Could a router protect our network or need we use an hardware firewall?

Question

I am at a small firm (12 PC on the internal network). We use this network architecture now:

Internet(Modem) --> Router --> Firewall --> Switch -- > Internal Network (clients PCs)
                |                       |
                |- Wifi Router          |- DHCP & AD Server
                |- HTTP file server 

The Main server and the clients PCs are (relatively) new (to other components), they were bought in 2005. But the other hardwares are creepy old ones, lot of them is older than 15 year. They became the bottlenecks of the network.

Here I describe all of the components in a short shoot:

• The Router is an old ASUS (Rx3041)
• Firewall is a MS Server 2003 R2 with ISA 2006 installed (now formerly Forefront Threat Management Gateway) Definitely this is the main bottleneck of our network, we need to restart this server more than one per week, because it randomly start to drop allowed connections.
• DHC & AD Server is a MS SVR 2008 R2 and it also operates as an internal file server and internal HTTP server (We run a Redmine issue tracker on it. But not on IIS.)
• Wifi Router is just simply an access point to the internet outside of our firewall for our wireless devices such phones and tablets (but no laptops or computers, which we use for work.)
• HTTP File server is an old laptop, which is out of the firewall too (However we have a rule for it to reach it from internal network, so we use it as a network drive to publish some stuff.

While our programmers work out of office, so we don't have any sensitive information on most of the client PCs except one. Our server store sensitive information too. (source code, our clients information, etc..)

We want to fresh up our network a bit. We plan to use only one router instead of 2 routers and a firewall. It looks like this:

Internet(Modem) --> Router with wifi --> Switch -- > Internal Network (clients PCs)
                           |                      
                           |- HTTP file server (DMZ maybe?)

We want to use the Asus RT-AC66U router.

I read this great answer from Bill Frank, but that question is three year old and things change fast. Maybe routers evolved enough to be able to secure a network. So my question: is this a viable option? Could a router protect us? Or must we use (still) a hardware firewall to protect our network? (We should, but must we?)

We choose this option because of the matter of money. If I could I setup a new router and place the whole network behind a firewall (on new machine) but management say there is no easy money can be spent for that. Should I fight for a new firewall server? Or the router will be enough?

Answer 1

Many routers - even in the consumer-segment - have basic network filtering capabilities based on protocol, port and IP, which means that they can also be used as a basic firewall. Dedicated firewall appliances often offer additional features, like deep-packet inspection to detect certain known threats on the protocol-level or automatic attack detection based on heuristics (they can warn you when someone seems to be probing your network for vulnerabilities). Whether you need this or not depends on how secure your network needs to be and how much this security is worth to you.

The manual of that router shows some screenshots of the web interface where a button "Firewall" is visible, even though it is missing any written documentation about that feature. But I own an even cheaper Asus router, and it can do port- and IP-based filtering, so I would assume that this one can too (contact ASUS support when you need to know details).

But keep in mind that consumer-grade routers are rarely sufficiently hardened. The news about critical vulnerabilities in home-routers are numerous. There is a hard price-war on that market, and the support in form of fast security-patches for existing products seems to be one of the first cost-factors to cut down on.

When you use a consumer-grade router, you have to be aware that a skilled hacker which targets you specifically will likely find a vulnerability and use it to compromise it. Doing a risk analysis of this scenario is up to you. You need to estimate how likely it is that a skilled hacker gets interested in your data and how large the damage would be when your data would get stolen.

Answer 2

Thoughts around this: There are numerous factors that matter in such an environment. How much are you willing to spend on 'proper' firewalls and/or IT-security in general? Some hardware for an opensource firewall is not so much compared what can be expensive if some information gets exposed.

Firewalls in general do not need to be expensive; have a look at pfSense. It is totally opensource and free, requires little to nothing in hardware, has a lot of packages etc.

If, however, you choose to go with a router, there is OpenWRT and DD-WRT at your service, totally free and deliver what you might want.