ISP, Firewall and Filtering Costings

[JonnyAlpha]

Hi all,

 

Bottom line up front:

 

To assist me in putting a ISP switch plan to the SLT, can anyone give me some ball park figures for what we would need to pay for a FireWall and who with.

We currently have a Windows Server Client setup in a two form entry Primary school.

Approx 30 staff devices and 150 shared devices for pupils (Windows Laptops, ChromeBooks, iPads)

 

Our ISP is currently RM Broadband (which apparently uses Talk Talk) - £3326.40 P/A

Firewall is included with our broadband contract

Filtering is also with RM using RM Safety Net - £689 P/A

Total £4015.40 P/A

 

In the Summer I managed to get our school down for a Starlink Satellite Internet Connection which has just been installed. we cannot use it yet as sorting everything else has taken too long and is still not there.

 

Before using Starlink we needed to find out whether or not we could continue with RM Safety Net Filtering. I have now finally had the answer that we cannot. I have also been informed that we will also need a separate Firewall, as that is also included with our RM Broadband contract.

 

Prior to finding out that we could not use RM Safety Net I had already been looking at alternative Filtering with Netsweeper and Smoothwall and have quotes for both.

 

Future costs (for the next two years) will therefore be:

Starlink ISPO - £0

Filtering and Monitoring - £1700 (uppermost quote)

Firewall - £500 (estimate - until I get an answer here)

 

Many thanks

[mavhc]

You don't need to pay anything for a firewall if you really don't want to. Not like you can have incoming connections on Starlink anyway, it uses CGNAT

 

If you want to limit outgoing connections then pfsense and similar are fine, run as a vm or on a standalone computer with 2 network ports

[MatthewL]

@mavhc you can have a public IP address on business packages rather than CGNAT.

 

- - - Updated - - -

 

Any good firewall will allow dual connections, you could use Pfsense, Watchguard both would support. There are others available.

[PotNoodleTech]

So you are going to use starlink as your main internet connection? That's really unusual in a school. Gennerally fibre to the cabinet would perfrorm singificantly better in most areas of the country - I guess if your in the middle of no where that may not be the case?

[synaesthesia]

So you are going to use starlink as your main internet connection? That's really unusual in a school. Gennerally fibre to the cabinet would perfrorm singificantly better in most areas of the country - I guess if your in the middle of no where that may not be the case?

 

Frankly I'd think that was absurd - akin to using X for all parental communication!

[PotNoodleTech]

Frankly I'd think that was absurd - akin to using X for all parental communication!

 

They seem to take more notice of twitter than any other commmunication method lol

[JonnyAlpha]

So you are going to use starlink as your main internet connection? That's really unusual in a school. Gennerally fibre to the cabinet would perform singificantly better in most areas of the country - I guess if your in the middle of no where that may not be the case?

At the start of this year I started to investigate our Infrastructure (I am the Computing Teacher and acts as the interface between the school and the offsite IT Sp).

We carried out a site survey and averaged 47MBps across the site, some areas much less.

 

We are in North Devon and have FTTC, so should be getting 80MBps to the Server. Full fibre for the area is out to contract (poss with Airband) with no setup date. I was then offered a free trial with Starlink

 

The IT Sp company folded and we currently have an interim setup. They did a speedtest to / from the server and got around 76MBps. They have also done a complete audit of our entire network and have identified that everything is out of date with a recommendation for replacement (circa £10K) (They are not a company, so this is not a money making exercise, it is a security requirement.

 

So with Starlink free for two years we can move away from RM, which I admit has given pretty reliable, but we can look for slight better VFM.

[synaesthesia]

At the start of this year I started to investigate our Infrastructure (I am the Computing Teacher and acts as the interface between the school and the offsite IT Sp).

We carried out a site survey and averaged 47MBps across the site, some areas much less.

 

We are in North Devon and have FTTC, so should be getting 80MBps to the Server. Full fibre for the area is out to contract (poss with Airband) with no setup date. I was then offered a free trial with Starlink

 

The IT Sp company folded and we currently have an interim setup. They did a speedtest to / from the server and got around 76MBps. They have also done a complete audit of our entire network and have identified that everything is out of date with a recommendation for replacement (circa £10K) (They are not a company, so this is not a money making exercise, it is a security requirement.

 

So with Starlink free for two years we can move away from RM, which I admit has given pretty reliable, but we can look for slight better VFM.

 

What are you using for phones? VOIP over starlink might be interesting when the latency starts hitting higher numbers.

[mavhc]

"Latency ranges between 25 and 60 ms on land, and 100+ ms in certain remote locations"

 

I get 38ms on a leased line to Gamma

[synaesthesia]

"Latency ranges between 25 and 60 ms on land, and 100+ ms in certain remote locations"

 

I get 38ms on a leased line to Gamma

 

We're on Gamma and the highest latency we get to pretty much anything is 10ms - I'd have severe questions for them at 38, even when fully loaded and QoS is kicking in!

[mavhc]

It's 16 now

 

5 5 ms 4 ms 4 ms man-tcw-sr2.net.exa.net.uk [82.219.45.1]

6 5 ms 5 ms 5 ms te0-3-0-13.rcr21.man02.atlas.cogentco.com [149.14.36.17]

7 5 ms 5 ms 5 ms be4509.ccr21.man01.atlas.cogentco.com [130.117.2.69]

8 10 ms 10 ms 9 ms be2174.ccr51.lhr01.atlas.cogentco.com [154.54.78.89]

9 11 ms 10 ms 10 ms be3487.ccr41.lon13.atlas.cogentco.com [154.54.60.5]

10 11 ms 11 ms 12 ms be2868.ccr21.lon01.atlas.cogentco.com [154.54.57.154]

11 * * * Request timed out.

12 11 ms 10 ms 20 ms ae2.3212.edge6.lon2.neo.colt.net [171.75.8.171]

13 15 ms 10 ms 10 ms GAMMA-TELEC.edge6.London2.Level3.net [212.187.167.190]

14 16 ms 16 ms 16 ms 88.215.54.252

[JonnyAlpha]

Frankly I'd think that was absurd - akin to using X for all parental communication!

That’s a completely different subject and out of my control. The school has MS 365, School Comms, Class Dojo and FaceBook. Teachers use a mix of all of them 😡😡

[JonnyAlpha]

What are you using for phones? VOIP over starlink might be interesting when the latency starts hitting higher numbers.

Initially we were going to leave the VOIP on the RM Broadband connection, but I have since identified that it expires in March. We may have to try the VOIP over Starlink and see how it goes.

[mavhc]

So the main question is: monitoring and filtering. Do you have anything installed on each computer to monitor/filter already?

[JonnyAlpha]

Frankly I'd think that was absurd - akin to using X for all parental communication!

Sorry what’s absurd? Using Starlink for our ISP or using VOIP over Starlink?

If it’s the ISP we’re paying nearly £4K PA for Broadband and Starlink is free for two years DfE funded trial.

I am going to start getting ISP quotes, but not sure who to look at?

[synaesthesia]

Sorry what’s absurd? Using Starlink for our ISP or using VOIP over Starlink?

If it’s the ISP we’re paying nearly £4K PA for Broadband and Starlink is free for two years DfE funded trial.

I am going to start getting ISP quotes, but not sure who to look at?

 

I think it's ideal as a second/backup line, but as a sole primary connection it's risky. The link to X is the owner - you have to wonder if it's still going to be around this time next week/month/year because someone does something a bit silly at the top But if you're paying nothing and it's just a stopgap it's no doubt better than nothing. Hopefully all goes OK for you though!

[JonnyAlpha]

So the main question is: monitoring and filtering. Do you have anything installed on each computer to monitor/filter already?

 

Currently using RM Safety Net proxy filtering, can’t use that if we stop using RM as our ISP. Looking at buying Netsweeper, Smoothwall or the like.

[JonnyAlpha]

But back to the original question, for Starlink and any other follow on ISP what Firewalls should we be looking at and how much?

[synaesthesia]

I'd look at both Smoothwall and Sophos XG - speak to Wave9 for the latter and Smoothwall directly for the former.

[tom_newton]

Happy to help out - sounds like we are well placed as we can do firewall and filtering all in the one spot.

Drop me a line - [email protected] - and I will put you in touch with the relevant people

 

Tom

[Wave9_Lee]

I'd look at both Smoothwall and Sophos XG - speak to Wave9 for the latter and Smoothwall directly for the former.

 

Thanks @synaesthesia

 

Happy to quote for firewall/filtering/monitoring anytime.

 

Ref the free trial - agree it's hard to turn down free, but as far as I'm aware there is no SLA with Starlink, be interested to know if that's changed. So no guarantees on uptime, throughput, latency, or fixtime in the event of an issue. So agree with the Starlink as a backup scneario. Few of of our customers have used it, but speed was variable and outages frequent. Kind of flies in the face of DFE broadband standards tbh.. Also, going by those standards, backup connection would be appropriate. SOGEA (previously FTTC, should be sub 25ms and Leased Line <5ms generally). Voip would probably be noticably bad at around 100ms+ or so. SOGEA and Leased Line you would get a 'proper' SLA with these, uptime guarantees, service credits, <6hr fix time guarantee etc.

 

Also need to consider your upstream bandwidth requirement.

 

Not trying to put starlink down, it's good in certain use-cases, just not as the main/only link in a school (unless there is absolutely no other choice)

 

But free is free - just consider what will happen if the service is deprecated or hard-down..

 

Pretty confident we could offer connectivity/firewall/filtering and monitoring for less than your current price including unlimited helpdesk support for all changes, robust SLA and service credits.. but we can't beat free : )

Edited November 7, 2024 by Wave9_Lee

[mavhc]

https://www.starlink.com/map?view=latency says it's about 25-31ms for uk

[exa_thomas]

We would also be happy to help with your filtering. You can drop me an email at [email protected], and I will ensure we get back to you. We have on-site and cloud-only solutions.

[PaddyNewman]

I mean you could query LGfL for a potential price (I work there, so would say that) but I've used Starlink for over 2 years, nearly 3. It's not 'perfect' and I'm seeing a lot worse connection these days but it serves a purpose.

 

https://www.starlink.com/map?view=latency says it's about 25-31ms for uk

 

I'd take their numbers with, well between a pinch of salt and a gritting lorry.

Edited November 9, 2024 by PaddyNewman

[mavhc]

I mean you could query LGfL for a potential price (I work there, so would say that) but I've used Starlink for over 2 years, nearly 3. It's not 'perfect' and I'm seeing a lot worse connection these days but it serves a purpose.

 

 

 

I'd take their numbers with, well between a pinch of salt and a gritting lorry.

 

What numbers do you have today?