1

I am at a small firm (12 PC on the internal network). We use this network architecture now:

Internet(Modem) --> Router --> Firewall --> Switch -- > Internal Network (clients PCs)
                |                       |
                |- Wifi Router          |- DHCP & AD Server
                |- HTTP file server 

The Main server and the clients PCs are (relatively) new (to other components), they were bought in 2005. But the other hardwares are creepy old ones, lot of them is older than 15 year. They became the bottlenecks of the network.

Here I describe all of the components in a short shoot:

  • The Router is an old ASUS (Rx3041)
  • Firewall is a MS Server 2003 R2 with ISA 2006 installed (now formerly Forefront Threat Management Gateway) Definitely this is the main bottleneck of our network, we need to restart this server more than one per week, because it randomly start to drop allowed connections.
  • DHC & AD Server is a MS SVR 2008 R2 and it also operates as an internal file server and internal HTTP server (We run a Redmine issue tracker on it. But not on IIS.)
  • Wifi Router is just simply an access point to the internet outside of our firewall for our wireless devices such phones and tablets (but no laptops or computers, which we use for work.)
  • HTTP File server is an old laptop, which is out of the firewall too (However we have a rule for it to reach it from internal network, so we use it as a network drive to publish some stuff.

While our programmers work out of office, so we don't have any sensitive information on most of the client PCs except one. Our server store sensitive information too. (source code, our clients information, etc..)

We want to fresh up our network a bit. We plan to use only one router instead of 2 routers and a firewall. It looks like this:

Internet(Modem) --> Router with wifi --> Switch -- > Internal Network (clients PCs)
                           |                      
                           |- HTTP file server (DMZ maybe?)

We want to use the Asus RT-AC66U router.

I read this great answer from Bill Frank, but that question is three year old and things change fast. Maybe routers evolved enough to be able to secure a network. So my question: is this a viable option? Could a router protect us? Or must we use (still) a hardware firewall to protect our network? (We should, but must we?)

We choose this option because of the matter of money. If I could I setup a new router and place the whole network behind a firewall (on new machine) but management say there is no easy money can be spent for that. Should I fight for a new firewall server? Or the router will be enough?

  • You are considering to buy consumer-grade hardware, so you seem to be on a budget. How tight exactly is it? – Philipp Apr 10 '14 at 8:17
  • What are your security requirements? How important are the business secrets do you need to protect and how large would the damage be to you or others when they would get compromised? – Philipp Apr 10 '14 at 8:22
  • We could buy this router for 200$ and this was the border, I want one a more expensive one but they want a cheaper one so this was the middle path. They just really don't want to spend on this. (I want to buy one for 400$ the said we could buy a server from that money. We couldn't, but it show how they thing about it, sadly.) – NoNameProvided Apr 10 '14 at 8:22
  • We develop accounting software, and the entire source code is on our main server, so I think the damage would be big. (Hoewer very sadly the main developer said it recently that it is not a problem if the source code leaked, because it so big that they cant use it for anything... they are just so wrong.) – NoNameProvided Apr 10 '14 at 8:29
2

Many routers - even in the consumer-segment - have basic network filtering capabilities based on protocol, port and IP, which means that they can also be used as a basic firewall. Dedicated firewall appliances often offer additional features, like deep-packet inspection to detect certain known threats on the protocol-level or automatic attack detection based on heuristics (they can warn you when someone seems to be probing your network for vulnerabilities). Whether you need this or not depends on how secure your network needs to be and how much this security is worth to you.

The manual of that router shows some screenshots of the web interface where a button "Firewall" is visible, even though it is missing any written documentation about that feature. But I own an even cheaper Asus router, and it can do port- and IP-based filtering, so I would assume that this one can too (contact ASUS support when you need to know details).

But keep in mind that consumer-grade routers are rarely sufficiently hardened. The news about critical vulnerabilities in home-routers are numerous. There is a hard price-war on that market, and the support in form of fast security-patches for existing products seems to be one of the first cost-factors to cut down on.

When you use a consumer-grade router, you have to be aware that a skilled hacker which targets you specifically will likely find a vulnerability and use it to compromise it. Doing a risk analysis of this scenario is up to you. You need to estimate how likely it is that a skilled hacker gets interested in your data and how large the damage would be when your data would get stolen.

  • I know about that they have basic firewall, the question is: are they enough to keep safe our network? +1 for warn me about the lack of fixing vulnerabilities – NoNameProvided Apr 10 '14 at 8:47
  • @NoNameProvided Dedicated firewall appliances often offer more than just port+ip-based filtering and have features like deep-packet inspection and automatic attack detection. Whether you need this or not depends on how secure your network needs to be and how much this security is worth to you. – Philipp Apr 10 '14 at 8:53
2

Thoughts around this: There are numerous factors that matter in such an environment. How much are you willing to spend on 'proper' firewalls and/or IT-security in general? Some hardware for an opensource firewall is not so much compared what can be expensive if some information gets exposed.

Firewalls in general do not need to be expensive; have a look at pfSense. It is totally opensource and free, requires little to nothing in hardware, has a lot of packages etc.

If, however, you choose to go with a router, there is OpenWRT and DD-WRT at your service, totally free and deliver what you might want.

  • Hmm I give a look to pfSense, thanks! This custom firmwares could be installed on any router? – NoNameProvided Apr 10 '14 at 8:54
  • If you mean DD-WRT and OpenWRT wich count as firmware (IMHO) there is a database at their website with supported routers (Alot). If you mean pfSense it runs on any x86 proc arch, it's a FreeBSD at base – Neophyte Apr 10 '14 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.