OK... so I've been spending a bit of time working on infrastructural things over the past few weeks and I've come upon an interesting phenomenon that I shall call the 'Shitty Linux Box Firewall Phenomenon'.
It can be described thus:
For some reason it seems that a broad group of technical people subscribed to the Linux box as a firewall approach to internet security. Now this is probably not an altogether bad thing- we're running a software on OS firewall here too. But, they seem to think that because Linux can run on the smell of an oily rag, their firewall should be run on the smell of an oily rag. e.g. 'Oh we keep a whole heap of old hardware floating around for when we install firewalls at customer premises'.
What's with this. If you value your network connectivity, and judging by the expletives bandied around here at our currently shitty pipe most people do, then you want your firewall to be running on your best hardware, not your worst.
A firewall (particularly a software one) represents an pretty risky single point of failure for your network. It's not like you can just ring up Cisco or Watchguard and ask for a forward replacement when it shits itself. So why run it on shitty gear! I ain't got no problem with the concept of Linux as a firewall but put it on a decent box- ideally something with redundancy such that you can swap out a decent chunk of the machine without turning it off. Things like hot swap power supplies and Raid 1 with a hotspare drive.
Anyway rant over.
