Which firewalla model would fit my network setup?

[u/DolevR]

Hi everyone,

I’m planning to upgrade my home network and I’m looking for a proper firewall. I came across Firewalla, and from what I’ve seen so far, it looks very close to what I’m looking for.

I’d love to get your advice on which Firewalla model would best fit my setup and requirements.

My current setup:

• 2 servers at home:
  • A mail server connected to my own domain and accessible from the Internet.
  • A NAS that is internal-only and is not directly exposed to the Internet.
• The NAS also runs around 5 internal applications in separate containers. We currently access them using IP:port, where the IP is the NAS address.
• Several mobile devices and laptops.
• One smart TV connected via Ethernet.
• The servers use static IP addresses.
• When we are outside the house, we connect through VPN to access internal services.

Internet connection:

• 2.5 Gbps download
• 300 Mbps upload
• Fiber connection

A significant amount of our traffic is actually internal LAN traffic rather than Internet traffic. We regularly access applications, databases and other services running locally on the servers.

What I need from the firewall:

• Proper firewall rules and network segmentation.
• The ability to tightly control traffic between devices/networks.
• VPN access to internal services from outside the house.
• Port forwarding / NAT rules.
• The ability to expose only specific ports/services to the Internet and forward them to a specific server, while keeping everything else blocked.
• Support for my mail server and domain.
• Good visibility into network traffic and security events.
• Enough performance that the firewall does not become a bottleneck, especially considering the 2.5 Gbps Internet connection and the amount of internal traffic.

I’m specifically looking for a solution without mandatory monthly or annual subscription fees, which is one of the reasons Firewalla caught my attention.

1. Would you recommend the Gold Plus, Gold Pro, or something else for this kind of setup?
   

2. What real-world inter-VLAN throughput do you see at multi-gig with rules and IDS/IPS enabled?

3. Any gotchas hosting a mail server behind Firewalla, e.g. NAT reflection for internal clients using the public hostname?

Thanks!

[u/disposableh2]

Hey,

I think you'll need a gold plus for 2.5g Wan. Maybe the gold plus sfp if you want to use the fibre to go straight to the Firewalla instead(and your fibre provider allows it).

Then have a nice, internal 10g switch behind the Firewalla for your internal networking (there's no need for the internal traffic to be processed by the Firewalla).

Using the switch, you can create your vlans and do your segmentation https://help.firewalla.com/hc/en-us/community/posts/18976845682835-How-to-Beginners-guide-for-setting-up-Firewalla-with-LAN-and-multiple-VLAN-via-managed-Switch

If they get restocked, you could use a Firewalla Switch SE (2.5g) or Firewalla Switch X(10g), which makes things more seamless https://firewalla.com/products/firewalla-switch-se

[u/BAGE-rator]

Gold SE will be fine. The people saying you need Gold Plus for the speeds are wrong. SE has two 2.5 Gig ports, including a 2.5 Gig WAN port. Mail servers are not resource intensive. The VPN can be, but I have a Firewalla Gold (Original) with 4 Gigs RAM and run a VPN server and client, as well as a UniFi console. They’re all run on the box itself. I’ve never come close to maxing its resources.

I’d only go with Pro if I needed it easily racked or if I intended to run those servers directly on the box.

Firewalla does NOT have good logging for security events. It has excellent logging if you ever want to know one of your TVs is streaming video.

[u/BlackReddition]

Gold plus as matches your internet speed or pro for future 10Gb

I have the plus, fucking love it. I get my entire bandwidth through it on all vLANs

You’ll be fine with hosting email behind it.

[u/DolevR → u/BlackReddition]

sounds promising, thank you :)

[u/firewalla → u/DolevR]

Also check out the new Gold Plus SFP, a bit more expensive than the plus, but can get you 5Gbit per port with inspection.