Hardware for gigabit WAN but no NAT required
-
Hi
I’m about to get symmetrical gigabit FTTP installed. As it’s a home package, I have to use the supplied Genaxsys ONT/Router. You can only get it set to bridge mode if you pay a small fortune for a business package.
So - I was wondering about using the DHCP/NAT on the supplied router (to avoid double NAT), but then placing a PFsense box in-line between that and my main switch to do firewall, basic IDS/Snort work, as well as host an OpenVPN server to give me some security when I’m working away. Doesn’t have to provide gigabit speeds, obviously, as it’ll be the hotel Wi-fi that’s the likely bottleneck.
If I don’t need to do NAT, does this mean I can get away with a lesser specced box? And are there any recommendations? I know it’s unorthodox to firewall inside the main router, but as it’s not a trusted device (by me) and there’s the double-NAT thing, it seemed a sensible option. Please advise if there is a better way, though.
Many thanks in advance.
-
I double NAT with my ISP. I have the option to bridge, but once already they accidentally switched me back to "Gateway" mode because that's the standard. I'd rather not be different if there's not much benefit. I placed my firewall in the DMZ of the ISP's gateway, allowing pfSense to control all of the port forwarding and UPNP related features.