Up until 2015, I used a consumer router as my home gateway (device that connects computers and devices to the internet). Then I started investigating what would be good network security for the home network. I didn’t like what I found.
The dirty little secret is that consumer routers used as gateways are laughably easy to hack, even when configured properly. See links 1, 2, 3, 4, 5, and 6, as examples, or search “router easily hacked” or “router insecurity” online. It’s not just one brand…. it’s all of them. Enterprise-grade routers are not much better. See links 7 and 8 as examples. With routers, it’s not enough to configure them securely and to patch them regularly, which almost nobody does. Router firmware, by its nature, is riddled with exploitable bugs. If your router is infected, your devices (PCs, tablets,…) might become infected, and your bank account and other critical information can be stolen.
For personal reasons, I needed something better. Way better. I also wanted something that could protect every device in the home. That meant a firewall of some type after the cable modem.
Sophos XG running in a Polywell custom-built computer. Front view
Sophos XG running in a Polywell custom-built computer. Rear view
After much searching, I decided to try an enterprise-grade UTM (Unified Threat Management, or, a "firewall") software, Sophos UTM, which has since been replaced by Sophos XG, which is what I currently run. Sophos has kindly made this Sophos XG software FREE for home users. Wow!
Sophos XG has achieved test results that are among the best enterprise UTMs/firewalls. In a recent NSS Labs test, it blocked 95% of attacks, and placed 3rd in security effectiveness, behind ForcePoint and Cisco. However, neither ForcePoint nor Cisco offer free firewall software to home users.
Sophos XG Security Effectiveness vs. the Competition. From NSS Labs, 2017
I did this work primarily because I figured that an enterprise-grade UTM, highly maintained, would be much more difficult to hack than a consumer-grade router. But doing this work is not for the uncommitted:
Polywell Configuration for Sophos XG. Fanless Build
I did all of this work without a background in networking nor in network security, so it took 2-3 days just to get most of my devices connected to the internet, because I had to learn as I went along. Also, enterprise-grade firewalls are not as friendly as routers to internet-of-things devices like Rokus, Apple TVs, Amazon Echos, Sonos speakers, security cameras, SmartThings smart home controller, and so on. That means figuring out workable firewall rules not just for PCs, but for all the devices in the home.
Sophos XG Home Screen
I’ve been running Sophos XG for almost two years now. It has blocked numerous exploits and malware. It has also shown all sorts of (blocked) attempts to hack into the devices in my home (China is easily the worst offender). I’m glad I use Sophos XG, and after I conquered the learning curve, it does not take much time to maintain. I’ve also developed an understanding on why it is so valuable, and what to look for in a good home gateway (firewall, UTM, router) device.
Sophos XG Example Report Page
Below is my required feature list. Sophos XG offers everything on my list
Configuration / Administration
In a future post, I’ll outline some consumer alternatives to Sophos XG and how many of my required feature list they fill (hint: not that many).
I’d like to thanks Sophos for making such a powerful tool available for free to home users willing to put in the time to learn network security.