pfSense Firewall

Over the past few months my company has been testing out a different firewall products to protect us from all you h4x0rs out there. Our old Watchguard Firebox is no longer supported so we needed to look elsewhere.  We started by looking at a couple of commercial products and despite having a $5000 budget for a new firewall we decided to give pfSense a try.   pfSense is a open-source customized FreeBSD installation that is designed from the ground up to be a solid, secure firewall.

Last night I found myself at work late so I decided that after two months of testing it was time to move the pfSense installation onto a production server.  I re-purposed an older 1U Pentium 4 4GB of RAM server that was a decomissioned FreeNAS box. Now I releze that this is overkill but it was the only rack mountable server that I had available.

The server has two internal gigabit NICs and 2 dual port NICs for a total of six network interfaces and we are using all but one.  Currently we have LAN, WAN, VPN, Training Network, and finally the Guest Wireless  all hanging off this box.  We are running the Captive portal on the Guest Wireless and currently I am testing the OpenVPN that is built into pfSense to replace our old MS PPTP VPN.

pfSense has a package repository that is contains community created packages.  We have installed the Arping, Cron, and Snort.  After running the Snort package for a few weeks on the test server (but in production) I determined that China is a pain in the ass due to constant hacking attacks to our FTP server so I found the package Country Block which allow for you to drop packets coming from specific countries.  Lucky we are not an international company so I was able to block China, Korea, Russia, and a few others.  (Sorry if you are from those countries but a few bad apples ruin it for everyone.)

All and all this is an excellent firewall product that I would recommend for any SMB.  They have an excellent community to help you if you have any issues and if your company is worried about relying on strangers they also have commercial support.  I have barely descriped a tenth of the features that this awesome product contains so head over to their website for more indepth information.