Example of a small business network system

 Here's a system network design for a small business incorporating the Netgate 2100, Ubiquiti 8-way PoE switch, Ubiquiti access points, and a suggested NAS device:

1. Netgate 2100:

Position the Netgate 2100 as the central gateway device for the network. It will handle tasks such as routing, firewalling, and network address translation (NAT) to ensure secure and efficient connectivity between the internal network and the internet.

2. Ubiquiti 8-way PoE Switch:

Choose a specific model from Ubiquiti's range of 8-way PoE switches that suits your requirements. A popular option is the Ubiquiti UniFi Switch 8 (US-8-150W). This switch provides Power over Ethernet (PoE) capabilities, allowing you to power compatible devices directly through the network cable. It offers multiple Ethernet ports for connecting devices, ensuring reliable network connectivity.

3. Ubiquiti Access Points:

Deploy two Ubiquiti access points for seamless wireless connectivity throughout the office space. Ubiquiti UniFi Access Points are highly recommended due to their reliability and centralized management capabilities. Consider models such as the Ubiquiti UniFi AP AC Lite or the Ubiquiti UniFi AP AC Pro, based on your coverage and performance requirements.

4. NAS Device:

For the Network-Attached Storage (NAS) device, a popular and reliable option is the Synology DiskStation series. Specifically, the Synology DiskStation DS218+ offers robust features suitable for small businesses. It provides ample storage capacity, data redundancy, and advanced file sharing and collaboration options. The DS218+ supports various RAID configurations and comes with a user-friendly interface for easy management.

Network Topology Overview:

1. Connect the Netgate 2100 to the ISP modem, configuring it as the primary gateway device.
2. Connect the Ubiquiti 8-way PoE switch to the Netgate 2100 to extend network connectivity to multiple devices.
3. Deploy the two Ubiquiti access points at strategic locations to ensure optimal wireless coverage.
4. Connect the NAS device to the network switch for centralized storage and backups.

With this system network design, the Netgate 2100 serves as the primary gateway, the Ubiquiti switch provides power and connectivity to various devices, the Ubiquiti access points offer wireless connectivity, and the NAS device facilitates centralized storage and data backups.

Configuring the Netgate 2100 firewall involves several steps to ensure a secure and functional network environment. Here's a procedure to guide you through the process:

Note: The Netgate 2100 runs on the pfSense software, which provides a web-based graphical user interface (GUI) for configuration.

1. Connect to the Netgate 2100:

Ensure that your computer is connected to the same network as the Netgate 2100. Open a web browser and enter the IP address of the Netgate 2100 in the address bar. The default IP address is usually "192.168.1.1."

2. Access the pfSense WebGUI:

You will be prompted to log in to the pfSense WebGUI. The default username is "admin," and the default password is "pfsense." Enter these credentials to access the GUI.

3. Set Up WAN and LAN Interfaces:

• Navigate to the "Interfaces" section in the WebGUI. Configure the WAN interface by selecting the appropriate network adapter, assigning IP settings (static or DHCP), and defining any additional WAN-specific settings required by your ISP.
• Configure the LAN interface by selecting the appropriate network adapter, setting an IP address and subnet mask for your internal network, and enabling DHCP if needed.

4. Configure Firewall Rules:

• Head to the "Firewall" section in the WebGUI and select "Rules."
• By default, you'll find two pre-configured rules, "LAN to any" and "WAN to any." Review and modify these rules based on your network's specific needs.
• Create additional rules as necessary to allow or block traffic based on source and destination IP addresses, ports, and protocols. Consider the services you want to make accessible from the internet and those you want to restrict.

5. Enable NAT (Network Address Translation):

• In the WebGUI, navigate to "Firewall" and select "NAT."
• Configure outbound NAT rules if you need to translate private IP addresses to the public IP address of your WAN interface. By default, automatic outbound NAT rules are created.

6. Enable Services and Port Forwarding:

• If you want to make services accessible from the internet, configure port forwarding. Go to the "Firewall" section, select "NAT," and click on "Port Forward."
• Set up port forwarding rules to forward specific ports or ranges to internal IP addresses and ports of the desired devices or services.

7. Configure Additional Security Features:

• Consider enabling other security features such as Intrusion Detection and Prevention System (IDS/IPS), DNS filtering, VPN, or VLANs as needed. These can be accessed and configured within the corresponding sections of the WebGUI.

8. Apply Changes and Test:

• After making all the necessary configurations, click on "Apply Changes" to save and activate the settings.
• Test the firewall rules by attempting to access services from internal and external networks to ensure they function as intended.

Remember to regularly update and maintain the firewall rules to adapt to changing network requirements and security threats.

Note: It is recommended to consult the Netgate documentation or pfSense community forums for more detailed instructions and specific configuration options based on your network's unique needs and security policies.

9. Enable Logging and Monitoring:

• In order to keep track of network activity and potential security incidents, it's important to enable logging and monitoring features on the Netgate 2100 firewall.
• Navigate to the "Status" section in the WebGUI and select "System Logs" to configure log settings.
• Enable the desired log categories such as firewall, DHCP, or VPN logs, and choose where to store the log files, whether locally on the Netgate 2100 or on a remote syslog server.

10. Implement Traffic Shaping and Quality of Service (QoS):

• If you want to prioritize or limit specific types of network traffic, you can configure traffic shaping and Quality of Service (QoS) settings.
• In the WebGUI, go to the "Firewall" section and select "Traffic Shaper" or "Quality of Service" depending on the version of pfSense you are using.
• Configure the desired traffic shaping rules, such as bandwidth limits or prioritization based on specific protocols, IP addresses, or ports.

11. Implement VPN (Virtual Private Network):

• If remote access or secure site-to-site connectivity is required, you can configure VPN on the Netgate 2100.
• In the WebGUI, go to the "VPN" section and select the desired VPN protocol (e.g., OpenVPN, IPsec).
• Configure the VPN settings, including encryption, authentication, and VPN clients or peers.

12. Regular Maintenance and Updates:

• It is crucial to regularly update the firmware and software of the Netgate 2100 firewall to ensure it remains secure and up to date.
• Check for available updates in the "System" section of the WebGUI and follow the instructions to apply the updates.
• Periodically review and update firewall rules, monitor logs for any suspicious activity, and stay informed about security vulnerabilities and best practices.

Conclusion:

Configuring the Netgate 2100 firewall involves setting up the network interfaces, defining firewall rules, enabling NAT and port forwarding, configuring additional security features, and enabling logging and monitoring. It's important to customize these settings based on the specific requirements and security policies of your small business network. Regular maintenance, updates, and monitoring will help ensure the ongoing security and functionality of the firewall.

============================================================

Here's an example table with the pricing information for the hardware components mentioned:

Hardware Component	Brand/Model	Price
Netgate 2100	Netgate 2100	$300
Ubiquiti 8-way PoE switch	Ubiquiti UniFi Switch 8	$150
Ubiquiti Access Points	Ubiquiti UniFi AP AC Lite	$100 (per unit)
NAS Device	Synology DiskStation DS218+	$300

Please note that the prices mentioned are for illustrative purposes and can vary based on location, time, and specific vendor pricing. It's always recommended to check with local retailers or online stores for the most up-to-date pricing information.