2

I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic that I've outlined below for which I hope to get your invaluable suggestions and advice!

My topic:

Today’s small to medium enterprises (SMEs) are a dynamic environment filled with many applications programs, databases, Internet, and wireless access. In addition, SMEs require Internet connectivity to many of its branches. Securing your network and reputation could be provided expensive firewalls. You are to investigate the use of freeware or shareware tools to provide similar functions to that of firewalls. Investigate readily available tools on the public Internet at a budget to provide:

  • One appliance network security.
  • Provide Internet access (after business hours)
  • Keep computers free from virus and malware threats
  • Role-based user privileges - define what students, teachers, staff or visitors/customers can access when on your network.

What my professor needs me to do is basically use a server (which can be an old PC running Windows Server 2008) as a firewall (instead of using a standalone firewall device in order to reduce costs) between my internal company network and the Internet.

He wants me to investigate the freeware/shareware applications available on the Internet so that I could run them on that server to make it an effective replacement for a standalone firewall so as to reduce costs, but provide effective security at the same time for a small company network with limited financial resources.

So far, I have got the small company network design ready but that is all I have been able to do. From my understanding the server (old PC running Windows Server 2008) will require 2 network cards - one to connect to my internal company network switch and the other to connect to the Internet.

I would love to get your suggestions/guidance on how to go forward with the rest of everything right now.

Improve this question
2
  • 1
    you're right about the 2 nic setup
    – schroeder ♦
    Mar 28, 2012 at 17:12
  • 'keep computers free from virus and malware' I hope is a paraphrase. A firewall has limited ability to do that, unless it is also inspecting email content, attachments, etc.
    – schroeder ♦
    Mar 28, 2012 at 17:13

2 Answers 2

Reset to default
2

This is all predicated on using the "old pc running Win Server 2008" (I assume you mean Microsoft Windows Server 2008) as a gateway.

This predicate poses a number of issues:

  1. MSWindows in it's various incarnations, is heavier on resources - running the most up to date (i.e. feature rich) version of the operating system on old hardware is hardly a recipe for good performance / reliability.

  2. IMHO, BSD and Linux operating systems offer a far greater set of facilities for networking / managing security out of the box then MSWindows does

  3. MSWindows Firewalls are typically implemented within or on top of winsock.dll, which can leave a lot of the network stack exposed compared with iptables / ipfw

  4. There is a far more diverse and complete ecosystem of free code available for Linux / BSD than for MSWindows

  5. Point 4 is particularly true to applied to free software (as defined by Gnu project et al) where the guarantee of access to the source code gives better opportunity for review of the quality of a product (yes there's lots of freeware/shareware for MSWindows - but where's the source code?)

  6. This ecosystem, in addition to peer review, also gives rise to diverse community support

The argument that the skills for running, say a Linux server are not as widely available in the organisation compared with MSWindows skills is not valid: to add value whoever manages this must understand about security, network protocols, policy planning and implementation....what operating system is used to deploy the implementation on is a very small detail in terms of skill requirement.

So forget about freeware/shareware and go look for "Free software".

Improve this answer
12
  • Agreed. Maybe something you can start looking into is PFSense. A FreeBSD operating system built specifically to be a router/firewall. pfsense.org
    – Safado
    Mar 28, 2012 at 15:53
  • Thanks for your replies guys. Although I agree with you that using a Linux OS here makes more sense, the only problem I see here is that I have never used Linux before. So if I do use Linux here, what version should I download and install on the old machine to make it an effective firewall?
    – ken99
    Mar 28, 2012 at 16:35
  • Also, I need to prove that the old machine is able to stop network mapping software like Nmap and Angry IP scanner from accessing my internal company network from the outside. Do you think that Linux would be able to carry out that task? And Ryan, can I use PFSense on a clean machine or does it need to have an OS on it like Windows/Linux? @RyanM.
    – ken99
    Mar 28, 2012 at 16:52
  • 1
    For project purposes, use Ubuntu and set up iptables for firewalling. There might be more secure and better Linux distros, but for a first timer, go the easy route. I totally agree that Linux is what you need for this project, no question.
    – schroeder ♦
    Mar 28, 2012 at 17:09
  • 1
    Two other points: a) if you're doing any sort of computing degree, you're going to want to get at least comfortable in UNIX sooner or later, so don't worry about that. b) schroeder is insightful as ever - the role based privileges are going to be the challenging part, so watch out for that bit.
    – Graham Hill
    Mar 28, 2012 at 18:45
1

PFsense gets my vote, however if you are extremely uncomfortable with BSD/NIX*, there is always Untangle (*NIX based, but completely GUI, not that PFsense is really lacking here).

Edit: As for stopping Nmap and Angry IP, just pull the free Snort signatures in PFsense and configure it to stop port scans. If Nmap continues to find vulnerabilities on the server, enable those specific protections via snort

Improve this answer
1
  • Thank you for your suggestion! Untangle seems like it should be a little easier to configure, maybe bcoz its GUI based, like you said. Your suggestion about using Snort signatures to stop Nmap getting through sounds like it should work, although I honestly have no idea as to how should I go about implementing it! @Numpty
    – ken99
    Mar 28, 2012 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .