Apologies for the fairly basic question. We are a fast growing business (12 employees and roughly planning to double in next two years)

Part of our work involves direct connection to our customer networks. Typically we do this via VPNs.

A new and larger than usual customer is asking for a lot of info regarding our firewall and configuration and it seems wants to set up a site-to-site VPN.

We have been running well for some time on a leased line with a good quality router. We open certain ports (such as web, VPN) and forward them to the appropriate IP addresses internally.

We are also moving to a new office and trying to set things up well/better there.

As well as the above should we have a hardware firewall? What is the advantage over a router that only opens certain ports?

A basic firewall such as SonicWall SOHO seems to be the way to go. If we bought this, it would sit in between the router and the rest of the network? And we would just leave everything open on the router to allow the firewall to manage the connections? And it would still allow us to route the right ports through to where they need to go?

We may need to engage some experts, but we have considerable network experience in house but not with this aspect. So hoping we can handle it ourselves with a bit of a steer.

Appreciate any help.



  • Product recommendations are off-topic here.
    – Ron Trunk
    Sep 5, 2015 at 14:15
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 5:49

3 Answers 3


While product recommendations are off-topic for this forum, you are correct that the firewall should be placed between the router and the rest of the network. The big change is that now the default gateway of all your PCs will point to the firewall instead of the router. Similarly, the router now points to the firewall instead of the internal network

For those devices that are accessible from the outside, good practice says to put them on a separate network (called a DMZ) and a separate interface on the firewall. You should only allow the necessary ports into the DMZ from the outside.

To implement a site-to-site VPN, a hardware router makes things much easier. You also want to limit inbound traffic from the VPN tunnel.

  • Thank you Ron. Does the firewall end up providing our VPN for us too, or I suppose the alternative is to put our VPN server (which is currently a standalone Linux machine that just does that) in the DMZ?
    – James
    Sep 7, 2015 at 10:28
  • Yes most hardware firewalls will terminate the VPN tunnel for you .
    – Ron Trunk
    Sep 7, 2015 at 12:04

Just check the subscription model of the SonicWall.. I'v heard it can be rather, unappealing.

Are you part of the IT Dept of this fast growing company? If not, I'd outsource the work to a company with a decent rep, or perhaps there are users on here that can do consulting for you. Unfortunately with security, you only have to be wrong once, to have a MAJOR headache on your shoulders.


Regarding router vs. firewall, firewall appliances nowadays incorporate the router functionality which makes a dedicated router obsolete. You do need some device to interface with the WAN line, and preferably a modem (xDSL, fiber,...).
Often, your ISP supplies this access device, and if it is a router it should be configured to let traffic out and in without any policing; that is up to the firewall.
For a site-to-site VPN the terminating VPN gateway needs a public IP address. A modem just hands over the traffic so it doesn't 'use' the WAN IP address for itself; a router does, and you would have to take care your firewall gets one as well (a second one).
If you look for a firewall think about content security as well - anti-virus, IPS and so on. Vendors handle this differently. SSL inspection is another topic as the majority of malware comes in on encrypted traffic (mail, browsing). You will notice at this point that advice from an experienced professional might be due.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.