Netgate SG-1000 microFirewall

Author Topic: Hardware for gigabit WAN but no NAT required  (Read 266 times)

0 Members and 1 Guest are viewing this topic.

Offline CheltenhamMan

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Hardware for gigabit WAN but no NAT required
« on: December 30, 2017, 10:58:20 am »

Iím about to get symmetrical gigabit FTTP installed. As itís a home package, I have to use the supplied Genaxsys ONT/Router. You can only get it set to bridge mode if you pay a small fortune for a business package.

So - I was wondering about using the DHCP/NAT on the supplied router (to avoid double NAT), but then placing a PFsense box in-line between that and my main switch to do firewall, basic IDS/Snort work, as well as host an OpenVPN server to give me some security when Iím working away. Doesnít have to provide gigabit speeds, obviously, as itíll be the hotel Wi-fi thatís the likely bottleneck.

If I donít need to do NAT, does this mean I can get away with a lesser specced box? And are there any recommendations? I know itís unorthodox to firewall inside the main router, but as itís not a trusted device (by me) and thereís the double-NAT thing, it seemed a sensible option. Please advise if there is a better way, though.

Many thanks in advance.

Online Harvy66

  • Hero Member
  • *****
  • Posts: 2360
  • Karma: +220/-12
    • View Profile
Re: Hardware for gigabit WAN but no NAT required
« Reply #1 on: December 30, 2017, 08:01:21 pm »
I double NAT with my ISP. I have the option to bridge, but once already they accidentally switched me back to "Gateway" mode because that's the standard. I'd rather not be different if there's not much benefit. I placed my firewall in the DMZ of the ISP's gateway, allowing pfSense to control all of the port forwarding and UPNP related features.