Sin100

Is there a difference from normal firewalls you use on your everyday PC (zone alarm, AVG firewall, McAfee etc) and firewalls you use on a large/semi-large network.

The reason I ask is because I am writing a report on how I would computerise a ticket company (database, website, network etc) and I started to think about security for the network I have 'built' (although it is virtual/non existent).

The virtual company has a server (and a backup server) with 10 nodes (PC's for sales staff)

__________________

Counter Strike Source OCN Server = 66.150.214.50:27015

COD4 OCN Server = 208.167.251.231:28960

Dawlish7

I think it depends on the person setting it up, like some person may use a hardware firewall, or server grade firewall or something like zone alarm or windows in built firewall it depends on the setup, but i am not sure on how most operate personally i would use something linux based, im no expert, Experts will come chris :P


Edit : found this http://www.securepoint.cc/products.html hardwareish,

there are linux distros dedicated for network security,

hope this helps

Some linux firewalls


http://www.ipcop.org/

http://www.smoothwall.org/

http://www.untangle.com/

__________________
R.I.P - XAslanX Amigos

Bonz™

Software firewalls for business are generally more expensive and you buy them in bulk (25-100 persons, 100-500 persons etc) As far as software firewalls I don't believe there is any difference.

Hardware firewalls that a person may use at home would be something like IPCop, Smoothwall. These are just community linux distros tailored as a firewall. Corporate hardware firewalls are not much different. They are generally a proprietary OS made as a firewall with dedicated guaranteed hardware backed by support. They also usually have license fees and usually 24/7 support.

As far as actual performance, there isn't a whole lot of difference.

Anybody feel free to add on or correct anything.

__________________
Bonz::Asmodian Templar of Zikel

Total Available Storage
Currently: 8,377 GB (useable)

Dawlish7

nice job, i think you have it covered

__________________
R.I.P - XAslanX Amigos

Bonz™

I use Endian Community firewall at home, and a Sonicwall TZ 170 at work.

The Endian is free and contains many different features, but is only backed by community support. I also have to own a PC to put it on.

The Sonicwall has a yearly fee attached, and it's a dedicated hardware device. It also has Licensed features that cost money each year depending on what you want. They have onsite support and 24/7 call support.

I have scoured both devices and found nothing different between the two. They both offer SPAM filters, Gateway AV, P2P VPN connections, Traffic monitoring (I think Endian exceeds Sonicwall's capabilities here), HTTP Proxies etc. Although there are more expensive firewalls out there with much better options than our Sonicwall, a standard small business firewall will not be much (if any) different.

__________________
Bonz::Asmodian Templar of Zikel

Total Available Storage
Currently: 8,377 GB (useable)

Sin100

Thanks a lot guys, and Bonz, you summed it up well, this will certainly help

__________________

Counter Strike Source OCN Server = 66.150.214.50:27015

COD4 OCN Server = 208.167.251.231:28960

Bonz™

No problem

__________________
Bonz::Asmodian Templar of Zikel

Total Available Storage
Currently: 8,377 GB (useable)

yawnbox

There are many different categories of firewalls. Packet filter, Stateful, Application Proxy, Unified Threat Management (UTM), Intrusion Protection System (IPS), and Network Address Translation (NAT). There are huge differences when it comes to performance; however, as a single home user you will not notice the limitations of throughput.

There are many differences between these technologies. Packet filtering is the oldest and the most basic. Any "firewall" has some level of packet filtering. Stateful firewalls are the most common among home users, and also another feature built into any firewall system. However Stateful firewalls differ based on firewall vendor, because with UDP and ICMP traffic, for example, there is no complete state for the firewall to monitor, unlike a classic TCP protocol where there is a well defined start and end of any given session. examples of appliance-based stateful firewalls include most any home-based router or wireless access point that you can find today, and a server-based stateful firewall would include ipcop, smoothwall, m0n0wall and pfsense. Some of these server-based stateful firewall distributions support basic Intrusion Prevention System technologies.

Application Proxies are the most "in depth", and most secure firewall technology because it is basically the middle man between all communications. It is most commonly used in Web-based services environments, and are not used in high-bandwidth intensive environments because of the amount of processing that comes along with an application proxy firewall. An example of an application proxy would be Microsoft's ISA server, which can run in server-core which is highly secure. The best use of this server-based application proxy firewall is for internal (within the LAN) use only. One of the very best appliance-based application proxy firewall solutions is the Secure Computing Sidewinder firewall.

UTM firewalls combines several firewall technologies, including stateful firewall, intrusion prevention system, anti-virus, -spyware, -fishing, -adware, -spam, and web filtering. UTMs are also used primarily in low-throughput intensive environments, with low-user counts. The IPS capabilities in UTM firewalls are typically subsets of full blown IPS features. And anti-virus functionality is generally limited to HTTP, SMTP, and POP3 protocols only. Examples include netbox blue, sonicwall, untangle, endian firewall

Intrusion Prevention System (IPS), following the Intrusion Detection System (IDS), differs from UTM because it is much more feature-rich. UTM consists of a couple hundred signatures and only supports a dozen or so protocols, where as a full IPS will utilize several thousand signatures and over 40 protocols. Of course this is dependent on the vendor and/or product. Stand alone appliance based IPS can also support up to multi-gigabit speeds.

There are many different kinds of Intrusion Detection and Prevention Systems (IDP), and vendors will often interchangeably use some of them which more often than not confuses the end user. Vendors like to call detection "reactive" and prevention "proactive." IDP is a subject that is out of the scope of this thread, but I highly encourage people to go out and read about them.

Intrusion Detection and Prevention Systems (IDP)
Includes IDS and IPS functionality.

Intrusion Detection Systems (IDS)
Considered the first-generation term. Passive monitoring.
Intrusion Detection (ID)
Also called "sensors."
Network Intrusion Detection Systems (NIDS)
Host Intrusion Detection Systems (HIDS)

Intrusion Prevention Systems (IPS)
Considered the second-generation term. Active monitoring.
Network Intrusion Prevention Systems (NIPS)
Example: McAfee IntruShield
Host Intrusion Prevention Systems (HIPS)
Example: IBM Proventia Desktop and Server Endpoint Security

The largest "firewall" (device) providers are Cisco, Juniper, and Check Point.

__________________
Athlon XP 1700+ 1.4GHz to 2.39GHz
Intel Core2 Duo E6600 2.4GHz to 3.4GHz
Intel Xeon X5272 3.4GHz to 3.66GHz