You can walk around Best Buy or Circuit City and take a look at all of the small home office routers on the market. If you are looking for something that you can plug in with very little work involved, by all means invest your money into one of these cheaply manufactured devices. However, if you are reading this post then you are interested in providing this functionality yourself.
In making a decision as to what you would like in a home router/firewall, first ask yourself the question, “what features and functionality do I need?”. Here are a list of features that I wanted to use in my home office and what they provide:
Firewall: I wanted full control over what I want to protect. I wanted the ability to port map, meaning I want to connect to my home devices from anywhere I travel. Using RDP I want to connect to my windows desktops to perform support for my family and also retrieve files that I have lazily left on my home pc.
Router: I wanted to provide DHCP with more options, such as being able to provide more subnets, multiple dhcp ranges, and remotely but securely manage without worrying about https bugs causing my router to become unresponsive.
Content filtering: I do not have a problem with my teenager going out to adult websites or harmful websites, but I do feel the need to make sure that I understand that all content being access is acceptable. This control is a necessary feature I feel that all SOHO firewalls should support.
IDS: Like all devices that sit on the public network, you should have a clear picture as to what vulnerabilities that exist. I am able to analyze all traffic that are potentially harmful to my firewall. Or all vunerbilities that I am not protected against. An IDS system provides that information and makes me more security aware. I also have my webservers monitored by my firewall even thought they sit outside my network.
Scripting:
I use Awk, Perl, and Bash to provide automated services. My scripts let me know what I need to worry about and alert me of problems so that I do not have to manually look for them.
Everything I have named here either comes with the Ubuntu linux OS or can be readily downloaded. I must say that it took me a week to properly fine tune my firewall to my liking and it resides on a pretty old PII pentium server. I use snort for IDS and squid for Proxy. My firewall filtering is provided by iptables, which can be fairly difficult. You can download a program to act as iptables for dummies. I chose not to do that.
Most of you by now have wireless routers. The professor uses a wireless access point which is a router that I chose to disable to routing functionality. The reason for, hacking wireless access is fairly easy due to the lack of wireless security in home networks. I do not want my wireless router controlling my home network. I treat wireless access like any unsecured device accessing my network. This way I am able to quarenteen any security breach. What I do use for wireless security is an IDS monitor on my private ethernet interface so that i can analyze traffic, I use WEP ( which can be readily hacked), but i back that up with Dot1x security. So whenever I have guests I disable 802.1x and have them use my wep key. But majority of the time, my devices use mac security.
You can easily implement what I have in my home to an enterprise. What I will say is that even though if properly configured this can be just as secure as any enterprise, but automation may take special skill sets as there is not alot of engineers that think, they have their vendors think for them. Checkpoint and Cisco ASA’s are both devices that come with solutions that automate much of your protection. But think about this, now a days most of the cars are automatic. If you ever driven a stick, you can tell by the sound of your vehicle how your car is running. Automatic cars create automatic people who are unable to tell if the pulse of their car is operating correctly. Manually handling your own security makes sure you properly understand how your security is working and not take the word of a device which claims they are protecting your network properly.