Firewall or router, which comes first

I have a very general question. Consider the following network layout examples:

Internet<-->Router<-->Firewall<-->Private Network


Internet<-->Firewall<--->Router<--->Private Network

Which of this setups is the best reccommended setup?

I am thinking that the second setup will easily allow you to connect another router and add another subnet onto the network without interefering with the server configurations. You can also comfortably point the gateway of all machines to be the router.

I use the first setup at my organization and becaue of this the router has no private IP address, so cannot use it as a GW on the clients.

Maybe slightly related to an earlier question but just asking. All answers earn points.

Who is Participating?
aaronblumConnect With a Mentor Commented:
I would recommend the second configuration since that should provide the most protection for your network.  This configuration will help shield your router from external attacks and decrease the size of your attack surface.
Agreed also turn off external pings so no one even knows you are there.
jimmyray7Connect With a Mentor Commented:
The second setup will allow you to have a Gateway on the private network.  If you have more questions, post what type of devices these are and we can dig a little deeper.
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

JMarewaAuthor Commented:
Great. I forgot to add one device, the satellite modem. See below and let me know if it makes a difference in your reccomendations.

Internet<-->Satellite Modem<-->Router<-->Firewall<-->Private Network


Internet<-->Satellite Modem<-->Firewall<--->Router<--->Private Network

No major difference here, though I would advise making sure that you keep the firmware on the modem updated if that is within your technical capabilities as it must be outside the firewall.
pony10usConnect With a Mentor Commented:
Our set up at work:

Internet provider <---> edge router <---> firewall  <---> IPS <---> layer 3 switch <---> router <---> internal network

I think the method pretty much is dependent on the abilities (brands) of the equipment and the configurations.
The preferred setup may depend on what exactly your router does. Your doubts about whether to put it in front of the firewall or after it makes be think you may not need it at all.
fs40490Connect With a Mentor Commented:
Well as you know either will work.  As for the best depends on what you are looking for.  So does your firewall have more than just 2 interfaces?  If so you may be able to support a second interface to stand up an additional internal network.  This helps to alleviate the need of a router internal to the network.

I personnally like to have a router in front of the firewall.  This way I can actually support basic layer 3 filtering to help offload some of the unnecessary processing from the firewall.  

Ideally you would have an additional router in this scenario.  With that configuration it would be:

ISP --> router --> FW --> router --> Internal LAN

Of course as pony outlines it would be nice to have additional security gear available also, mainly IPS.  Again the thought being that not only it will help to prevent attacks, these devices also help to alleviate some of the processing other devices need to do.
Fred MarshallPrincipalCommented:
Some common devices just combine the two functions into one box.  
Juniper Networks implements what they call "virtual routers" on each "zone" with the firewall in between the trusted and untrusted zones.

So, you could take a hint from their architecture.

In fact, if there were a reason, you could have routers in front of and behind the firewall with separate roles.  But, I can't think of much of a role between the modem and the firewall actually.
JMarewaAuthor Commented:
Thank you all guys. Much appreciatted.
JMarewaAuthor Commented:

I meant to award point equally and then close the question. I am not meant to close the question. Please let me know. I am a bit new at this.

Cancel auto-close.

- thermoduric -
EE Community Support Moderator
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.