What's the Best Firewall?

Transparency notice: I was not paid to create this video. But, UniFi gave me the Dream Machine and Cisco are lending me the firewalls used in this video. I purchased the other devices myself.
Hackers hack millions of ISP routers: • Hackers remotely hack ...
BT cheerfully admits snooping on customer LANs: www.theregiste...
Changes to pfSense Plus Home+Lab: www.netgate.co...
UK ISP Had 6 Million Routers Vulnerable for a DNS Vulnerability for 18 Months: www.bitdefende...
Wireless routers: is your router putting your security at risk? www.which.co.u...
87 critical vulnerabilities discovered in routers in 2021: www.kaspersky....
#shorts #firewall #cybersecurity

[@davidbombal]

Which firewall do you use and recommend?

[@Nocy]

In France we use Stormshield FW in many companies mostly for the ANSSI certification

[@EddyGurge]

Watchguard here

[@slliks4]

Firefox firewall 😅

[@Raph-1001]

Palo Alto Networks PA-400 series and/or ZScaler ZIA for the clients.

[@Velrisias]

The best firewall at home is your index finger, stop using it to click on stupid links. Yes ISP firewalls aren't the best but most endusers get hacked because they click on dumbshit

[@orangehatmusic225]

The best firewall is unplugging the internet.

[@dtdang0309]

And the best way to not having an traffic accident is not to commute. 😂

[@igormicovic]

You are so smart bro

[@FreePizza007]

😂 live in the forest under a tent

[@smddev]

That 0.99% uptime baby

[@yusefskaff47]

With this, u are performing DoS on yourself

[@StuartMitchell88]

Depends on your technical capabilities or access to someone technical that you trust. For simple configuration and management for less advanced people, I'd suggest UniFi, but for someone more advanced, probably pfSense, but if you're more technical, it's really personal preference.

[@BigNad]

For the average home user with a spare $550USD burning a hole in their pocket, the dream machine pro is 100% the best set and forget firewall. Updates itself, user friendly UI and everything in plain english.

[@ecospider5]

That is what I have. When it works it works great. When it doesn’t it is nice they have free email support. The biggest problem I have is a bug with my isp. When they give the dream machine an ipv6 address I have no internet. I put a crappy router between the dream machine and the cable modem which forces an ipv4 address and everything works. I remove that sometimes to see if I’m lucky and the dream machine gets an ipv4 address. I’m currently without the second router. Second issue few would ever have I have close to 200 iot devices with an ip address. And my wireless network has ended up with 400ms ping to the Dream Machine. I have checked the normal stuff and didn’t find anything. So I will be emailing them. It will be interesting if they say I need more equipment.

[@2010RSHACKS]

Or.. don’t spend $550 and continue as I have for 25 years with a total of ZERO attacks

[@adammiller9029]

@@2010RSHACKS How do you know you werent attacked? Hackers usually avoid making themselves known.

[@cyberdefenseddi]

I totally agree 👊UniFi DMP is awesome

[@ArthursHD]

If one is strapped for cash Mikrotik, Teltonika, or OpenWRT router could be considered.

[@leedsgeek2681]

It’s not about how much you spend or how many softwares you install it’s about having the right tool for the job and the right knowledge to install it securely with defense in depth. Having some security is usually enough to deter hackers. Unless you have something worth the headache to steal

[@hadishamil6173]

Run pfsense open-source on your old pc

[@chrismeader3698]

Honestly for rather home or office the Fortigate firewalls are solid. Tons of support, various models from their F series to choose from including home rack mountable ones to more business use case versions. Solid gui if you’re not comfy with the cli but the cli is easy to learn. If you’re at home and going for more of a cost thing the dream machine from ubiquity isn’t a terrible choice. I wouldn’t necessarily recommend for business use case unless it’s like one office maybe. Scalability is all there from my experience.

[@Gearbhall]

Fortigate has critical CVEs and zero day exploits in the wild far too often for my comfort level. I used to be a Fortinet fan but they need to do something about their software Q/A

[@chrismeader3698]

@@Gearbhall I noticed that lately as well but they seem to be quick with distributing a firmware upgrade to patch those vulnerabilities. Truly the firewall is only as good as the person maintaining it.

[@floriantthebault521]

@@Gearbhall They have had a lot of those in years prior, but... they were really honest and you could see they were serious in weeding them out. It's still one of those first choice for enterprise. Cost-wise, it's difficult to beat.

[@phyr-4g]

@@Gearbhall They are dropping support for SSL vpn in their next FortiOS. SSL vpn has been the most vulnerabel module. Palo Alto who is known for security just had a huge security risk.

[@BigHeadClan]

Aye we have about 80 of those firewalls deploy'd across various clients they do well and rarely have any hardware issues. Pretty easy to configure and setup.

[@HomeBudgetComputing]

I use pfSense at home and recommend them to customers. Great for home/small/medium networks, and for a large network (coast to coast, or international) I still prefer pfSense if possible, but would go with Unifi if needed.

[@guiwhiz]

Layers... the key is in creating layers of security. No 'single' device is really 'bulletproof'.

[@imerla1316]

Cisco 4215 Next Generation Firewall cost around 100k do you really own one?

[@Dazdigo]

I'd say the one you have on hand. If you don't have any equipment, use the ISP and then when you have money get rid of all the ISP's equipment, even if you use a cheap consumer router. If you have a old computer lying around, use pfSense or OPNSense. If you are a business, use the commercial firewalls.

[@richardbryanesq]

So I can buy any router and it will replace the one Verizon installed? Just like that? Screw the coaxial cable into the back, and my cable tv and internet will work without any additional configuration on my part?

[@AhmadSwailem]

I would go for a Fortigate, could use the FGT40F for home/small business

[@jeffd6527]

I'd re-evaluate that. They have so many vulnerabilities and their issues with SSL-VPN's is concerning. I have a 70F and I won't let it anywhere near my WAN.

[@jaceallen7400]

Can confirm the SSL issues. Our office consistently experiences SSL errors on webpages known to be safe.

[@AhmadSwailem]

It is right that they had some vulnerabilities during the last two years, good thing they patched it fast Also if you deployed it with best practices you won't have that significant danger

[@AhmadSwailem]

@@jaceallen7400 i doubt the issue is from the FortiOS, mybe a security profile needs to be adjusted properly as well as for the packet inspection And make sure you are on a mature firmware, check the support portal

[@3s0t3r1c]

@@jeffd6527 Do you use VPNSSL at home?

[@WayneSylvia]

Firewalla works really well

[@RatoAx]

Take your pick between pfsense and OPNsense and get a low powered but capable machine like a 1l PC or Nuc and learn something on the process.

[@amitchoudhary7428]

Depends on CVE score and the end user awareness😊

[@skynetintex5878]

LOOL @ CVE score.

[@johndennis8115]

Firewalla Purple meets the needs while being configurable, constantly updated and offers extras in a very small, capable package.

[@RandomUserOnTheInterWebs]

The best firewall is the one that you know how to properly configure.

[@alexmaroske]

FIREWALLA!!

[@Magickmaster3]

I got a protectli and it's great. Good performance, passive, custom.

[@horriblepianorecords]

It doesn’t matter what firewall you have if you configure any/any rules and don’t patch it regularly 😅

[@brockhard]

Unifi has a terraform provider which I love so I can set up my router with IaC. Their UI is really nice too. I used to run a pfsense on a VM and had it working perfectly but I enjoy Unifi a lot more.

[@CyberFraudDawg]

I have a Protectli running pfsense and snort, absolutely love it.

[@sbme1147]

Excellent choice !!

[@Azlehria]

I run a Palo Alto device at home - sort of. A Cloudgenix ION 2000 with pfSense CE on it. $50-ish is a great price for a Lanner FW-7525D; well worth the mild hassle of shuffling the SSD around. Palto Alto hardcodes the BIOS password and sets external media last in the boot order, so you have to ensure that the SSD has no bootable partition in order to install a new OS. I just swapped it for a blank surplus 64 GB drive I had.

[@sgarciat]

Meraki MX67 integrated with Cisco Talos. It can be installed automatically, just plug it in and you can also have your home switch and WiFi managed through the same dashboard. ✅

[@Bill_W_N7]

The DEC850 running OPNSense and ZenArmor has been a great combination for my homelab / home networks.

[@davidbombal]

Thanks for sharing. Seems like a very popular option :)

[@KungFuKirbs]

Ridiculously expensive for home use.

[@Bill_W_N7]

@@KungFuKirbs You are absolutely correct. If I had it to do over again, I probably would do something that was not as expensive. It's been a reliable appliance though.

[@4megii]

I just have OpenWRT flashed to my own router, and I just place that in the DMZ.

[@lukasbruderlin2723]

You forgot to mention MikroTik - even they are more than just a pure FW, they are considered highly secure, ARM based and offer an huge range of superior HW an a amazing price. Yes, I agree that often it makes sense to have separate devices for separate tasks, bit with such a professional Router OS and devices, you can securely have Routing, Wireless, AP or more on the same device.

[@ruly9662]

I will like to read david's opinión about it also

[@vibrion121]

Aren't MIPS based? Or they switch to Arm? I only know them in readings

[@colejenkins8012]

UDM, mostly since for home it’s the best budget option with more robust security than an ISP router and a mesh system. It allows me to filter traffic and port forward access to servers I host.

[@davidbombal]

I think a lot of people would agree with you :)

[@Swizzle5795]

I love my synology router. The SRM portal has great features that are easy to configure

[@BeiAkaMarrlee]

Have used almost all of these at some point or another. Have really enjoyed using Fortigate over the last 8 years or so. They do a pretty good job of discovering / fixing CVE from internal discovery. I tend to avoid firewalls that have most of their CVE discovered from 3rd parties, as those are the ones that will more likely to have vulnerabilities going undiscovered for the longest.

[@mrmookie]

Fortinet 60F for layer7 shaping on a budget. Mikrotik if they can't afford the Fortinet.

[@JBSbass]

any firewall you can open and close ports on and do timeouts, black and white lists and has some smarts for packet inspection. Even port 80 and 443 can be used to Ingress a network so packet inspection is a must if you have data worth taking.

[@SZK87]

Ubiquity udm pro . Makes the most sense for the average Joe : nice UI, easy to configure and , most important , can easily extend your network with switches and access points.

[@aliswaid5244]

I use my mikrotik as a firewall in my home and I detect everything as it is programmable

[@psimonsen123]

For large Id use two different back to back and some IDS, Siem etc. For all as much ZeroTrust as feasible

[@kirilldanshin]

Mikrotik and Keenetic are pretty nice for smaller networks. One is more for tech savvy people, the other can be configured with no experience, yet still provides options for customization

[@radscientist]

It doesn't matter if it's not configured properly.

[@sissiwasabi]

Palo Alto hands down the best firewall for small business and large companies. For private use probably an open sense because its free and pretty powerful

[@tschaderdstrom2145]

At home, anything that adds a default deny layer is sufficient. IoT stuff goes on its own network where possible.

[@CMD_Line]

All firewalls, hardware or software have vulnerabilities. Doesn’t mean the ISP one is bad. In some cases they have built in technology that works with the ISPs network to ensure additional security and that vulnerabilities and patches are resolved much quicker.

[@fatlip8315]

I hit up comcast once and introduced them to wrb security, I didn't go into it, I didn't want the money, I just figured that it would be great if they added security, they did a great job. I like it, plus it's included, and you can still do your own firewall.

[@Johnny_C137]

Xfinity Gateway + Windows Defender is all I need.

[@NinjaSushi2]

I was thinking the Google router can't be that bad. I wonder how protected it really is.

[@fatlip8315]

I mentioned some of the security measures to Comcast a while back, how secure is Comcast routers and firewalls? Seems pretty secure, they've caught and alerted me to several blacklisted or banned ips that tried to connect to me PC

[@betatester03]

@@Johnny_C137 If you say so.

[@jorgitogaitan]

At home I’m using firewalla and they pretty cool. Love their travel firewalla as well as it connects to guest WiFi wherever I go and I can then be behind my own protection rules

[@carmelishus]

Check Point is and always has been the leader in actual network security. It’s not about marketing or popularity. Do a side by side comparison and you’ll see the prevention is top notch.

[@dsaukko]

pFsense home and small business. Dream machine for bigger clients. If you want to be really secure, pFsense then dream machine behind it.

[@RolandsKenins]

I'm about to upgrade my IT at home and considering pfSense Netgate 2100 + IPS/IDS.

[@iCanFixYourLaptop]

Works great it’s just a b**** to configure sometimes because of several bugs but hopefully an update will work it out

[@StaHoo1001]

SonicWall SOHO will do for most home/very small business scenarios

[@michellewentworth9862]

Cisco on the Internet facing side the run it in serial through a pfSense before it gets to your network. There are smaller Cisco firewalls than the one you showed.

[@edwardfernandez6496]

FortiGate 60F UTM license. More than a firewall for SOHO needs. That little package has a lot to offer for the price. State Full Firewall, Antivirus, AntiSpam, VPN server, IPS and more.

[@AM33427]

Personally a big fan of the Ubiquiti equipment. Excellent

[@Irisseesall]

Sitting on a hacked ubiquiti right now.

[@drummer4j]

OpenWRT on a cheap/energy efficient WiFi 6 router. Simple, stable, secure, and best of all open source 👍

[@XSFlanger]

Palo Alto or FortiGate, depending on budget.

[@thomaswerkhoven78]

What firewall i would choose? The one thats not Linux based. Linux is made for more and therefore makes the security vurnerable for potential exploits.

[@retrocjt]

Fortigate are definitely the pioneers in modern Firewall security and technology. Simple, easy to use interface, with tons of customization!

[@Unknown-wi2dy]

No, CVE scores say another thing

[@xisuz]

​@@Unknown-wi2dy Any link for further reading?

[@ruhnet]

Yuck...

[@Unknown-wi2dy]

@@xisuz just google „fortigate cve history“ and „any other fw vendor cve score“ and compare

[@rockhaze]

Not the experience we had, a lot of our new fortinet switches came with dead ports and updates ended up bricking a few as well. Switched over to ubiquiti/cisco and phasing out the fortinet devices as fast as possible.

[@zachlandis8728]

It depends on whether you want firewall associated security services such as dns filtering or not. Usually for a home, all you would really need is something you can set up easy like that UniFi one, a rack mounted Cisco firepower or ASA is overkill unless you run a business that can cover the licensing costs.

[@litmkbsd1802]

I just bought a small N305 Intel NUC and installed vanilla FreeBSD. Makes a great router and VM host (it has 32Gb RAM). If I had to go with a "off the shelf" solution probably mikrotik RB4011 or similar

[@miyu545]

Watchguard Firebox is the best option although the updates are not cheap.

[@edwarddejong8025]

At work, i selected the fastest single thread CPU you can buy which was actually a very cheap Intel E3 chip because it doesn't have hyperthreading, on a supermicro chassis, running OpnSense. It works great, and you can do millions of packets per second. Be sure to use the best Intel ethernet NIC's because they have better drivers that are higher performance and reliable. Crazy to buy an expensive Cisco when all you are doing is filtering packets.

[@supercharged1046]

I bought a TPC-Link A9 Off Craig's for $20 dollars and flash it with the latest OpenWRT firmware and I haven't had any issues.

[@sammyfromsydney]

The more complex you make your home setup, the less help the ISP will provide.

[@trizzybones]

You don’t need to make your setup complex and it’s best not to rely on your ISP to help you. A firewall is essentially just a set of rules for what ports are allowed open on your network. For a home network you should just keep all inbound ports closed. If you need to open any inbound connections for some specific purpose, like you’re running a web server, then you would employ more security measures like network segmentation and such, but that’s a different conversation. For most people, the rule set is simple. You should also make sure you keep the software/firmware updated as soon as there’s a patch, and other normal security practices like MFA, strong passwords, etc.

[@jspringer86]

why do I need my provider to help setup MY network? I just need their connection working to the property. I can take care of everything after that.

[@audioware1]

I you know what you are doing, you shouldn't need any help from the ISP.

[@betatester03]

I've never even thought to go to my ISP for anything other than what they are responsible for. If my connection goes down, I check my hardware first to make sure it isn't on my end, then I contact them. What else could they possibly help you with?

[@kokrhanek3ta]

I am using Fortigate 60F at home and i am very satisfied.

[@Arctics04]

Here in Germany we have to use a Fritzbox router. In theory I could connect my router with a router that provides a better firewall and use the Fritzbox router as bridge mode so it uses the Firewall from the other router.

[@rA_Valen]

That's not even close to true. You can just request your PPPoE login from your ISP and use whatever you want. Source: I am German and use Ubiquiti Btw: Du kannst denen immer auch einfach mit der BNetzA drohen um deinen PPPoE Zugang zu kriegen

[@NeilMukhamediev]

pfSense running on 4200 is the very solid choice

[@foxronyo]

I've heard good things about the Protectli. Definitely considering getting one. It's not enormous, so it would be great for tucking behind the TV, or anywhere you don't have alot of space.

[@mmbelanger]

Great hardware and fantastic support. They even helped me with some pfSense configuration questions that had nothing to do with their hardware.

[@sbme1147]

Actually they are very, very good. You can put CoreBoot on it, which is very nice. If I could afford it I would of gotten one. I got a CWWK i3-1315U, can put 2 NVMe's ( one PCIe 4.0 x4, site says 3.0 but some of us on ServeTheHome Forums did testing and mfg screwed up ). CWWK does do BIOS updates, but I would go with Protectli ( granted it's like $400 more though for same specs IIRC ). Come on Protecli come down in price at least a little? Well I got mine for 20% off.

[@cobro2]

I’ve heard it heats up like a mofo, if so then not a good idea to be tucking it anywhere.

[@mmbelanger]

@@cobro2 The newer units seem to run hotter than the original, but I have one in an uncooled closet at home and have had no problems. I'm likely shortening its life, but I'm not overly concerned.

[@cobro2]

@@mmbelanger thank you for the info.

[@markarca6360]

I'll have my UniFi Cloud Gateway Ultra instead. It has IDS/IPS.

[@Jomster777]

I’ve seen a lot of Fortinet Firewalls being used for all of businesses I’ve worked with including a Store/Pharmacy with 10,000 locations in the US.

[@guig2004]

David, definitely Cisco 4215 👍🏻👏🏻😉 I have even configured on in London 😊

[@mworld]

I run OPNSense on a n305 small form factor box @home.

[@rjbraun]

I love my WatchGuard firebox, it's the best! But has a steep learning curve if you're not familiar with this type of thing.

[@glebkleiman6637]

FortiGate 40f for small 60f-100f for medium size

[@rawkfist-ih6nk]

I found a fortigate 600D and I’m liking it. Used to have a Cisco ASA. The fortigate has lots of features that come included with the base OS won’t no licenses needed and they’re going pretty cheap on eBay. There’s a concern about the lack of future firmware but I’m able to mitigate that somewhat by preventing external access and limiting ingress to only 443 and blacklisting. Then I have some defense in depth strategies on the inside.

[@jasontechlord]

The way I look at it is the more you spend the more security you can have... kinda. There will be diminishing returns in a home environment. I do wish there were better (and cheaper) solutions for your average home user because too many people rely on their ISP.

[@dannythomas7902]

Cisco meraki for.small office works pretty good, 15 years in industry

[@mymoviemania1]

I am watching all your shorts and videos, starting from now.

[@SteveGolter]

CheckPoint 3000 series is what I use at home.

[@anguraj7502]

I prefer Sophos & Pfsense for home.

[@manikandans]

mikrotik for home and small business- can have IPSec S2S for branchoffice or cloud connectivity and webproxy for Lan users and much much more capabilities. can fit on your palm, bit non-intuitive but powerful.

[@8skellerns]

Just got the Unifi Cloud Gateway Ultra and set the BT router to bridge mode.

[@renehoehle]

I use Sophos XGS but the new systems are too complicated in my mind and are not really user friendly. The price raising 3 times a year to i really think about to switch to PFSense.

[@doisan8218]

I'd start of with PfSense. If I now have a budget, i'd purchase a PA-400 series NGFW.

[@JacobDrJIsrael]

I am not a network security professional. While I certainly have experience around IT, the networking aspect is just so huge. As such, my preference isn't to aim for perfect security. That is impossible. My aim is for a device that gets support and regular updates. Pfsense, mikrotik, sonic wall... Even Google routers get regular patches...

[@captgrant]

Pfsense on 1u enterprise hardware with 4port card segmented lan provides excellent protection, and low power consumption. Very reliable

[@vwestTube]

for home Firewalla ✌🏼

[@playdoh1975]

Yeah it works really well at separating you from your cash 😅

[@vwestTube]

@@playdoh1975 What? 😆

[@mikouserx7739]

The best home firewall is the mini pc with installed Sophos XG Firewall :)

[@foo2hp]

I use black one and I'm happy with it 🙂

[@marcschweiz]

Get a Firewalla. Absolutely in love with it

[@YuJay]

If we don't start making an effort now, the big 3 ISP are soon making it impossible to use Third-party routers by encrypting the username and passed to your internet login and encrpting the VOIP settings forcing you to use the router and its built in VOIP socket when we are all forced to change over to digital lines. Sky has already effectively done this and BT and TalkTalk are the next to follow.

[@randominsomnia]

Would you mind providing a source for that which elaborates a little bit on the topic?

[@YuJay]

@@randominsomnia I can not provide any sources other than common knowledge in the UK, the digital switchover has been moved from 2025 to 2027. The Router issue is common knowledge if you use Sky, BT or TalkTalk that provide VOIP Telephone which is built into your router and is encrpted. These ISPs charge more for Telephone or Internet if you don't get both, BT are the only one that sells unpackaged Internet with no extra cost. So you can get a separate VOIP service that provides settings for thirdparty hardware, but most people in the UK wouldn't know how to do this and would just opt in to the default telephone package with ISP locking them in to a 2/3 year contact with router that does the job and nothing else.

[@darrylaustin7833]

Sophos XGS6500 is a good firewall.

[@masterundercontrol]

Sophos XGS home edition, free to home use! Runs on pretty much everything with x86 processor and 4-6 GB RAM. Can be standalone or virtual machine. It's basically identically Sophos compared to business edition!

[@hbombattaque]

In my home I have a fortigate 40f doing load balancing with my two ISPs, then I have a firepower 1010 as the core of my local network, with vlans, access control, amp, ips, url filtering

[@gustavoechavarria6170]

I noticed you didn’t mention some very popular and highly regarded firewalls used here in South America and America in general, such as SOPHOS and FORTIGATE. Both are very affordable in their entry-level versions and offer fantastic next-generation firewall capabilities like application control, perimeter antivirus, web filtering, IPS, IDS, etc. An FG60D/E/F or Sophos XG (which is free for home users) is sufficient for a home or a small business.

[@syedibrahimkhalil786]

Dear Sir, Waiting for your Udemy giveaways 😊 Really wanted your courses with Ms. Rana Khalil.

[@joaquinc4661]

Fortinet all the way with the hardening that I do, it will be very secure.

[@paulasselin3490]

Zyxel firewall are pretty good for home usage ngl

[@DevilbyMoonlight]

best way to protect is to pull the plug out when not in use :/

[@JoelTehMole]

We usually sell our customers sophos xg firewalls - I'd like to know what people think of them!

[@Techlifeandmore]

I'm just throwing out my opinions though I don't have a lot of experience with networking. At home, the firewall on your ISP provided router is probably fine for most users, though for those looking for an extra boost, a mid range to high-end Wi-Fi router is probably going to offer a good firewall. For a small business, a similar thing, but they'll probably want to get something like UniFi so the one built into the Dream Machine Pro or other Dream Machine products would probably be fine. For a large business, the Cisco or Opensense firewall probably would work best.

[@KristopherNoronha]

I simply use one router behind another, disable upnp, disable remote admin, disable guest access and change the admin usernames and passwords.

[@Technology-Law-Climate-Change]

Yes, when the telecom operator said that it would give me free broadband, I was actually very skeptical...

[@marshallcoley]

For home purposes I think the Firewalla line of products is powrful, affordable and easy to setup.

[@petrvalkoun4539]

OpenWRT or Mikrotik are also good routers/firewalls

[@darks1der713]

Sophos XGS home edition on intel hardware. Enterprise grade security for free (excluding hardware cost of course)