Post

I Finally Understand Why People Do This

Posted
By Usman Masood Ashraf
views 8 min read
I Finally Understand Why People Do This

I Finally Understand Why People Do This

Introduction

There comes a moment in every DevOps engineer or sysadmin’s career when we finally grasp the “why” behind seemingly excessive infrastructure investments. For many of us, that moment arrives when we dive into the world of homelabs. As a software developer who once viewed networking as “router go brrr,” I recently discovered the transformative power of repurposing enterprise-grade hardware. This journey began with a simple question: “Why would someone spend hundreds of dollars on a decommissioned firewall when consumer routers exist?” The answer lies in the profound difference between understanding infrastructure and merely using it.

Home labs have evolved from simple hobbyist setups into critical environments for testing enterprise configurations, developing automation skills, and creating self-hosted solutions. For experienced professionals, these labs provide a sandbox to experiment with technologies we manage professionally but rarely control end-to-end. This guide explores the specific case of enterprise firewall repurposing - a practice that bridges the gap between theoretical knowledge and practical infrastructure mastery. By the end, you’ll understand why sacrificing convenience for control becomes irresistible when you’re building truly robust systems.

Understanding the Topic

What Are Enterprise Firewalls?

Enterprise firewalls like the Sophos XG 210 are sophisticated network security appliances designed for business environments. Unlike consumer routers that operate at basic packet-filtering levels, enterprise firewalls perform:

  • Deep packet inspection (DPI)
  • Application-level control
  • Intrusion prevention
  • VPN termination
  • Advanced threat protection
  • Granular traffic shaping

These devices typically cost thousands when new but become available for $50-150 on secondhand markets as businesses upgrade. Sophos XG specifically runs the Sophos OS, a proprietary firmware that offers comprehensive security features through an intuitive web interface.

Historical Context

Enterprise firewall development accelerated in the early 2000s as businesses grappled with increasing security threats. Companies like Cisco, Palo Alto Networks, and Fortinet dominated the enterprise space. Sophos entered the firewall market with its acquisition of Astaro in 2011, bringing enterprise-grade security to mid-sized organizations. The XG series represented their shift to next-generation firewall capabilities with integrated threat protection.

Key Capabilities

The Sophos XG 210 delivers features typically reserved for six-figure security appliances:

  • Stateful packet inspection with application awareness
  • Web filtering categorized by over 140 categories
  • IPSec VPN with client and site-to-site support
  • High-availability clustering
  • Multi-WAN support with load balancing
  • DHCP and DNS services
  • User authentication integration
  • Detailed logging and reporting

Pros and Cons

Pros:

  • Enterprise-level security features at consumer prices
  • Hardware acceleration for high throughput
  • Comprehensive logging for security analysis
  • Redundant power supplies (in higher models)
  • Quiet operation compared to custom-built solutions

Cons:

  • Limited support for decommissioned units
  • Power consumption higher than consumer devices
  • Physical size requires dedicated space
  • Firmware updates may require valid licenses
  • No cloud management for secondhand devices

Typical Use Cases

  1. Home Network Security: Implementing enterprise-grade filtering and threat protection for personal networks
  2. Self-Hosting Protection: Creating DMZ zones for servers exposed to the internet
  3. VPN Gateway: Securing remote access to home lab resources
  4. Learning Environment: Practicing firewall rule creation and security policies
  5. Network Segmentation: Isolating IoT devices or guest networks

Current State and Alternatives

The enterprise firewall market continues evolving toward cloud management, making secondhand physical devices increasingly valuable for homelabs. Alternatives include:

  • pfSense/OPNsense (open-source on commodity hardware)
  • Untangle NG Firewall
  • Sophos SG series (older but still functional)
  • FortiGate devices (with community firmware support)

Real-world applications include home labs protecting Kubernetes clusters, media servers, and development environments while providing detailed security insights impossible with consumer equipment.

Prerequisites

Hardware Requirements

  • Sophos XG 210 or similar enterprise firewall
  • Network cables (CAT6 recommended)
  • Power supply (check voltage requirements)
  • Computer with web browser for configuration
  • Optional: Console cable for CLI access

Software Requirements

  • Modern web browser (Chrome, Firefox, or Edge)
  • Terminal emulator (PuTTY, Tera Term) for CLI access
  • Optional: SNMP monitoring tools (Zabbix, Nagios)

Network Considerations

  • Static IP address for management interface
  • Understanding of basic networking concepts (subnets, gateways, DNS)
  • Network topology plan including VLAN requirements
  • Internet connection for firmware updates

Access Requirements

  • Physical access to device ports
  • Admin credentials (default: admin/admin)
  • Optional: SSH access for advanced configuration

Pre-Installation Checklist

  1. Verify device powers on without unusual noises
  2. Check for physical damage on ports and fans
  3. Confirm power supply matches device requirements
  4. Backup configuration if previous firmware exists
  5. Document existing network topology
  6. Plan IP addressing scheme for management interfaces

Installation & Setup

Physical Setup

  1. Position the device in a well-ventilated area
  2. Connect power supply and verify front panel lights
  3. Connect management port to your computer using a crossover cable or through a switch
  4. Power on the device and wait for boot completion (approximately 2-3 minutes)

Initial Access

  1. Determine the device’s IP address:
    • Check DHCP server logs on your router
    • Use Sophos IP Finder tool if available
    • Default IP is often 192.168.100.1 or 192.168.168.168
  2. Access the web interface:
    1

    https://<device_ip>:4444

    Ignore SSL certificate warnings

  3. Change default credentials immediately:
    1
2
3

    # CLI equivalent (optional)
> set admin password <new_password>
> save

Basic Configuration

  1. Set system time and NTP servers
  2. Configure management interface IP: ```yaml

    Network configuration example

    interfaces:

    • name: Management ip: 192.168.1.10/24 gateway: 192.168.1.1 dns:
      • 8.8.8.8
      • 1.1.1.1 ```
  3. Configure LAN interfaces:
    • Navigate to “Network” > “Interfaces”
    • Edit LAN interface settings:
      • IP address: 192.168.100.1/24
      • Enable DHCP server with appropriate scope
      • Set DNS servers to your preferences

Firewall Policies

  1. Create basic security rules:
    1
2
3
4

    # CLI example for allowing HTTPS
> create firewall rule name="Allow HTTPS" action=accept service=https source=any destination=any
> create firewall rule name="Block All Else" action=drop source=any destination=any
> save
  2. Apply rules to interfaces:
    • Go to “Firewall” > “Rules”
    • Set rules to apply to WAN_IN and LAN_OUT

Verification Steps

  1. Test internet connectivity:
    1
2

    ping 8.8.8.8
curl https://ifconfig.me
  2. Verify DHCP functionality:
    1
2
3

    # From another device
ipconfig /renew  # Windows
dhclient eth0    # Linux
  3. Check firewall logs:
    • Navigate to “Logs” > “Firewall”
    • Verify expected traffic appears

Common Pitfalls

  • Forgetting to save configuration changes
  • Incorrectly applying rules to wrong interfaces
  • Overlapping DHCP scopes causing conflicts
  • Blocking management traffic
  • Ignoring firmware update requirements

Configuration & Optimization

Security Hardening

  1. Change default passwords on all services
  2. Disable unused services:
    1
2
3
4

    > set service telnet disable
> set service http disable
> set service ssh enable  # Enable for CLI access
> save
  3. Implement network segmentation:
    • Create VLANs for different network zones
    • Set up firewall rules between zones
    • Example IoT VLAN configuration: ```yaml vlans:
      • id: 10 name: IoT interface: LAN1 ip: 192.168.10.1/24 ```

Performance Optimization

  1. Enable hardware acceleration:
    • Navigate to “System” > “Hardware”
    • Enable “Hardware Offload” settings
  2. Optimize firewall rules:
    • Place specific rules before general ones
    • Use object groups for similar services/hosts
    • Avoid overly broad rules
  3. Configure traffic shaping:
    • Set bandwidth limits for different applications
    • Prioritize critical traffic
    • Example configuration: ```yaml traffic_shaping:
      • name: Critical bandwidth: 50% priority: high applications: [ssh, rdp] ```

Integration with Homelab Services

  1. Set up VPN access:
    • Configure IPSec VPN for remote access
    • Generate client certificates
    • Configure firewall rules for VPN traffic
  2. Integrate with Docker containers:
    • Expose services through firewall rules
    • Use port forwarding for specific containers:
      1
2

      # Example: Expose Plex container
> create firewall rule name="Plex Access" action=accept service=https source=any destination=192.168.100.50:32400
  3. Configure logging to external syslog:
    • Set up syslog server in homelab
    • Configure Sophos to forward logs:
      1
2
3
4

      System > Logging > Syslog
Server IP: 192.168.100.100
Protocol: UDP
Port: 514

Best Practices

  1. Regular configuration backups:
    1
2

    # Backup via CLI
> backup config filename=sophos_backup.cfg
  2. Implement change management:
    • Document all configuration changes
    • Test changes in non-production environments
  3. Monitor resource utilization:
    • Track CPU and memory usage
    • Set up alerts for high utilization

Usage & Operations

Common Operations

  1. Adding new firewall rules:
    • Navigate to “Firewall” > “Rules”
    • Click “Add Rule” and configure:
      • Source/destination networks
      • Services/ports
      • Action (accept/drop/reject)
      • Logging option
  2. Updating firmware:
    • Download firmware from Sophos portal
    • Navigate to “System” > “Firmware Update”
    • Upload file and follow prompts
  3. Managing VPN users:
    • Create user accounts in “Users” > “Authentication”
    • Configure VPN access under “VPN”

Monitoring Procedures

  1. Real-time monitoring:
    • Dashboard view shows traffic graphs
    • “Monitor” section provides live activity logs
  2. Log analysis:
    1
2

    # View firewall logs via CLI
> show log firewall
  3. SNMP monitoring:
    • Configure SNMP community string
    • Set up monitoring in Zabbix/Nagios:
      1
2

      # Check interface status via SNMP
snmpget -v2c -c public <device_ip> 1.3.6.1.2.1.2.2.1.8.$ifIndex

Backup and Recovery

  1. Configuration backup:
    1
2
3
4

    # Automated backup script example
#!/bin/bash
DATE=$(date +%Y%m%d)
curl -k -u admin:password "https://192.168.1.10:4444/backup?config=1" > sophos_backup_$DATE.cfg
  2. Recovery procedure:
    • Access recovery mode via console during boot
    • Use “restore config” command
    • Verify functionality after restore

Scaling Considerations

For home lab use, scaling is typically limited by hardware. Consider:

  • Adding more interfaces for additional network segments
  • Implementing high availability with a second device
  • Using as a dedicated VPN gateway for growing remote access needs

Troubleshooting

Common Issues

  1. No internet access:
    • Verify WAN link status
    • Check NAT rules
    • Confirm ISP connectivity
  2. DHCP conflicts:
    • Check for overlapping scopes
    • Disable conflicting DHCP services
    • Use show dhcp lease to view assignments
  3. Slow performance:
    • Check CPU/memory usage
    • Review firewall rule efficiency
Open Source, Reddit Guides, Kubernetes
homelab sysadmin how-to tools kubernetes k8s docker containers
This post is licensed under CC BY 4.0 by the author.