1

I think that to really monitor our workers' bandwidth consumption and access filters (e.g., website blocking) we need to have firewall equipment because the normal firewall on the computer itself (i.e., Windows firewall) is really not that helpful in our situation.

Do I need to use firewall equipment that will cost us a lot of money or still use the dedicated firewall that the OS provides? Or will the PC-to-firewall conversion will do?

And how is PC-to-firewall different from firewall equipment and Windows firewall?

Edit:

  • My budget will be $3000
  • and I need a firewall that has 4-port 10/100/1000 Mbps Gigabit Ethernet switch,
  • Proven firewall, support for separate virtual networks, and strong wireless security help protect the network and business assets
  • High-performance Gigabit Ethernet connections, internally and externally, plus a built-in wireless-N access point, speeds file transfers to improve productivity
  • Stateful packet inspection (SPI) firewall, firewall rules
  • Static URL blocking, keyword blocking, approved URL
  • Also monitor the bandwidth consumed by the user of workstation
  • This is kinda off topic as it doesn't ask specifically for hardware. You should try super user instead. – Peter Zhu Jun 11 '16 at 2:14
  • but, I am asking about the Firewall Equipment and that is a hardware equipment right? – Joshua Dela Cruz Jun 11 '16 at 2:17
1

I am addressing only this part of the question:

And how is PC-to-firewall different from firewall equipment and Windows firewall?

A hardware firewall offloads the work from the general purpose CPU that windows uses to a CPU that is specifically designed for processing large volumes of network traffic fast.

Windows firewall can block individual websites based on IP, but does not do SPI. Also with as much as people encrypt these days SPI can not inspect much of the traffic without SSL terminator.

If you buy software for each PC many of the functions of a hardware solution can be emulated locally, but then each PC has to have faster hardware to accommodate the addition work load. Also nasty root kits maybe able to hide from PC only solutions.

Think about it this way, a hardware solution is like going to a gourmet cake shop and buying a cake. Only the best ingredients were purchased and a master cake chief, or whatever they are called, monitored the whole process. They used all the correct tools, baked and baked it to perfection.

The point is you get to enjoy the cake with no effort on your part.

The software solution is like making the cake yourself. You go to your local store buy all the ingredients took them home. Now you will use whatever tools you have on hand to mix them together and bake. You most likely use inferior ingredients and poor tools and the end result maybe just ok. Then you still have to do the dishes, and throw away the rubbish.

When you are buying a hardware firewall, the vendor has (in an ideal world) hired a security experts to test the firewall and verify it has no known vulnerabilities. Most of them update themselves and require very little hands on once they are properly configured. The vendor assembled all the pieces for you and gave it to you in a convenient package. The will also for a fee have people on staff to help you configure it or configure it for you depending on the contract you sign and the fee you pay.

In a software solution each part of it is like an ingredient that goes into a cake. Each piece has to be individual managed, configured, and updated. Just like our cake one bad ingredient spoils the whole thing. The foundation is the OS which has to be kept current. Then you have your basic firewall which again has to be configured and maintained. Then the SPI package, antivirus, anti-malware, and etc.

Each packages has rules that need updating and the software itself has to be kept up to date. However, instead of being sad you made a bad cake, you company is the news for the next major data breach, and now you have to spend 10's of thousand cleaning up the mess.

I am not saying rolling your own solution is impossible or undesirable I am only saying you need to be prepared to do all the work yourself and initially it will definitely cost more money especially in hours of labor.

| improve this answer | |
  • You really answered my question though. But what is in my mind remain unclear is what does the thing they called "PC-Firewall Conversion"? What I mean is, the PC you have will transform as a FIREWALL EQUIPMENT as if they are made like CISCO Firewall Equipment. Thanks for answering my question. :) Kudos to you! – Joshua Dela Cruz Jun 13 '16 at 2:30
  • 1
    @JoshuaDelaCruz "PC Firewall Conversion" means you turn and old PC into a firewall. This goes back to baking your own cake with ingredients. Take an old PC, maybe some Quad and Dual gigabit nics (4 nics in 1 card). Then you could, for example, load linux, and configure it. Started with iptables (aka flour),ipset (yeast), snort for SPI with subscription, antivirus (+subscription), and a couple other utilities. After installing it all now you have to configure (bake) everything into the final product. Then test to verify everything works and is secure. – cybernard Jun 13 '16 at 4:19
  • @JoshuaDelaCruz It is too bad that testing a firewall is so much less fun than cake testing. yum! :) Hit it with every peneration tool you can find to detect defects, and then virtual, run around like crazy, trying to patch the holes in the structure. Hours spent with google scouring for the best way to configure each piece and taking the best parts of each recipe to make the final product, and test again. Also, if your distro is any good you will have to update monthly, and verify that didn't break anything. – cybernard Jun 13 '16 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.