Slashdot Mirror
Ask Slashdot: Advice On Building a Firewall With VPN Capabilities?
An anonymous reader writes "I currently connect to the internet via a standard router, but I'm looking at bulking up security. Could people provide their experiences with setting up a dedicated firewall machine with VPN capabilities? I am a novice at Linux/BSD, so would appreciate pointers at solutions that require relatively little tweaking. Hardware-wise, I have built PC's, so I'm comfortable with sourcing components and assembling into a case. The setup would reside in my living room, so a quiet solution is required. The firewall would handle home browsing and torrenting traffic. Some of the questions knocking around in my head: 1. Pros and cons of buying an off-the-shelf solution versus building a quiet PC-based solution? 2. Software- versus hardware-based encryption — pros and cons? 3. What are minimum requirements to run a VPN? 4. Which OS to go for? 5. What other security software should I include for maximum protection? I am thinking of anti-virus solutions."
This will let you connect to vpns and such http://www.buffalotech.com/products/wireless
or for a more geek solution https://www.pfsense.org/
Do you regularly remote in to your home network? Do you connect out to a server somewhere? If not, then setting up a VPN isn’t going to give you much (well technically it won’t give you anything). If so, your specific use case (which was not provided) matters.
As for software, one of:
- Throw your linux on there (I like Gentoo hardened) and roll your own with OpenVPN and other assorted tools (I like shorewall as an iptables frontend).
- pfSense if you’ve got a decent box and want bells and/or whistles
- m0n0wall if you want something light but functional
You might also want to consider routerboard, it’s cool shit and reasonably priced.
That was easy.
Sig withheld to protect the innocent.
Get a router compatible with OpenWRT (Netgear WNDR3800 is a good choice) and install OpenVPN.
www.amazon.com/gp/product/B00CPRVF5K
With US internet speed growth as it is, that router will last you for a decade.
A VPN? To connect to where, from where? Are you doing this for something to do, or because you want to implement the best solution? Do you just want better router software?
Install Tomato or DD or OpenWRT or any one of their variants on your existing router.
Building your own in the name of security isn't going to work unless you really know what you're doing, which you said you don't in your summary. That sounds like a dick thing to say, but it's not. Security is difficult for people that know what they're doing, when people who don't try to DIY it, it's almost universally bad.
Keep on knockin'
https://robbiecrash.me
Try
http://www.ipcop.org/
I have used pfSense running on a PC Engines Alix board for a few years now. There is a good community behind pfSense, along with a commercial entity if you want to pay for support. It supports both IPSec and OpenVPN.
pfSense has minimal requirements for hardware. I'm using an Alix 2D13, which has a 500Mhz AMD CPU with 256MB of RAM. I went with the Sokris VPN Accelerator card to offload the VPN. The newer version of the Alix board, the APU1C, no longer needs the VPN accelerator.
freebsd network engine, openbsd packet filter
can't lose
https://www.pfsense.org/
The price is right, and you can install it on just about anything including ALIX boards https://blog.pfsense.org/?p=155 , which is what I happen to use.
Buy a Ubiquiti EdgeRouter Lite.
You will not find a more dedicated firewall system like IPFire, (http://www.ipfire.org). Requires a PC with at least two network interface cards to route traffic, an easy to configure web based front end, back end through the command line, with firewall rules that include VPN, GIve it a go.
I build these critters all the time. Our entire multioffice infrastructure is based on Debian-based routers with OpenVPN. OpenVPN is pretty simple to get running, and I use Webmin to build my iptables rules.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I love me some pfSense. We use it at the office and it handles everything we can throw at it (including VPN/IPSec between offices to backfeed high bandwidth security video). It is also light weight enough to work in a home environment on minimal hardware.
Their hardware is both overpriced and well-made. For our small branch offices their embedded devices (such as https://store.pfsense.org/VK-T...) are better than what we could create on our own in low volume and a lot less work. For larger branch offices we will stick pfSense in virtual machine with whatever else they have running. It does well as a VM, too.
Cheers,
Matt
raspbian on raspberry pi works very well as a firewall/router. Software I use: dnsmasq(Just for dns), openvpn(for administration), openvpn(trusted clients use vpn as gateway, thus avoiding unencrypted packets on wifi), dhcpd(Serving 3 networks) and of course finally: iptables.
I can easily max out both upload and download speed(35/35 uplink) without the rpi choking.
Cheap - ddwrt router
more involved - pfsense or kubuntu (not joking)
Cheap silent fan - brand called BeQuiet! - very surprised how quiet and gives about 90% efficiency, no messing with water cooling etc
Look at www,untangle.com to get a good idea of what other options there are. Runs on a variety of hardware and they give some scoping info to figure out how much power you need.
The last time I built a dedicated firewall computer for my home network was for DSL in the late 1990's. I had a Cyrix MediaGX CPU/motherboard (freebie from work), a pair of network cards, and SuSE Linux for the firewall. Most DSL modems back then didn't support sharing multiple computers. Tech support wouldn't speak to you if you didn't have a "abby-normal" computer (i.e., Windows) connected directly to the modem.
I picked up an Asus ac66u last year (there are later models and I suspect cheaper ones in the range that are similar) - and it supports VPN (amongst all manner of other stuff).
Just have an extra page on the GUI to allow you to generate an openVPN cert and account privs. Pretty useful as means when I'm travelling I can just seamlessly add my phone to the home network.
I'd thought about buying something dedicated (well was more a NAS project, I thought I could add this to) - but unless you've got some complex needs or high volume - I strongly suspect I'd make more of a mess (both function and security) trying to set it up myself.
Grab a cheap Mikrotik RB750 or similar and you'll find you have an out-of-the-box solution that's feature-rich, supported, and easy to use.
"Oh no... he found the
I've been very happy with m0n0wall running on Soekris hardware.
Runs on cheap/free hardware and loaded with features. Plus it's not tied to pathetic wifi router hardware.
I have an ADSL connection and I connect to it through an RPi / Draytek Vigor 120 setup with LFS distro (yes it takes shitloads of time to compile).
It also works as a WIFI hotspot with an Edimax USB wifi dongle (and a high-gain antena)
Thou this is OT as it's not easy to set up for a novice.
I'm running a NetGear FVS336 in a similar situation. Working very well for me (static IP, wanted to use VPN to connect to my home network, wanted security between the open internet and my network).
Setup was quick, I was able to assign static local IP's to devices that needed them very quickly. Was able to forward specific ports to specific end-point machines (e.g. port 80 hits the Raspberry Pi) without leaking any config on my local network externally. VPN setup was fairly quick, so I can connect securely to my home network when I need to (I run a Squid instance on my Mac Mini to allow me to bounce web traffic to my home network. YMMV.)
The hardware is easy:
Either get a router that you can add DD-WRT/tomato to or build your own PC.
Software answer:
OS = OpenBSD
VPN = OpenVPN
BUT you are not asking the right questions.
VPN's only work when 2 ends connect. So what VPN server/client will the other end of your connection use? What are you actually trying to do? Does your work have a fat-connection that they will let you use? Are you planning on paying for VPN service from a 3rd party? Do you want to create a VPN between your home and your laptop while you travel?
If you want to build yourself a solid, dependable, 'solution' follow this guide:
http://www.bsdnow.tv/tutorials...
"The price good men pay for indifference to public affairs is to be ruled by evil men." ~Plato (427-347 BC)
I just ordered one of these kits: http://store.netgate.com/kit-A... to use with PFSense. I haven't set it up yet, but many people seem happy with a similar bits. PFSense seems well-respected and relatively easy-to-use. Since it is FreeBSD under the hood, I should also be able to run my AP/Wifi management services on it (outside of the home, I'd probably insist on a separate VM for this).
Save a bunch of time. Buy a netgear FVS type VPN router. You can get 4 port, 8 port and/or wifi.
I second pfSense - easy to use, and great out of the box, and available add on features, GUI interface, OpenVPN and PPTP. Covers all the bases.
pfsense is rock solid.
even on shitty hardware, you can do a LOT with pfsense.
the turnkey boxes from their store are pretty neat too.
THL phish sticks
Buy a good switch and a low power PC with some ram. Virtualize it all.
Smoothwall is a good choice, there are lots out there.
Makes it easy to do other things like IDS as well later.
..don't panic
I've used Vyatta for exactly this for a small business LAN that needed a mobile VPN. It supports MS style PPTP and others. It's configured using cisco style routing commands, but there's configs you can use pretty much out of the box. I ran it happily on a 5 year old dell pc for years.
I love pfSense, it is superb, but that hardware is very overpriced. I guess it includes a support contract, but still, you could build out one of those appliances for less than half the cost.
Just throw a Soekris 5501 at it: http://soekris.com/products/net5501.html
anything else is a waste.
This is a question by an admitted new nerd, that could easily be answered by a few Google searches. There must be countless sites where people have related how they solved this problem.
Think about it on the other hand: what if today's story was "User X made his own firewall with VPN! It was his first time using Linux." We would maybe congratulate the newbody, but 99% YAWN...
Or a checkpoint UTM-1 or a Juniper SSG...
Get a small premade solution and skip the DIY thing. It's minimal power and unless you happen to like pain and suffering, a simple SSL VPN with a decent Web UI is much nicer than spend in half your life building one.
I absolutely love Endian firewall. Put it on an old box, a virtual machine or whatever you want. It has all the firewall features you could want, and has VPN support out of the box.
http://www.endian.com/us/
Let's make like a bird... and get the flock outta here.
The classic router for this purpose was the Linksys WRT54G, but that is getting very long in the tooth and does not support 802.11n or 802.11ac.
The current reasonably priced (about $100) pick that supports everything and is a *working* 2.4ghz and 5ghz 802.11ac router with OpenWRT or DD-WRT is:
TP-Link Archer C7 V2 AC1750
Manufacturer Info is here -> http://www.tp-link.com/en/prod...
It can be re-flashed with either OpenWRT or DD-WRT to provide firewall and a variety of VPN types. It also has enough flash to add other features and given that it includes 2 USB 2.0 ports can also used as a low power (compared to a full hardware PC) internet server.
The disadvantage on this router is that it only supports 1750AC and not 1900AC and that the USB ports are only 2.0. There are routers that cost a lot more that provide both 1900AC and USB 3.0, but they also do not currently FULLY support OpenWRT and DD-WRT.
My personal experience is that OpenWRT is more module than DD-WRT. This makes is easier to pick and choose "packages" in any configuration you'd like. For instance, I added the stunnel package to protect a IP video camera that did not provide HTTPS for remote home monitoring. Now the router provides necessary HTTPS for that use case.
If you are looking to use either DD-WRT or OpenWRT check their home pages BEFORE purchasing a router so you know that it is fully supported by each.
The router to AVOID at the moment appears to be the Linksys 1900AC which the manufacturer FALSELY claimed in their sales literature at launch supported. It still does not.
You can view info on the OpenWRT project here -> https://openwrt.org/
And the DD-WRT project here -> http://www.dd-wrt.com/site/ind...
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
I'm not a fan of pfSense but I do recommend you check out IPFire http://www.ipfire.org/
If you have the time and interest, there's no substitute for learning about setting up these things via command line. Learning about iptables / DHCP / DNS / OpenVPN / SQUID are invaluable skills.
Those boxes:
http://www.pcengines.ch/apu.htm
with
https://www.pfsense.org/
as software. Very small, low power usage, no noise, sufficient for most cases.
pfsense plus openvpn does a decent job. Building your certs with XCA takes some time, but it is very easy to manage after it is up. Plus, it is BSD under the hood.
There are tons of options available to you.
I would try this new web page: google.com it can find things for you.
I really like pfsense. It is FreeBSD based and very easy to setup. See http://www.pfsense.org/
AskSlashdot is a joke. I mean all you get are jokes, or whatever comes up first in a basic Google search.
A Good Troll is better than a Bad Human.
I use pfSense with this box... small, quiet, and rock solid
Intel Celeron 1007U Dual LAN, Dual COM Mini-ITX PC, 2GB, Morex 557, GA-C1007UN-D
by MITXPC
I added a 60gb ssd to this myself but you can buy it already installed.
Can be found here for about $200
http://www.mitxpc.com/proddetail.asp?prod=EKGBC1007DLT3410
I just went through this and here's the short summary of my research. DIY - go with a PC Engines Alix board or a Soekris board if Intel NICs matter to you. You can buy them here (link below). Install PFSense. Done. Easy. Or if you want a more command line approach install VyOS. https://soekris.com/ http://www.mini-box.com/ALIX-b... https://www.pfsense.org/ http://vyos.net/wiki/Main_Page If you want an off the shelf solution the best product I've found for the money is by Ubiquiti Networks called Edge Router lite. http://www.ubnt.com/edgemax/ed... As far as VPN acceleration. With the Alix or the Soekris you can have a dedicated Crypto Accelerator. I haven't gotten to the VPN portion of my build yet. It only really matters if you need fast sustained throughput on a point to point IPSEC. If you are just connecting from remote software decoding will probably be fine. PFsense has OpenVPN included and makes this easy. VyOS or another route will require more hands on.
Enterprise product, free (as in beer) for home use.
Encryption, VPN's ipsec and SSL mail scanning anti virus etc etc etc
easy to use !
No I have no association with them apart from a user and a customer
http://www.sophos.com/en-us/products/unified-threat-management/tech-specs.aspx
http://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx
AskSlashdot is a joke. I mean all you get are jokes, or whatever comes up first in a basic Google search.
We are the Google algorithm...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
http://www.ebay.com/sch/i.html?_from=R40&_trksid=p2050601.m570.l1313.TR2.TRC1.A0.H0.Xcisco+rvs4000&_nkw=cisco+rvs4000&_sacat=0
Incredibly cheap. It runs my home network.
Yea, may be the best, build yourself, actually not that hard, its a rock solid solution!!!
Since your question was not clear as to whether you wanted to connect to a vpn for outgoing traffic encryption, or to provide secure access to your home network, I will assume that you want both. I've got a zyxel usg50 at home and a usg100 at my office and they have been able to handle everything I have thrown at them. http://www.amazon.com/dp/B0042.... I was also pleased that when the whole Heartbleed fiasco appeared, the zywall firmware was not vulnerable at all. Dual WAN connections are supported which lets me use both my AT&T Uverse and Charter Cable internet access with load balancing. The only negative that I can note are the several features on the zywall that require monthly subscriptions. But, since I don't use those, there is no loss to me.
In the past, I have built my own firewalls either on dedicated hardware, or as a vm on an esxi hypervisor, from Linux ipchains to netfilter to BSD pfSense. While I love to roll my own, having such a critical piece of infrastructure as dedicated hardware has made life much easier.
They seem to be reselling http://pcengines.ch/
I recently did this very thing, but my setup is for mobile use specifically and is tied to my cell phone data connection.
I used an older laptop that has WiFi and a LAN port, coupled that with a WiFi enabled router (all routing functions to the WAN port are disabled) and DHCP is served by the laptop. Wifi is served by the router and forwards all DHCP requests to the laptop, so I can have wired and wireless connections.
For the OS, I used Ubuntu Server LTS and loaded the GUI on top of it for ease of use (with a 500gb drive, why not?) as well as the build-essential and a number of other packages. I also loaded up Apache, Webmin, Shorewall, DHCP Server, Squid and a number of other services I felt I had a need or use for. I then set up the WiFi connection to my mobile phone, plugged the LAN into the Wifi router and turned on DHCP.
I then created the VPN connection and then set the WiFi connection to auto-start the VPN connection, configured the firewall to not allow forwarded/masq'd traffic over the unprotected interface and allow it only via the tunnel and deny any inbound traffic that wasn't related/established on both the VPN tunnel and Wifi interfaces. The effect is that if the VPN tunnel goes down for some reason, internet access goes down with it and I know something went boom and I'm not left unprotected inadvertently and not know it.
This works very well for me since I live a mobile life, but I've used the same setup with wired cable/DSL connections in the past too. The fact my mobile carrier can't pick and choose what data it wants to transmit (or throttle) is, of course, a HUGE bonus. All they see is binary data flowing. Unlimited data also helps. :)
It is going to be hard to beat something like a Ubiquiti EdgeRouter Lite by building your own, unless you have specific non-normal requirements.
If you want to learn more about network gear, then a Juniper SRX210 on eBay would be interesting.
I have pfSense running on a Soekris net6501 for my home network firewall. I have set up OpenVPN - configuration took only a few minutes and it has worked perfectly.
The Soekris Net6501 is more than sufficient for my needs but pfSense scales well and will run on many types of hardware. When I was testing it I ran pfSense as a VM without any problems - in retrospect I should have left it that way permanently.
I bought an ASA-5505 on Amazon for around $500. For that price you get a firewall that is used by many big companies. You can get your feet wet in the Cisco world - which could help if you ever need to look for a job, and it handles VPN nicely.
If you've never worked with Cisco before, it will take you some time to get up to speed on the cisco way though.
The only drawback with this box is that the interfaces are 100 Mbps only.
There are a few affordable solutions out there. Here are 3 options with support for IPSec, OpenVPN and PPTP.
1. Ubiquiti Edge Router, The Lite model retails around $99. The gui is intuitive and easy to use. The latest update makes setting up site to site IPSec tunnels pretty simple. Don't like the GUI? No problem, It has ssh and serial support and is based on the excellent vyatta fork VyOS.
2. Mikrotik, I recommend the RB2011 series as they have 10 ports ( 5GigE and 5 FastE ), plus the $129 model has wifi and an SFP port as well. Quite easy to set up.
3. pfSense. The hardware is pricey but the software is excellent and works well in a VM. You can pick up a low end fanless micro ATX board , pick up an extra NIC and have a quiet firewall sitting in your living room.
Check out PFSense, has a snort plug in and the vpn capabilities you're looking for.
"If any question why we died, Tell them because our fathers lied."
There seem to be quite a lot of 1801s and also some 1811/1812s on eBay. They have hardware crypto and are designed to support VPNs The 1801 has ADSL2+ but the others have 2 WAN ports to connect to a cable or ADSL modem.
Just download and install VyOS (fork of Vyatta) if you're building your own firewall.
http://vyos.net/wiki/Main_Page
Yup, pfSense is Good Stuff. On the hardware side it'll run on damn near anything. I run mine on an old Celeron machine with traffic shaping, no issues. I don't know that I'd want more than one or two simultaneous VPN users with that compute capacity, though.
Eagles may soar, but weasels don't get sucked into jet engines.
somehow i think he is just trying to hide behind a VPN to do some "torrenting"
Open Source Java Web Forum with LDAP authentication
Hands down the most reliable and easy to use dual wan, VPN enabled Router for quick deployments, silent, low power consumption, handles PPTP, ipsec, etc...
I am no fan of their quickVPN software (a third VPN option included with this router), but it works as well if you dont like pptp or if you find IPSEC too much of a pain to setup.
Plus it has DUAL WAN connections, so you can use a hotspot or DSL, or the neighbors connection as a failover (or you can load balence them, or bind stuff, etc...).
Im blown away noone has mentioned this router as i see it everywhere.
http://www.newegg.com/Product/...
Pfsense is a huge winner as well, though youll need to buy silent low cost hardware to run it (and its a good deal more involved - though considerably more powerful).
We use these two for all of our client locations with offices of up to 100 or so people, for at least 7-8 years or more.
--Idiots, Every single one of YOU, A flaming mass of conglomerated morons, hey wait a second, isnt that how RAID works?
or smoothwall or moonwall.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
No mention has been made of Smoothwall yet, so I will. It has OpenVPN and IPsec capabilities.
I agree. If you don't mind tinkering, pfSense is the way to go
I agree that pfSense is a great solution but I disagree about the tinkering . pfSense fits well in the mantra of "simple things can be done simply but complex things are possible". It needs little tinkering if you have a reasonably standard setup - say an internet connection plus a local network. It has decent defaults.
If you have a more complex setup (I have a LAN interface, a DMZ, a guest network, and a VPN interface as well as several additional software packages) then some tinkering will be needed.
It's what I use and clients can use openvpn. Works fine for me.
I think the question is do you want to constantly be fixing your firewall and routing rules and also troubleshooting problems that might cause you to tear your hair out? Or do you want to do this in a weekend or a few hours and have something that is pretty solid and stable? I see already that everyone is recommending their favorite firewalls. What you want to get is an enterprise grade firewall. For this reason you should look at the Cisco ASA line (You can get one eBay for about $300), or a Dell Sonicwall. Note that you need to spec all of these to your needs. And remember there is no such thing as total security whether you have spent $100 or $100,000 on your firewalls.
Run a quick Google search for Linux or BSD firewalls.
Or Distrowatch's distribution search form is helpful.
http://distrowatch.com/search.php?ostype=All&category=Firewall&origin=All&basedon=All¬basedon=None&desktop=All&architecture=All&status=Active
Depending on your level (you said newbie) and willingness to get your hands dirty, you have a whole lot of options. ...and more
- pfSense (as others mentioned)
- Vyatta
- IPFire
- IPCop
And as far as VPN software goes you have a few software options, some of which can inter-operate and others than cannot.
OpenVPN
LibreSWAN
OpenSWAN (succeeded by LibreSWAN)
StrongSWAN
http://www.smoothwall.org/
Try pfSense. https://www.pfsense.org/
I've been using m0n0wall on Soekris boards for years. Recently switched to using it in the free version of ESXi. Have not only IPSEC site-to-site VPNs to the parent's and sister's house, but mobile VPN as well.
Just download and install VyOS (fork of Vyatta) if you're building your own firewall.
http://vyos.net/wiki/Main_Page
By far the best solution I've come across. It's a enterprise class product you can use at home for free. All you need is a PC with a couple NICs. I use a cheap fanless Dual Core 2GHZ Atom machine with a couple gig of RAM. It's a turn key solution with a lot of options.
It has all the whiz bang VPN and firewall features you'd want. Plus a bunch of intrusion detection, malware and virus features. Really the list feature list is huge. The only limit is the home edition is limited to 50 active devices.
Actually i would recommend m0n0wall. This is what pfsense is built upon - but without the kitchen sink its even lighter. And m0n0 does everything he asks excellently.
Check out the pcengines apu1d4 (http://www.pcengines.ch/apu1d4.htm)
and of course, openbsd is the way to go.
As a network consultant I deal with a myriad of FWs. PFSense is definitely my favorite for an open-source solution. It's free, powerful, easy to install, and has very basic hardware requirements. I've run it both on standard hardware and in a VM.
The netgate solution is a bit less: http://store.netgate.com/NetgateAPU2.aspx
If you feel the need to build something, builld a commodity PC and put Vyatta on it. If you want something inexpensive that works and doesn't require too much effort on your part, get something like the Ubiquiti EdgeRouter Lite. Three Ethernet ports, Linux-based OS with a fork of Vyatta on it. Less than $100, and its a three-port IPv4/IPv6 router, customizable firewall, IPsec/PPTP/L2TP/OpenVPN VPN gateway, and more. Small physical package, seems to have good reliability, has enough performance for typical USA ISP speeds (15-50 Mbps).
I don't have any relationship with Ubiquiti other than as a satisfied customer. I have two family locations separated by 3000 miles. I put an ERL in each, with a site-to-site VPN between the two locations and L2TP VPN remote access to each location. I can manage all the family IT stuff from my house as if we had our own private network (we do - VPN). There is a bit of a learning curve, but if you are willing to build your own in the first place, you shouldn't have much trouble learning what you need to know to work with the ERL in all three configuration modes: GUI, command line interface, or (for efficiency with certain types of changes) editing the config.boot or other configuration files directly. Its not perfect, but I found it a lot more acceptable than laying out $250-$500 apiece for used Cisco ASA 5505 hardware, then dealing with the hassle of getting software upgrades and such out of Cisco.
My question is basically the OP's question, but the requirement for multi-factor?
Anything out of the box that supports low-cost hardware tokens, e.g. yubikey/yubicloud support?
Thanks.
I guess OpenVPN would be out of the question. I'm installing mine on a Rasberry Pi running Rasbian.
pfSense works well but Untangle is also worth mentioning (http://www.untangle.com/). It has all sorts of pluggable modules like VPN client/server, ad blocking, intrusion detection, etc. I've been using it for a few years on modest hardware (Intel Atom with 4G of RAM and a 1TB green disk) and it's always worked flawlessly.
I use the kong mod of dd-wrt on NetGear WNR3500L V1 routers at two locations.
I connect remotely from an iPad using OpenVPN client for IOS.
NetGear hosts a site called MyOpenRouter that is less confusing than the dd-wrt site. Its a good place to start.
ClearOS installed on an Atom based dual NIC piece of hardware with an SSD. Run this for years with no issues. PPTP, OpenVPN, whatever VPN you want! Acts as a firewall and newer versions can handle a WiFi dongle too I believe.
Sophos software utm with a home license. the license is free. you will have free ssl clients and web filtering.
I have a pc in my living room that is on 24/7 and serves as my media server (xbmc) and storage (hardware raid + lvm + nfs). It's also my compile machine so I invested two years ago in a i7 3930k with 64GB ram and loads of disk space. I'm running the community edition of Astaro Firewall (nowadays called Sophos UTM http://www.sophos.com/en-us/pr...) under kvm. I purchased on ebay a quad port intel 1GB NIC which is reserved for my firewall VM. I have one port connected to my ISP, one to my internal network via a real hardware switch, one to a dmz VM, and one to my wireless AP. The system is rock solid, Sophos UTM is being updated on a regular basis, has a long list of nice features, including OpenVPN and iOS/Android friendly VPN solutions, with clients for linux/mac/windows/ios/adnroid. The interface is super nice. And since a few versions ago it supports google authenticator for a two factor authentication, both to the admin console and the user portal, as well as the VPN. Very very nice feature. Works with iOS and Android, NetworkManager, etc.
In the past I was using netbsd on an old powerpc machine, then ipcop on the same powerpc machine (I was the guy who ported ipcop to ppc and sparc), then ipcop on x86 under vmware server, then ipcop under virtualbox, then astaro firewall under virtualbox. I switched to kvm+qemu because I was not happy with the virtualbox network performance. I even played with PCI passthrough to have complete control over the network card. Finally I settled on libvirt + kvm with astaro firewall. I'm running all this under LFS (linux from scratch), but this setup can be easily replicated on any modern distro: Fedora, CentOS, Debian, Ubuntu, you name it.
Or you can try and roll something yourself, based on iptables, whatever. But if you're not into monitoring security mailing lists for the latest vulnerabilities, you're better of with an off-the-shelf commercial product with a free community offering.
I have used IPCop at work for years; it'll run on any old PC, or a small Atom machine these days is ideal. Fairly easy install, excellent web GUI, IPSec & OpenVPN support.
I'm sure that all these other suggestions will be good too, IPCop is just what I know.
well played sir!
A Good Troll is better than a Bad Human.
the problem is finding your public routable ip address needle in the big internet hay-stack if you're using "dial-up" with a ever changing address. ...
once you know which ip address to send your vpn packets to then it becomes trivial: openVPN and port-forwarding.
to find your ephemeral ip address without ever using domain-name system (dns servers):
1: irc client connect to irc server static.ip from your home ip address and leave it running (set to auto-reconnect on ip change)
to find your dynamic.ip address from abroad connect to irc server static.ip and do a whois on the user logged in and get the home ip address.
2: run a tor relay and give it a name. use some tor-relay tracker to lookup your tor relays name to find the ip address.
3: seed a secret torrent and be sure you're the only seeder. download this torrent from abroad and find the ip address of seeder.
4:
5: $$$
I like embedded boards, but most of them are just horrible value. If space/power/etc isn't an issue, grabbing a PC from a junk pile and throwing a couple NICs in it will be far more cost effective. Pretty much the only network-centric embedded board I've seen with truly good value was the Uibiquiti Routerstation Pro but sadly it's discontinued.
What do you think about Untangle? (untangle.com) You can buy appliance version of it too.
as the subject line indicates, i use the rt-ac56r (~100usd at walmart) as my primary router and with the asuswrt-merlin fork i have dual simultaneous openvpn servers configurable from the webui. awesome router. and true to asus' reknown for keeping old devices updated, the 'adaptive qos' based on trendmicro's DPI based system is on it's way to this venerable device, which premiered in the latest model, the rt-ac87u
Firewalls are not easy to do right. PFsense makes is easy enough, but you can still shoot yourself in the foot. The nice thing is PFsense is ROCK solid. Make all the filter or rules changes you want in production, during the day!!
Unless you have a computer laying around, I strongly recommend getting an off the shelf solution using a router with capabilities built in. One good example I can point out is the Cisco Small Business RV215W Router. For $100-ish off Newegg, you get a full router with ACLs, QOS, VPN, VLAN, and more. If you like your current router, set up your current router to forward VPN traffic to this device. Best part is that it is small, quiet, and energy efficient when compared to a full computer.
There is nothing wrong with using a custom computer and throwing Linux on there with a software package to handle VPN, but based on your description, I think this would be a better fit unless you really want to go in depth on learning VPN technologies. By the sound of it, you just want something easy to set up and manage with little maintenance.
Might be overkill but why not......zentyal has been good for my needs.
Dare I raise the suspicion, that the underlying Linux is to blame? pfSense, on contrast, is based on FreeBSD and is — as mentioned by numerous people here — quite usable even on old celerons...
In Soviet Washington the swamp drains you.
You don't need to buy their hardware, you can install pfsense on whatever you want. I have it running on a VM with 256mb ram.
pfsense.org Period.
I have pfSense running on a dual-core mini-itx Atom board with on-board Intel GB NIC, a Intel PCI-E GB NIC, 2GB RAM, and a CompactFlash to SATA adapter for storage: this setup has gotten me enterprise level performance and reliability, no matter what I throw at it - IPSEC VPN, off-site video monitoring, a Plex server serving up to six WAN side clients at once, etc. It has never frozen/locked up, it controls my commercial grade UPS which all networking gear in my riser closet is connected to, and it consumes about 13 watts under full load.
Hardware:
Software:
Agreed, pfSense is a great solution. I've run it at home on an old Pentium 3 and a first-generation Fit-PC embedded box, and at work on everything from a first-generation Athlon to a pair of Dell R-200s (overkill, but they were cheap and we wanted identical machines for the failover pair)
the best way to bulk up security is to turn it off.
you might miss it for a little bit but the increase in your life will make up for it.
This indeed. I have pfSense running on one of these with a 60 Gig SSD drive. If it wasn't for the cat trying to hide behind it I wouldn't even know it was there and running.
How come Slashdot never gets Slashdotted?
As others stated pfsense is excellent and *WRT runs on cheap MIPS/ARM hardware.
However, pfsense is more difficult than IPFire and the MIPS/ARM soho routers struggle with VPN (underpowered). PC Engines APU uses about ~7 watts and IPFire is developing nicely with grsecurity + PAX and they recently added Active Directory.
It results in a nice low powered reasonably priced router and a user friendly UTM.
PC Engines APU
IPFire
I would have to most definitely suggest you get a second NIC and install IPcop on any old box. Very easy to get a VPN setup. Or if you want to go really hard core, try out RouterOS at http://www.mikrotik.com/software.html
Try http://www.gargoyle-router.com... It is a nice front-end for open Wrt and has OpenVPN plug-in.
Buy an RV042, deploy in 20 mins and go to the bar.
vyos.
That it all.
http://vyos.net/wiki/Main_Page
Get The Book of PF
-- "At Microsoft, quality is job 1.1" -- PC Magazine, Nov. 1994
This indeed. I have pfSense running on one of these with a 60 Gig SSD drive. If it wasn't for the cat trying to hide behind it I wouldn't even know it was there and running.
The above is a rather nice little box. At half this price I would buy two.
I was going to reply to the original poster that if he had to ask
he could not get there from here. The above system has the
critical two Gig-E network ports. He would have to install
and learn how to administer a linux system or install a pile of odd
things on top of an IMO fragile WindowZ OS. Full blown Win-Server
software that can get the job done costs more than the hardware.
The best bet is to run the router that the ISP gives you and
then use that as the basic firewall and allow one port
access inside to a machine that runs VPN software.
That machine could be the above or it could be anything
else.
The obvious other place to start is to Google for "gig-e router vpn".
When shopping VPN solutions make sure all three bits are
working.... Client, server, firewall...
VPNs are interesting... they punch a hole in a firewall that
once inside other security must be in place. Badly structured
VPN solutions increase the footprint and enable many
worms, viruses and other cruft to run free.
Well structured good things happen.
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
"It's hard so don't do it."
Fuck off.
I've been using Zentyal, it does everything I need it to.
ipCop or ipfire are both good for your purpose, free, stable, easy to set up, try it and you'll love it
I would highly recommend ZeroShell, it's easy to configure as the name implies and it's full of advanced features such as turning your wireless card into a WiFi router and multi-wan fail over, for redundant internet connectivity.
I just deployed it at my job to replace a Cisco router and access point and I'm not even considering going back to the old hardware. As for security, let's just say after I deployed the firewall rules our PCI compliance auditor couldn't even detect any open ports (even though there are many services running). This distro supports 3 different kinds of VPN access (OpenVPN, IPSec, & PP2P) depending on your preference. Check it out at wwe.ZeroShell.org
Full blown Win-Server software that can get the job done costs more than the hardware.
No, not really. Windows has the easiest internet-sharing and vpn configuration wizard you'lll find. And its not half bad, but...
The above is a rather nice little box. At half this price I would buy two.
I have an equivalent box, Instead of pfSense (which, besides the gui and the easy VLAN setup, is a crappy system for everything else), I run FreeBSD 9.2. And I use it everyday to tunnel into my windows machines with RDP via SSH :)
I would highly recommend ZeroShell, it's easy to configure as the name implies no shell required, and it's full of advanced features such as turning your wireless card into a WiFi router and multi-wan fail over, for redundant internet connectivity. This could be useful if you want to use your cell phone's internet for a backup to your main net connection. I just deployed it at my job to replace a Cisco router and access point and I'm not even considering going back to the old hardware. As for security, let's just say after I deployed the firewall rules our PCI compliance auditor couldn't even detect any open ports (even though there are many services running). This distro supports 3 different kinds of VPN access (OpenVPN, IPSec, & PP2P) depending on your preference. It also has easy to install add-ons such as integrated Anti-Virus for all incoming traffic, along with bandwidth monitoring, proxy caching, and content filtering. Check it out at www.ZeroShell.org
current stable (v24 SP1) is dated July 2008 (Link)
In fact, if you check the official site's downloads area, you will find the the "obsolete" folder is newer than v24-sp1! (Link)
I'd say you should do a little research too.
Or you can get a used Watchguard Firebox XCore or XCore-e series for around $50-100 on ebay. Drop in a 2 or 4GB Compact Flash and you're in business. Looks professional with working LCD display with a few modifications. I'm not sure about throughput over VPN so that could be a dealbreaker for some. The XCore-e series has gigabit NICs if you need the extra bandwidth. https://doc.pfsense.org/index....
Yeah. The ERL looks super-sexy, and (at 99 USD is reasonably priced.) Its VPN throughput looks very good, and it can route and firewall traffic at or near gigabit speeds.
It uses a lightly-customized version of Vyatta (which runs on top of Linux), so if you're a Linux novice, you'll need to do a little bit of more reading to work with the CLI. However, the Ubiquiti wiki has a squillion examples of config files that should cover most every need.
Also, the device does have GUIs for configuration of many common things (like, for instance, a NATting firewall, VPNs, and QoS.). The beta firmwares add even more GUIs and appear to be developed by a couple of guys in the company who really know their stuff.
I stuck in the following mobo - http://www.intel.com/content/w... - into an old casing, put in an old psu, and an ethernet card on its slot, with an SSD card, and that's all to it
And it has been running for the past 3 years, 24/7 without giving me any problem
I use IPCop. We have it running on our utility internet connections in our offices connected to our labs in each of our 10 offices. We use them for typical lab purposes and to provide raw internet access to guests and for testing in the office. All of them are connected together using IPsec.
They are mainly running on old HP desktops we had laying around with a dual port NIC or the internal NIC and a second cheap nic from old servers we retired. Some are a virtual instance on VMWare. I have some that have been running with no KB, mouse, or monitor sitting in the corner of the datacenter for over 900 days untouched. The others are only not at 900 days because power in the building went down for what ever reason. Yes they are behind on patches but nothing is being offered from the outside that I am worried about getting in. Quite a few of them pass over 500GB of traffic a month to the and from the internet. Rock fkng solid.
one of them is running on ESX on one of those HP desktops, the IPCop instance has 512MB ram and it easily passes 100mbit/sec traffic in from the outside to physical machines in our lab.
I'd go off with the DIY solution. Inside expensive branded solutions you are bound to find usuall PC components anyway - Pentium 4 buth with ddr3 ram. And known Cisco issues like revert 10- firmwares backwards and install each firmware update one after each other, else it does not work... also make me steer away from branded pre-made solutions.
Quite helpfully if you want to have a look, at what it supports, they've put the UI online:
http://event.asus.com/2012/nw/...
There is more than one way to do it.
1. Raspberry Pi(not practical)
RPI+linux+iptables+openvpn
pros : cheap, low power(5W), no noise, low heat
cons : 1 100Mbps port only, usb-ethernet/usb-wifi+additional switch needed, usb performance not good. Not recommended unless your outer ethernet side is very slow.
2. DD-WRT + supported hardware(ap/router)
AP/router(typically arm based)+linux+iptables+openvpn
pros : relatively cheap(depends on hardware model), low power(typically 10W), no noise, low heat, integrated WIFI/wired ports. small. clean looking.
cons : limited internal storage/memory. May brick your hardware if you are not careful enough(and void your warranty) useful for dedicated role(firewall, vpn)only
may use for printer/file server or other role if your hardware has usb port, but (typically) slower than full pc.
3. Mini ITX based PC
Low-end bay-trail based Mini ITX motherboard(j1800 recommended)+dc-dc power+12V power brick+small case+storage+linux/bsd(?)+iptables/pf(?)+openvpn
pros : versatile(file/full printer(cups)/application(ex. minecraft) server capable depend on configuration, up to 8/16GB ram + TBs of storage),
still can be made fanless&no noise if you've planned well,
relatively low heat(warm) if you leave it on open space
cons : most power hungry(~15W, depend on configuration), additional usb-ethernet adapter/switch/wifi needed, biggest of all above(20cm*20cm*5cm + brick)
tips
-for cheap 12V power brick, look for power brick for LCD monitors(12V 3.5A/5A SMPS - depend on your system's power usage- widely manufactured)
-about iptables, read iptables tutorial on frozentux.net
-p910nd - light, spoolless(no file operation) print server daemon. turn your cheap usb only printer to always-on networked printer even on limited storage platform.
I would rather see you utilize one of the newer Single Board Computer routers from a vendor like Mikrotik rather than spend far too much money for a Cisco ASA or SoHo solution.
.
As an enthusiast I would recommend the Routerboard CRS series for price and punch. It will provide the OP with all of the features he requested and a ton more that CISCO would charge a licensing fee for. The base cost will be around $149.00 for a CRS with 8 1gbp Ethernet Ports, a Gbit SFP cage, and integrated 802.11N MIMIO interfaces. http://routerboard.com/CRS109-...
Wanna build your own, you can add 802.11AC to any of thier base baords and chuck it in an enclosure for rock bottom prices. -- http://routerboard.com/R11e-5H...
It supports Client and Server modes for IPSEC, OVPN, PPTP, L2TP, VPLS,GRE,SSTP and those are off the top of my head.
I'm not a salesman, just a nerd.
Casey Annis
P.S. If you go with Mikrotik, I'd be happy to do a TeamViewer session with you and get you started.
Cons:
I recommend IPcop. Its a dedicated firewall Linux distro with an easy to configure gui for VPNs and DMZ. Runs on any old hardware.
I forgot to mention the State-full Firewall with Connection Tracking and QoS systems with packet inspection rulesets. Casey
Juniper SRX100H2 .. $500 which includes 3 years of HW replacement and SW support .. Plus this stuff actually works.
The RouterStation Pro was merely Ok.. for the value point. We sold a lot of them when I used to work for a WISP hardware provider but they had a ridiculously high 10% return rate compared to the less than 1% return rate on a comparable Routerboard.
I don't work there anymore but I still use Mikrotk RouterOS and Routerboard in my home and office. While comparable in priceto Ubiquiti they both beat the blue router pricing by a hundred country miles and pound for pound the configuration interfaces are superior to blue router's old and busted command line. It just makes sense when you look at it.
The console Mikrotik console commands actually resemble english.
I just set up a couple of sonic walls with site-to-site VPN enabled
Full blown Win-Server
software that can get the job done costs more than the hardware.
No, not really. Windows has the easiest internet-sharing and vpn configuration wizard you'lll find. And its not half bad, but...
The above is a rather nice little box. At half this price I would buy two.
I have an equivalent box, Instead of pfSense (which, besides the gui and the easy VLAN setup, is a crappy system for everything else), I run FreeBSD 9.2. And I use it everyday to tunnel into my windows machines with RDP via SSH :)
One caution is that Windows is not as secure an OS perhaps because
there is a rich set of stuff that is darn hard to replace or eliminate.
A FreeBSD or Linux based firewall+VPN system can be pruned to an astoundingly
short list of services and binaries. I say this but most Linux system owners
do not do this.... but it is better facilitated if you want to do it.
You open up a good context to make the point that a user should use what
they know best. If the poster knows how to manage one system and not
the other then the best answer for that user is obvious.
Opinionated discussions like this are really homework check lists
for others. At some point consensus identifies a winner to learn first.
Along the way issues, tools and options surface as alternatives worthy
or research and may cause the consensus answer to change.
I am not a fan of consensus science but it does have its place.
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
One caution is that Windows is not as secure an OS perhaps because there is a rich set of stuff that is darn hard to replace or eliminate.
I haven't seen one single landline direct-connection to the internet since the dialup/adsl days. Most consumers will have a router. The only exception is 3G/4G adapters, but the topic is about firewalling. And unless you're running a DPI appliance to check for binary malware, you're getting those in your windows machines anyway.
A FreeBSD or Linux based firewall+VPN system can be pruned to an astoundingly short list of services and binaries
As can Windows. And you can also take the easy approach of just closing any external port besides the VPN, leaving only potential attacks on the TCP stack and the VPN layer. I actually find funny people that use firewalls on unix systems "as a checklist item"; Most systems don't even require firewall if properly configured. But yeah, lets badmouth windows and forget the ton of distros that allow remote root login via ssh *by default*.
You open up a good context to make the point that a user should use what they know best. If the poster knows how to manage one system and not the other then the best answer for that user is obvious.
No. If the user knew what was best - or at least the options available - he woudn't be asking this. Having guys following tutorials on the internet to configure stuff is not my idea of "secure", and he'd probably be better buying a dedicated appliance with a nice gui interface.While realizing that you exposed something from the internal system or used a weak password for root after your whole network was compromised does have its educational value, it is a dreadful experience for a non-unix nerd.
Just as a heads up, I measured 18Mbps (that is 1.8MB/s) with my OpenWRT TP-link WDR4300 (with AR9344 @ 560MHz) . I don't think off-the-shelf routers have any openVPN support, so no HW encryption engines.
If you need higher speeds, forget off-the-self routers (at least for the VPN end-points).
We use it at work and I'm planning to move it to home too. It will give you the options of all the VPN's you could think of.
Other open source firewalls are pretty good out there too. I'd download the firewall software as an ISO and fire it up in a vm. That way you can see which you find the best for you.
Dedicated boxes pre installed are good, we have one at work. But you could quite as easily buy some second hand machine throw another NIC in and build your own with whatever you choose.
But yes these seem good choices:
pfsense
Untangle
Smoothwall
From previous posts and http://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions for helping you choose one too :)
Another alternate firmware for home routers is CeroWrt. Although its goal was as a research platform for studying Bufferbloat (which has been solved!), the current 3.10.50-1 build has been extremely solid for over a month. You will need a Netgear WNDR3800 router to run CeroWrt. See details at: http://www.bufferbloat.net/projects/cerowrt/wiki/CeroWrt_310_Release_Notes
If you prefer another router, the OpenWrt project has virtually all the updates for Bufferbloat (especially fq_codel queue discipline). The Barrier Breaker builds are nearing final release, and are quite stable. https://openwrt.org/
Why not get just a router (I've been contemplating a Netgear WNDR-4300) and load it with OpenWRT or even DD-WRT?
If OP wanted to do video transcoding/HTPC duties I could see the use for a full PC but otherwise it is just a nuisence compared to a small, efficient, embedded system.
The main advantage of OpenWRT over $OTHER is it's packaging system and ability to install updates without reflashing. It has good documentation and a great community too.
A PC running Windows 7 with firewall enabled should do, no?