Need advise / How to create DMZ with UTM in my home network ?

Hi 

I am not sure if I got all your questions. But I'll try to give a few answers.

This link might be particular helpfull: http://www.letmegooglethat.com/ ;-)

1: Can Sophos UTM do NAT, Routing and Firewall?

Yes.

2: Can it do failover of uplink? 

Yes

3: How to setup a DMZ

It depends on your setup. Or what you want to achieve. Me personally prefer to have it logically separated like in parallel rather than sequential. See diagram below. Its sufficient for my (home) use.

4: Hardware

Here as well. It depends. I have it running on a ESXi, i7 later generation with 64bit of RAM. The limiting factors are IDP, VPN and number of concurrent users.
My setup should be sufficient for around 100 Users with at last 50 mbit/user minimum on VPN. (Yes, its far over kill for home use.. but hey, it was a 600.- $ in total, I can have other things on ESXi and it is going to last a good moment).

To find your suitable hardware, you might consult a so called "sizing guide": https://www.google.ch/search?q=sophos+sizeing+guide&oq=sophos+sizeing+guide&aqs=chrome..69i57j0l5.4726j0j9&sourceid=chrome&ie=UTF-8 

I have DMZ/ LAN on the very same Sophos but with 3 Network Ports: WAN, LAN, DMZ. It allows me to separate the traffic.

Hope that helps a little

N3

About point 3

My AP in DMZ is to provide Wifi connexion to internet (tablet/laptop) and also give acces to device present into DMZ if necessary, AP will not need to have LAN access.

I have multiple NAS, one in DMZ, three on my LAN, the one in DMZ will be accessed from Internet only, it offer FTP services.

I would like to make transfert from NAS in DMZ to NAS in LAN and reverse, does it can be possible in my or your diagrams ?

If i put printer on DMZ, LAN user can use it and other user from AP too ? (if add the firewall rulz of course), i figure that it can be better to put the printer in DMZ to serve all users from AP or LAN, does it can be possible in my or your diagrams ?

I planed to use 2 sophos because i was thinking that my LAN was more secure/protected like this, but if you confirm me that it has no benefits and that the same security level (with more easiest setup), i will use only one UTM.
Does it can have bandwidth impact with 1 sophos utm to manage flow between LAN to DMZ ?

About point 4

I have the opportunity to recover Sophos SG230 with Flex Port, do you think that it can be enough to manage 1Gbe ISP bandwidth connexion ?

I didn't need VPN function, traffic type will be FTP, Torrents, Web browsing.

if it's not enough, what current model do you suggest ? or do you suggest me to keep my current setup with home edition ?

Many thanks for your help.

What do you try to achieve? It doesn't look much like a home use setup. A school network?

Point 3:

Yes, you can configure ports at your convenience from any network to any other. It is possible in both, yours and my diagramm.

I personally would put the printer to the LAN. It is just easier. As long as the printer doesn't provide services to the internet, I don't see much of a risk.

Using two Sophos wouldn't increase security per Se. If you would use two different brands of firewalls, security could be higher. However, this will keep you busy for a while... in my eyes a bit too much unless you are a bank or a government.

Point 4:

I am not familiar with that type of hardware. Just google for the specification. Loog for "maximum throughput". Usually, a device that can handle up to 1GB is rather close or above to 1000$. I cannot tell, if self-made hardware suits you more since I am not familiar with your needs and skills.

General considerations (for SOHO users)

How would a hacker attack a home user?

1/ by far the easiest way would be to get a user connecting to my false hotspot. One would be able to sniff your data very easy.

2/ Very common is malware (virus, worm, backdoor, ..) to one of the devices in your network. This applies also for weather station, online radio or gaming device.

3/ Getting access to your data through a cloud storage (dropbox, ..) or webpage of any kind. Bruteforce attacks or hackings.

4/ Absolut security doesn't exist. Minimize your loss.

Considering this points, I follow below concept for my home use setup:

• Backup, Backup, Backup
• All devices need to be self-maintaining. Security patches and virus updates have to load automatically. Backups run automatically.
• Confidential data is on crypted drives or crypted folders
• A different password and login for every online service or webpage. For really every service. Also for every computer and device in the network.
• Only crypted/ SSL connections when transferring data for e-mails and webpages
• Use of VPN when connected to public WLAN
• As few software installed on computers as possible. Only registered software from trusted sources.
• Limiting the range of WLANs to as low as possible.
• No network connections from external to internal LAN allowed
• Monitoring login attempts to firewall and servers
• Regular network scanning

Maybe to add: I don't see WLAN as such a risk as others do since I have a centrally maintainted UNIFI network, that provides certain monitorings and isolation settings.

And, important; you need to be able to maintain it with the least effort possible. Otherwise, you won't do :-)

Good Luck

N3

What do you try to achieve? It doesn't look much like a home use setup. A school network?

Point 3:

Yes, you can configure ports at your convenience from any network to any other. It is possible in both, yours and my diagramm.

I personally would put the printer to the LAN. It is just easier. As long as the printer doesn't provide services to the internet, I don't see much of a risk.

Using two Sophos wouldn't increase security per Se. If you would use two different brands of firewalls, security could be higher. However, this will keep you busy for a while... in my eyes a bit too much unless you are a bank or a government.

Point 4:

I am not familiar with that type of hardware. Just google for the specification. Loog for "maximum throughput". Usually, a device that can handle up to 1GB is rather close or above to 1000$. I cannot tell, if self-made hardware suits you more since I am not familiar with your needs and skills.

General considerations (for SOHO users)

How would a hacker attack a home user?

1/ by far the easiest way would be to get a user connecting to my false hotspot. One would be able to sniff your data very easy.

2/ Very common is malware (virus, worm, backdoor, ..) to one of the devices in your network. This applies also for weather station, online radio or gaming device.

3/ Getting access to your data through a cloud storage (dropbox, ..) or webpage of any kind. Bruteforce attacks or hackings.

4/ Absolut security doesn't exist. Minimize your loss.

Considering this points, I follow below concept for my home use setup:

• Backup, Backup, Backup
• All devices need to be self-maintaining. Security patches and virus updates have to load automatically. Backups run automatically.
• Confidential data is on crypted drives or crypted folders
• A different password and login for every online service or webpage. For really every service. Also for every computer and device in the network.
• Only crypted/ SSL connections when transferring data for e-mails and webpages
• Use of VPN when connected to public WLAN
• As few software installed on computers as possible. Only registered software from trusted sources.
• Limiting the range of WLANs to as low as possible.
• No network connections from external to internal LAN allowed
• Monitoring login attempts to firewall and servers
• Regular network scanning

Maybe to add: I don't see WLAN as such a risk as others do since I have a centrally maintainted UNIFI network, that provides certain monitorings and isolation settings.

And, important; you need to be able to maintain it with the least effort possible. Otherwise, you won't do :-)

Good Luck

N3