What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI
COURSE of the MONTH
13 days, 5 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
IPtables vs commerical firewall
Posted on 2012-12-28
Can anyone tell me the advantage of a commercial Firewall to IPtables?
I understand some of the commercial Firewalls have the ability to block at the application level (facebook, etc). Besides this, I am clueless. Thanks.
I understand some of the commercial Firewalls have the ability to block at the application level (facebook, etc). Besides this, I am clueless. Thanks.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
3 Comments
Commercial firewalls typically come with tons of extra stuff that are actually useful. Off the top of my head, uPnP is a nice one, built in VPN servers, logging, DHCP serving, DNS serving or proxying, etc etc etc. Don't forget a lot of them come with fantastically simple WebGUIs for configuration. Most of the higher end commercial routers come with diagnostic tools built-in as well.
IPtables is really just a basic no-frills firewall. Of course most all the options above could be added to a linux machine running iptables but I would not trust myself to not leave huge security holes when trying to configure it all myself. I believe this is what Untangled OS (based on Debian iirc) is focused around.
If your concern is cost, look up pfSense. It's everything you'd probably ever want in a commercial firewall, but free and open source, based on FreeBSD.
Oh, and the big one. Some commercial firewalls have the ability to subscribe to updates for things like AV scanning or content filtering. I believe Sonicwall and WatchGuard products can do this.
IPtables is really just a basic no-frills firewall. Of course most all the options above could be added to a linux machine running iptables but I would not trust myself to not leave huge security holes when trying to configure it all myself. I believe this is what Untangled OS (based on Debian iirc) is focused around.
If your concern is cost, look up pfSense. It's everything you'd probably ever want in a commercial firewall, but free and open source, based on FreeBSD.
Oh, and the big one. Some commercial firewalls have the ability to subscribe to updates for things like AV scanning or content filtering. I believe Sonicwall and WatchGuard products can do this.
For an opensource solution i also highly recommend iPFire. It is a very good nix based firewall and more Including proxy, content filter, etc.
so you could learn and perfect many avenues of security- AV - IDP- Filters and then update them on a daily basis
or you but something like a Juniper SRX Firewall that does Routing and Switching and FW
and it updates the AV
and runs filters for older attacks
and can run IDP/IDS system
and simplifies the config, mgt and maint with either a 'Slow' gui
or a solid command line
and you can cluster them
can you physically achieve a similiar level - maybe - but I do not have the time or the $ to afford to stay on the VERY top of these issues - when someone else does it for me - very well and costs less in the long run
and yes some of the newest gen controls up to layer 7 and monitor the application and the traffice designated for that application...
like Palo Alto FW
or you but something like a Juniper SRX Firewall that does Routing and Switching and FW
and it updates the AV
and runs filters for older attacks
and can run IDP/IDS system
and simplifies the config, mgt and maint with either a 'Slow' gui
or a solid command line
and you can cluster them
can you physically achieve a similiar level - maybe - but I do not have the time or the $ to afford to stay on the VERY top of these issues - when someone else does it for me - very well and costs less in the long run
and yes some of the newest gen controls up to layer 7 and monitor the application and the traffice designated for that application...
like Palo Alto FW
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Getting to know the threat landscape in which DDoS has evolved, and making the right choice to get ourselves geared up to defend against DDoS attacks effectively. Get the necessary preparation works done and focus on Doing the First Things Right.
In this blog we highlight approaches to managed security as a service. We also look into ConnectWise’s value in aiding MSPs’ security management and indicate why critical alerting is a necessary integration.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Suggested Courses
Course of the Month13 days, 5 hours left to enroll
777 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.