Do I Need a Firewall?
Every business network should be protected by a firewall. Options range from free open-source software to products from large corporations. This article aims to provide an overview.
What is a firewall?
Simply put, a firewall controls traffic between your business network and the internet. It allows permitted connections through and blocks the rest. Modern devices, known as next-generation firewalls or UTM appliances, also inspect content, filter websites and detect attacks.
Routers from internet providers such as A1 or Magenta, and devices such as a FRITZ!Box, already include security features. Whether these are sufficient for your business depends on your requirements. A separate firewall may be useful for remote access via VPN, a separate guest Wi-Fi network or multiple locations.
Open-source vs. closed-source:
the differences
Open-source and closed-source firewalls differ mainly in their licensing models, support options and vendor lock-in.
| Criterion | Open-source | Closed-source |
|---|---|---|
| Licensing costs | Core software usually has no licence fees; support and additional services may cost extra | Fees for software, security services and support depend on the provider |
| Source code | Publicly available | Generally not publicly available |
| Vendor lock-in | Hardware and service providers can usually be chosen freely | Changing vendors may require new hardware and licences |
| Support | Community, service provider or vendor, depending on the offering | Vendor and partners, depending on the support contract |
| Setup and operation | Technical expertise required | Technical expertise required |
Open-source firewalls: OPNsense, pfSense, IPFire
Examples of open-source firewalls include:
- OPNsense: is developed by Deciso in the Netherlands and is based on FreeBSD. Alongside the free version, a Business Edition with support is available.
- pfSense: is a long-established project from Netgate in the USA. Alongside the free Community Edition, the commercial pfSense Plus version is available.
- IPFire: is based on Linux and developed by a community. The firewall is aimed more at smaller businesses with straightforward network requirements.
OPNsense vs. pfSense
OPNsense began in 2015 as a fork of pfSense. The two projects are now developed independently.
| Criterion | OPNsense | pfSense |
|---|---|---|
| Vendor | Deciso, Netherlands | Netgate, USA |
| Editions | Community Edition and Business Edition | Community Edition and pfSense Plus |
| Licensing model | Community Edition: open-source; Business Edition: paid | Community Edition: open-source; Plus: commercial |
| Administration | Managed through a web interface | Managed through a web interface |
| Extensions | Additional features through plugins | Additional features through packages |
Commercial firewalls: Palo Alto, Fortinet, Sophos & others
Commercial firewalls come with different features and licensing models. The security services, updates and support included depend on the particular offering.
| Vendor | Country | Product families |
|---|---|---|
| Palo Alto Networks | USA | PA series |
| Fortinet | USA | FortiGate |
| Sophos | United Kingdom | Sophos Firewall, XGS series |
| WatchGuard | USA | Firebox |
| Check Point | Israel | Quantum Spark |
| Cisco | USA | Meraki MX, Secure Firewall |
| Barracuda | USA | CloudGen Firewall |
| SonicWall | USA | TZ series |
European firewall vendors
Digital sovereignty matters for firewalls too. That makes European solutions worth a look:
- Deciso (OPNsense): Netherlands
- Securepoint: Germany, with a strong presence among SMEs in German-speaking countries
- LANCOM Systems: Germany, offering routers and firewalls from a single vendor
- Stormshield: France
- genua: Germany, primarily for high-security environments
Hardware and costs
Open-source firewalls can run on suitable standard hardware, as a preconfigured appliance or in a virtual environment. Commercial vendors also offer virtual firewalls alongside physical devices. The performance needed depends on network traffic and the security features in use.
| Cost item | Open-source | Closed-source |
|---|---|---|
| Hardware and infrastructure | Standard hardware, preconfigured appliance or virtual environment | Vendor appliance or virtual environment |
| Licences and additional services | Core software usually has no licence fees; additional services may cost extra | Fees depend on the product, contract duration and selected services |
| Setup | Installation and configuration costs depend on the work required | Installation and configuration costs depend on the work required |
| Maintenance and updates | Regular updates and ongoing support | Regular updates and ongoing support |
A comparison over several years should include licences, security services and ongoing support as well as the initial purchase.
Conclusion
Both models can be suitable for businesses. The right option depends on the network, the features needed and the arrangements for ongoing support.
It is advisable to have an IT professional review your requirements and planned changes before choosing or setting up a firewall, or changing settings in your existing network.
Basic criteria include:
- Updates: How are the firewall and router kept up to date?
- Guest Wi-Fi: Is it separate from the internal business network?
- Remote access: How are external connections secured, for example via VPN?
- Accounts: Are individual administrator accounts and multi-factor authentication in place?
- Rules: Are firewall rules documented and reviewed regularly?