Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough".

For the most part the router acts as an NAT with all ports locked down unless explicitly forwarded. Most of them even allow you to block outbound ports as well. This is the bulk of what one needs a firewall for.

So tell me, what other capabilities, or "needed features" would one get out of running a "real" firewall in addition to their NAT router and why would one purchase that.


Routers are, internally, computers. They run an operating system (often a Linux or VxWorks derivative), with code. Like any substantial piece of software, they have bugs, some of which being remotely exploitable. However, unlike computers, they are rarely updated, so whatever security holes they have tend to be long-lived. And that's without counting more basic issues like default admin passwords.

While, conceptually, the router can be your firewall and thus any other firewall would be redundant, you would be well-advised to run an additional protection layer, such as a small PC with two ethernet interfaces, acting as a router/firewall, with a Unix-like operating system (some Linux or BSD flavour, for instance). The important point here being maintenance: don't consider the box as an opaque appliance to be installed and then forgotten. You have to check for security updates, preferably daily.

I thus recommend installing another firewall in addition to your SOHO router, not because the router would structurally be bad at firewalling, but because adequate security is reached only if proper system administration is applied, and you cannot really do that with a SOHO router; whereas you can with a PC and an open-source, maintained operating system.

  • Good points. I have never seen an exploit that was able to bypass a linksys router NAT to actually route to a host that is not explicitly forwarded. It is a very simple thing. "deny all if not allowed". I am not counting the CSRF remote admin vulns or default password because I am operating under the assumption that when I configure the router I will not be a complete idiot ;) – sectek Aug 13 '13 at 15:19
  • I also operate under the assumption that whoever I install this for is not going to be logging in (and having a live session to CSRF) – sectek Aug 13 '13 at 15:33
  • @sectek Remote-execution exploits exist for some older incarnations of the Linksys software stack, the firewall configuration is largely irrelevant in such cases. – lynks Aug 13 '13 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.