Stand-alone firewallsuggestions

[MT0Y]

Hi Team, noob time again. I’m running AX88U and with people coming and going and flatmates riddled droid handsets weird and wonderful logs are being generated and attempts to change other devices on the network.
‘I’m thinking of buying a standalone firewall to shield the AX88U and stop all the malicious attacks on my Apple TV and data possibly being forwarded on.

Should I get a wireless firewall system for guests and my flatmate to connect to?

open to ideas and suggestions
cheers
noob

 

[dosborne]

Do you have more specific examples of what is getting past the firewall in your router? Perhaps you simply need to tighten down some options.

 

[MT0Y]

I’ll get some info from it when it’s back up again and post. I appreciate your time in looking into it

 

[coxhaus]

Run Untangle behind a Cisco router using a Cisco layer 3 switch. Since the firewall works both directions the layer 3 switch will stop all the local routing traffic from being scanned inside the network and only real outbound traffic will be scanned. The wireless needs to be inside the layer 3 switch also. This is the best setup for a real firewall. Untangle is only $50 for home use. It is expensive for business use.

And don't compare ASUS to Untangle as they are in different worlds.

 

[cptnoblivious]

Sounds like you should only let those folks onto the guest network.

Since the AX88U support Merlin, I'd personally go a step further.

Flash to Merlin
Enable skynet
Setup YazFi to give you guest network separation.

IMO, you have everything you need within the package you already have, just a matter of configuring it.

Good luck!

 

[cooloutac]

I have been looking at pfsense, sophos xg and sophos utm. Their home editions are free and you get the same stuff enterprise gets. They also pretty much block everything by default especially sophos which is the most paranoid.

But if web filtering is a priority, untangled is a good option plus the most user friendly and the best reporting.

 

[mike37]

Strongly ditto dosborne and cptnoblivious!

I'd add the possibility that some of your guests are -perhaps- "innocently" abusing your hospitality: using your portal to enter the wild west of hacking/attacking/porn/etc. (and which may earn you a knock on the front door).

ISTM your LAN devices could be dangerously vulnerable.

Set some rules for your guests! Immediately respond to dosborne; immediately implement the suggestions of cptnoblivious.

..Possibly.. you would benefit from an IDS/IPS package which would likely run on your router+Merlin - but that is a steep learning curve and lots of work (as would be buying and learning more "stuff".)