Firewall / Router for small growing business

Question

Apologies for the fairly basic question. We are a fast growing business (12 employees and roughly planning to double in next two years)

Part of our work involves direct connection to our customer networks. Typically we do this via VPNs.

A new and larger than usual customer is asking for a lot of info regarding our firewall and configuration and it seems wants to set up a site-to-site VPN.

We have been running well for some time on a leased line with a good quality router. We open certain ports (such as web, VPN) and forward them to the appropriate IP addresses internally.

We are also moving to a new office and trying to set things up well/better there.

As well as the above should we have a hardware firewall? What is the advantage over a router that only opens certain ports?

A basic firewall such as SonicWall SOHO seems to be the way to go. If we bought this, it would sit in between the router and the rest of the network? And we would just leave everything open on the router to allow the firewall to manage the connections? And it would still allow us to route the right ports through to where they need to go?

We may need to engage some experts, but we have considerable network experience in house but not with this aspect. So hoping we can handle it ourselves with a bit of a steer.

Appreciate any help.

Thanks,

James

Answer 1

While product recommendations are off-topic for this forum, you are correct that the firewall should be placed between the router and the rest of the network. The big change is that now the default gateway of all your PCs will point to the firewall instead of the router. Similarly, the router now points to the firewall instead of the internal network

For those devices that are accessible from the outside, good practice says to put them on a separate network (called a DMZ) and a separate interface on the firewall. You should only allow the necessary ports into the DMZ from the outside.

To implement a site-to-site VPN, a hardware router makes things much easier. You also want to limit inbound traffic from the VPN tunnel.

Answer 2

Just check the subscription model of the SonicWall.. I'v heard it can be rather, unappealing.

Are you part of the IT Dept of this fast growing company? If not, I'd outsource the work to a company with a decent rep, or perhaps there are users on here that can do consulting for you. Unfortunately with security, you only have to be wrong once, to have a MAJOR headache on your shoulders.

Answer 3

Regarding router vs. firewall, firewall appliances nowadays incorporate the router functionality which makes a dedicated router obsolete. You do need some device to interface with the WAN line, and preferably a modem (xDSL, fiber,...).
Often, your ISP supplies this access device, and if it is a router it should be configured to let traffic out and in without any policing; that is up to the firewall.
For a site-to-site VPN the terminating VPN gateway needs a public IP address. A modem just hands over the traffic so it doesn't 'use' the WAN IP address for itself; a router does, and you would have to take care your firewall gets one as well (a second one).
If you look for a firewall think about content security as well - anti-virus, IPS and so on. Vendors handle this differently. SSL inspection is another topic as the majority of malware comes in on encrypted traffic (mail, browsing). You will notice at this point that advice from an experienced professional might be due.