Home Firewall - Is it worth it, if so which?

[Theldron]

Hi all,

 

I never got around to setting up a firewall at home.

 

We are in the processing of moving into our own home, so really want to get a decent home network setup, one of the things I am thinking about is a firewall. I have 3 kids all have access to the internet.

 

1. Is it worth having a separate firewall at home?

2. Is separate PC or VM sufficient?

 

I am looking at PFSense, so would like filtering for the kids, adblocker, the ability to limit the time on the internet if i need it.

 

Any advice would be appreciated.

 

Thanks

[robyholmes]

Just a 3rd party all in one myself but have you considered a UniFi Dream Machine?

[Theldron]

Just a 3rd party all in one myself but have you considered a UniFi Dream Machine?

 

Thanks that looks awesome, don't think I can afford something like that, as we need to do some work on the house. Sorry I should have said, I have a lot of excess PC hardware, so looking for something possibly open source or cheap, that I can build myself.

[Jcx500]

I use Sophos utm (the free edition ) I think it’s free upto 50 IP addresses , have it running on my home hyper v host

[Liam]

I use Sophos utm (the free edition ) I think it’s free upto 50 IP addresses , have it running on my home hyper v host

Me too. Works very well

[aicrd]

I use Untangle. The home edition is $50 a year with unlimited devices. You get access to all the same features as the business / education users as well such as web filtering and OpenVPN.

 

Its also got some really nice reports. Allows me to see exactly who is on my network, what sites they are visiting and how much bandwidth is being used.

 

They have a demo you can play around with: Untangle

Edited November 8, 2020 by aicrd

[computer_expert]

I use Sophos utm (the free edition ) I think it’s free upto 50 IP addresses , have it running on my home hyper v host

 

That was for the older (better) UTM product. The newer XG one has hardware restrictions (4 cores and 6GB ram) and no IP limits.

 

 

DNS ad blocking on pfSense can't get much better the the pfBlockerng addon. If you don't go down the pfsense route, then there is always pihole (which will run on x86_64 machines).

[free780]

Is there much point to protect kids if you have to do SSL Interception? DNS blocking can prevent some nasty sites. You can sign up for open dns for free.

[aicrd]

You dont have to do SSL Interception. Untangle works just fine without it. You just get a HTTPS error message instead of a block page when visiting a HTTPS site. Works the same way a Smoothwall does and doesnt use DNS, which can easily be bypassed.

[XiJ]

I’ve started using Cloudflares 1.1.1.3 for dns ‘filtering’ for the kids. They have their own wireless network on their a vlan.

 

I’ve toyed with open dns in the past.

 

Actually firewall is a Mikrotik router.

[aicrd]

I wouldn't use DNS for filtering as its easily bypassed. You can just change the DNS settings on your local device. This is why I replaced my Virgin router as their childsafe service was DNS based and it was bypassed.

 

Obviously it depends on the technical knowledge of your kids and even a web filter can be bypassed if they're determined enough. I've got enough trouble trying to prevent them getting past the filter at work let alone at home!

[XiJ]

The best thing of course is just to talk to them. Which is what we do. They’ll come ask us if they aren’t sure about something. The dns level stuff is for the innocent searches etc. Set at router level and leave it.

[Danp]

I know it's not a firewall or filtering solution, but our home network runs so much better with my old Pi running PiHole.

[mcolbourn]

You can prevent most DNS bypassing methods but just setting up firewall rules to only allows DNS out to specific devices. I use a UDM and then use nextdns at home (you can even run the client as a container on the udm https://github.com/nextdns/nextdns)its mainly to prevent the accidents but also gives some more defence against malware and phishing . But both of my kids know that if they see something that upsets them etc they come and have a chat I won't tell them off talking is always the best way of education.

[k-strider]

I use Sophos utm (the free edition ) I think it’s free upto 50 IP addresses , have it running on my home hyper v host

 

And Me, i bought a fanless mini pc with 2 Nics something like this https://www.mini-itx.com/~JBC420