the idea of putting all your eggs in one basket. It just adds too much complexity to the box and creates more single points of failure..

I don't know enough about all the products to address their SPI capabilities but the higher cost "firewall" products usually have more configuration capabilities than the others. With some it's binary - on or off, no configuration...

You have to balance your budget with your requirements. Don't spend $1000 on something when the value of what you want to protect isn't worth that much.

Author Comment

ID: 12336139
The Cisco sounds great. Also, since I do have wireless as well, I did find the Watchguard SOHO 6 wireless very interesting.

I will eventually have two websites, and I actually did not think about the NAT capabilities of some of the other products.

Thank you,

Featured Post

NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
To export Lotus Notes to Outlook PST or Exchange and Domino Server files to Exchange Server or PST files with ease, go for Kernel for Lotus Notes to Outlook conversion tool. Through the video, you can watch the conversion process. A common user with…

569 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question