Linux Firewall Part 3: Selecting Your Hardware

As mentioned in the previous segment, you can create a professional-level firewall using old hardware that you would otherwise throw away. Some people may choose to purchase new dedicated hardware, which can have several advantages. Either way, you can create a hardware firewall costs significantly less than the $1000-$3000 that professional hardware devices can cost.

Network cards
For a basic firewall, you’ll need at least 2 network cards (one for the Red network, and another for the Green network).  If you want to add a DMZ, then you’ll need an additional network card.

For the wired network cards, you don’t need anything more than 100Mbit on the Red and Orange networks, since even the fastest of Internet connections is 20Mbit.  These are minimum recommendations for building a firewall out of spare parts and have these items laying around.  If you’re buying new hardware, go ahead and do all Gigabit.

This Jetway board has expansions for three more network ports

If you want to add a Blue network into the mix, then you’ll need a regular wired network card with a wireless access point attached to it.  It is not recommended to use a wireless card directly, because your particular card might not be supported, and upgradability is limited.  Connect a wireless access point with the minimum wireless technology you want to support, like 802.11g or 802.11n.  That way you can always upgrade to the next wireless technology without ever opening your firewall.

Chassis
The selection of your PC case is really all about how satisfied you want to be with this project.  If you are going full-blown mini-ITX, then you can choose from some really cute tiny boxes and an external power brick.  There are also some 1U rack-mountable cases that are perfect for mini-ITX motherboards, but I wouldn’t recommend this unless you are hosting several webservers and are protecting a small server farm. These cases are just fine if you want to build a basic firewall and don’t need many extras like CD-ROM drives or full-sized hard drives.

I-Star 2U Rack-mountablable Case

I did try a very cheap 1U case, but believe it or not the ITX motherboard didn’t fit right in it… so make sure that if you do 1U that you make sure it is compatible with the motherboard you choose.

Another consideration for a special ITX case is this: what if the power supply breaks?  Your firewall is the biggest single point of failure for your network.  These small cases require special power supplies, and unless you have a spare on hand then you’re going to be down until you find a replacement.

I chose an i-Star 2U case primarially because they are good and inexpensive.  I also want plenty of airflow, an attached DVD drive, full-size internal power supply  and two full-sized 80GB hard drives in RAID 1.  Since all of this equipment will only draw about 50 watts of power, any regular power supply should be around 90% efficient, so it won’t produce the heat you might expect.

On the next page we select an appropritate motherboard, video card, memory and storage…

Motherboard
You can use any old motherboard that’s faster than a Pentium-133 and it will work just fine.  I’d be concerned about the hardware dying, however.  So if you have an old computer from the past 5 years, then you should be set.

You may choose to purchase entirely new hardware, as I did.  I purchased a mini-ITX Jetway board with 2.0Ghz VIA processor and 1GB of DDR2 memory.  The reason I chose this is simple: heat and power consumption.  One of these EPIA boards will draw at maximum 50 watts of power (including 2 hard drives), and produce very little heat.  At this rate, the firewall can be on 24 hours a day and cost eight cents a day to run (or $29 a year).

Many “all-in-one” motherboards also have everything integrated, so it can fit in a very, VERY small case.  This motherboard also has optional add-on modules that can take a 3-port network card (helpful if you have a 4-network firewall) and PCMCIA-hard drive card.  If you use a CompactFlash card instead of hard drives then not only would it produce very little heat, but would be practically silent.

Memory
As far as memory goes, your firewall can get away with 256MB of memory, but 512MB is probably the recommended minimum.  Memory usage goes up dramatically when you enable Intrusion Detection and URL filtering, but really won’t go over 512MB, but it’s great to have overhead.  You probably don’t even need more than 1GB of RAM because some Linux distributions only support 1GB anyway.  If you’re going the ITX route, then there’s only one slot of memory available, so choose the maximum amount you could want.  Memory ist cheap, too

Long story short, throw in 1GB of DDR2 if you’re buying new hardware.

CD-ROM drive
Yes, you need a CD-ROM drive… at least for the installation.  Some distributions allow you to boot from and install from a USB key, but that isn’t covered in this guide.  It’s much easier to burn a CD and plop it in the drive.  If you don’t want a CD drive just hanging around doing nothing, then you can temporarially use it just for the install and then take it away.  I have a DVD-ROM drive permanently installed in my firewall box, just in case I ever need to do an emergency reinstall.

Video Card
Yes, even a Linux box that is apparently “doing nothing” needs a video card.  Even though you may not be using it, that old GeForce 6800 GT isn’t the best choice because it will introduce unnecessary heat into the case, and will draw unnecessary amounts of power, even at idle.  I saw a generic XFX PCIe video card in a retail store the other day for $7, which is all you need for this application.  You don’t need any fancy hardware acceleration: just the ability to display text.

This is another reason to choose a motherboard with onboard video… you don’t have to worry about it, you can utilize a much smaller chassis and you’re not wasting precious airflow space in your box with extra cards.

Storage
There are a few options here.  You really want your firewall to be as “enterprise-worthy” as you can, so in this case you may want to consider RAID 1.  When using RAID 1, everything is preserved even if a hard drive fails.  Some Linux firewall distributions do support software RAID, but I chose to go with the RAID features of my Jetway motherboard.  All I had to do was enter the motherboard BIOS and change the SATA mode to RAID and build the array from bootup.  Then you can install from any firewall distro you want and still be protected.

The only problem with onboard hardware RAID is that there are no management utilities from within the firewall software… so you won’t be alerted if a drive fails, and you cannot do a “live” rebuild (you must rebuild offline within the RAID BIOS).

A large hard drive isn’t really necessary unless you plan to log everything (hack attempts, internet activity, URL-filtering, etc.).  In all honesty, even an 80GB drive is overkill, so use whatever spares you have hanging around… just be sure you’re confident they’ll last.

If you want to go cool and silent, you can install to a CompactFlash card.  The Jetway board I selected has modules that allow a flash card to be seen as a regular hard drive.  Even though these cards are typically slower than even the slowest of hard drives, it is still fast enough to boot from and generate logs.  You really can’t RAID these puppies (well you CAN, but that’s a different article).  If you don’t plan on doing any logging, then this may be your best option, as the card will unlikely wear out, and you don’t have to worry about failures.

I chose a hardware RAID 1 with dual 80GB HDDs for this project, because I’m planning on doing lots of logging and I don’t want any downtime.

Now that you have selected and installed your hardware, you can begin installing your new firewall.  It doesn’t take as long as you think…