Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 22 replies
  • Answers 1 answer
  • Subscribers 14 subscribers
  • Views 53802 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is a limit of 50 IP addresses still realistic for home use?

Paul C

I've recently started using a UTM 9 home license on a small firewall appliance (Intel J1900-based). It's working well, and I'm definitely a fan. However, I'm immediately running into the 50 'user' (really IP address) limit.

We're a typical family of three, admittedly a gadget-heavy household, but not ridiculously so. I expect that's likely to be a common trait of anyone sophisticated enough to want to run Sophos UTM 9 at home.

In short, I've exceeded the 50 IP limit by over 10% without even trying. Which surprised me at first, when I started counting the devices I've added to my network over the past few years, sure enough, the count was correct. For example: three eero WiFi units, 5 small 'web smart' network switches (i.e. each has a web interface), A/V receiver, four DVRs, two HDHomeRun Prime network tuners, two smart TVs, a Sonos system, a printer and an all-in-one, standalone doc scanner, two Nest thermostats, the main '24x7' Linux server, plus a small Synology and Qnap NAS, Xbox 360, nVidia Shield TV, security camera, sprinkler controller, SmartThings Hub, Roomba ...that's 32 IP addresses, before we even start talking about laptops, tablets, smartphones, kindles, etc. Even my Smartwatch requests an IP address...

As I understand it, the Home license allows 50 IP addresses, period. The only way past that limit is to purchase a commercial license, whose costs runs to four digits for even a subset of the functionality provided in the home license. If that understanding is correct, either I have to work around this limit by putting some devices on a NAT'd subnet (which seems counter to the spirit of the license), or give up and go elsewhere. Which would be a shame, the only other negative I've come across is the complete lack of UPnP port forwarding (yes, I fully understand the controversy - but believe it's a solvable problem).

I see the value being offered, and would happily pay to increase that limit to 100 or 150 IP addresses (say $99 or $149?). I'd rather not pay a subscription personally, unless it's significantly less per year. But I don't have either option, it seems.

Thoughts?

- Paul



This thread was automatically locked due to age.
Parents
  • 0

    What you really need to think about is do all those devices need internet access?

    Do the printers need to access the internet?

    You can setup your own rules for upnp, you will need to control which devices have access to the rule. That protocol is a huge security risk and most business do not allow it outside of their environment.

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • 0

    What you really need to think about is do all those devices need internet access?

    Do the printers need to access the internet?

    You can setup your own rules for upnp, you will need to control which devices have access to the rule. That protocol is a huge security risk and most business do not allow it outside of their environment.

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

Children
  • 0 in reply to rfcat_vk

    Yes, the vast majority do need internet access. Even the printers - the all-in-one can scan to Google Drive, etc., and the printer needs internet access if you want to print to it from a Chromebook. Heck, even my blu-ray player gets its firmware updates over the internet. Taking one or two devices out of the equation isn't going to solve the constraint for long.

    Yes, I could set up my own rules to ape what UPnP would give me. But that would mean a handful of devices getting static IP addresses, and manually administering rules (perhaps forgetting to disable them when no longer needed). This is exactly the problem UPnP is supposed to address.

    The protocol itself could have been designed better (thanks as always, Microsoft), but there are ways to reign in the risk. The current implementations just blindly do whatever the client asks for, but it doesn't need to be so. The security issues could be tamed by adding some intelligence to the upnp daemon, to have it check what the client is asking for against what the sysadmin has said is OK on this network. It's that lack of ACLs (or equivalent) in the UPnP IGD implementations which pose the security risk, in my opinion.

Unfiltered HTML