Using m0n0wall on a WRAP 1-2 to create an easy hardware firewall
We wanted to replace our old firewall, which was an old PC running Linux, that also served as our file server, our DNS, and did internal web serving and ran our internal databases.
We needed to upgrade our server and decided that we wanted a dedicated firewall, but couldn't justify the cost of buying a whole new PC just to run as a firewall. We also found that our old firewall solution, which used IP tables, was difficult to administer and changing anything meant learning a new set of syntax rules.
So we opted to use a WRAP 1-2 with monowall on a 64MB SanDisk CF card. At only $325, this solution was much less expensive than our other options, and its small size meant that it fit easily into our existing server rack.
Our monowall box was really easy to set up - basically we just plugged in our cable connection, opened a web browser on one of our desktops and hey presto, there it was. And it's never gone down in the 14 months we've been using it, which is really reassuring.
We also like the fact that it's quiet, it runs cool and it doesn't use much power.
Using monowall also saves us lots of time because the GUI is so easy to use. It has loads of great features and the auto-update function in monowall is particularly handy.
For example, the other day we decided to update our firewall rules. By default monowall's firewall rules are set up to allow everything out. We wanted to restrict outgoing connections as a partial defence against trojans and viruses that might install themselves and then "phone home".
In order to figure out what outgoing ports we needed open, all we had to do was go to the interface, use the firewall logging feature, and then only allow ports that we could see were being used in the course of normal business.
And if we ever want to upgrade our hardware, all we have to do is use monowall's configuration backup feature, which means that we can upload our old settings to the new machine and have it up and running in minutes.
We plan to move our WRAP 1-2 into a rack mount case, which means that it will easily slot into our new server rack, with all of our other servers, and it only takes up 1RU.
We're also considering using a couple of the new rack mount Eber 210's for either file serving or database serving (or both) and using DRBD to provide complete redundancy. This level of functionality, reliability and redundancy wouldn't be possible with our available space - and budget - using standard PC servers.
- Paul McGowan, Technical Manager, Yawarra Information Appliances
Yawarra Information Appliances Pty Ltd
PO Box 606
Boronia VIC 3155
Tel: 1300 859 799
Email:
Web: www.yawarra.com.au
So we opted to use a 
