Things to look for in a Hardware Firewall
You’re absolutely right. The rapid growth of home broadband use, coupled with the shift towards remote and hybrid work environments, has significantly increased the potential for cyber threats. Consumer-grade routers often lack the advanced security features needed to protect against sophisticated attacks. By adding a hardware firewall appliance, you can bolster your network’s defense and gain control over traffic management, intrusion detection, and more secure connections to corporate networks. A hardware firewall appliance can provide features such as VPN support, deep packet inspection, intrusion prevention systems, and customizable filtering. These help ensure that your home network remains safe while connecting securely to remote work environments. Do you currently have a firewall in place, or are you considering setting one up? Throughput and ports You want high throughput numbers, especially once you turn on filtering and inspection Before looking deeper into the functionality of a hardware firewall, you want to know two things. The first is how many ports it has and the speed of those ports, because that determines both current and future setup needs. As hardware firewalls, when used in home networks, are usually set up as edge devices, they go between the internet and your internal hardware. That means you might only need two ports, but it’s important to match the speed of these to your existing hardware so they can all sync up together. They could also be used for internal segmentation, but that’s less likely at home. It’s still important to match port speeds with existing hardware, but you might want more ports so that future expansion can be planned. You’ll also want to check the throughput of the firewall, which is the volume of traffic that can pass through at any one time. Most firewalls will support 1Gbps+ throughput, so it’s not as important to check, but if you’re buying ex-enterprise or other used hardware, check the specs because older devices can drop the throughput drastically once you put filtering, intrusion prevention, and other security features on. Basic functionality Hardware firewalls have some features that are generally thought of as table stakes, like access control lists to allow or deny web traffic based on predetermined rules. This list of rules filters traffic before it hits the network, making it easier for the other security features to do their jobs while hopefully stopping unauthorized traffic. For example, you can set them up to only let video call data go to certain devices on your network, so other attempts will bounce off the firewall. While they’re also part of the software firewall in your operating system, having them on a dedicated network appliance means the rules get applied to all traffic, not just that aimed at your computer. They’re best when used in conjunction with a stateful firewall that can monitor every packet in a session and detect and reject any unauthorized traffic. Virtual Private Networks(VPNs) Whether you need to access your home network from outside, or use a computer to connect to a corporate computing environment at your workplace, having VPN support on your hardware firewall is important. It’s not just that it will encrypt your data going both ways, but it also acts as another layer of access control, ensuring that devices that aren’t supposed to be on your network aren’t able to connect. It’s also important to have multi-factor authentication for any VPN connections, as it’s the best way to ensure that only authorized users can connect through your firewall. Advanced security features Hardware firewalls can also have multiple advanced security features that might slow down throughput on your network but make it much safer as a result of them running. This could include deep packet inspection to inspect the contents of data packets as they go through the firewall, with a much wider range of metadata inspected than a simple stateful firewall. Even malicious encrypted data can still be guarded against, as the metadata and routing information can’t be encrypted. This works in both directions, so it’s a good way to guard against data exfiltration and malware or other issues spreading around your internal network. Some hardware firewalls have threat intelligence, which gets real-time updates for malware and other threats found in the wild, so they can better protect against emerging threats without waiting for larger updates. Or you can set up access lists based on the applications that are supposed to be allowed through the firewall so that even if malware makes it through unless it infects one of those programs, it can’t dial back home. Quality-of-Service While all the active monitoring and inspecting of packets is good for security, it slows down the throughput of the network as a result. Having Quality-of-Service rules running on the network appliance is an important way to ensure that every computing device that needs bandwidth gets its fair share while the security tools get enough to do their job as well. Security features that slow your users down too far will have them going to other means for internet access, which limits your overall security.
