Performance of a raspberry pi as a firewall

Question

I am thinking of setting up a raspberry pi inside a private network to act as a firewall for all incoming/outgoing traffic in that network. The idea would be to have a router connected to the network and connect the pi (along with all other devices) to the router and configure the router to allow only connections to and from the pi which in turn would allow or deny them access to other network devices.

Is this possible? I am guessing that if so it would limit all traffic in the network to the throughput the pi is able to output (and therefore in most cases not very useful), is that correct?

This is mostly for educational purposes really rather than a serious attempt at something like this.

Answer 1

This is possible although it would make more sense to connect the pi to the router, then everything else to the pi -- I mention this because the "along with everything else" in your question is a little ambiguous. Perhaps that is what you meant. Anyway, this would obviously require a bit more hardware -- a switch or hub and/or an appropriate wifi adapter.

There are advantages and disadvantages to this. The major advantage would be you could set up a much more fine tuned firewall than you can with the stock software on most home routers. But the disadvantage is...

I am guessing that if so it would limit all traffic in the network to the throughput the pi is able to output (and therefore in most cases not very useful), is that correct?

It is. If you want to support other people streaming on multiple devices simultaneously, the pi will be a potential bottleneck because of the max 100 Mbps ethernet speed. That would not exactly have to be divided since output would be on the USB bus -- "not exactly" since the pi's ethernet is already on the USB bus, which is in theory max 480 Mbps; so when the ethernet is maxed out, you still have enough left to pass though on the USB bus. Incoming vs. outgoing is not such a big deal since normal internet usage is mostly in one direction (in).

I think you want at least 5-10 Mbps available per device and leave plenty of wiggle room in the numbers; so half a dozen might be realistic. If those devices are often used for torrenting or otherwise mass downloading, forget it. The people using them won't be happy.

I am sure the processor + iptables (the linux kernel firewall, which is also used in most routers, but hidden behind a simplified interface) can handle that volume, so that is not a problem. But if you are seriously considering this you'd want to examine what the usage is on your LAN.

Answer 2

I did some informal testing with a RPi in bridged, routed and NAT configurations using a usb wifi adapter to connect clients to the RPi, and the wired 100 Mbps Ethernet to my Internet router. Connecting directly to the router with wifi, I get 60 Mbps download speeds. With the RPi in the path, it drops to 10 Mbps or less. This was without any iptables processing on the RPi.

From everything I've read, the sharing of the USB bus between the wired Ethernet and USB adapters puts a definite bottleneck on performance. So yes, you can definitely use the RPi as a firewall, but performance may be disappointing depending on your needs and Internet speeds. I may still use it as my hotel room travel router where Internet speeds tend to be limited to 5 Mbps or so.

Answer 3

I'm a big Raspberry fan - but in this case I would recommend to use the 'BananaPi R1 Router Board' which gives you the right hardware for your task.