Endian UTM

This UTM doesn't have rack concept and you don't have to download the apps

since all the features are bundled inside a single ISO. Apart from the usual

anti-virus, anti-spam, anti-malware capabilities, it also provides features like

SIP/VoIP support, stateful packet inspection, etc. You need to open its

configuration panel from a Web browser. You can configure the UTM from the

client application as well which is pretty easy. As you access the browser

interface for the first time, a wizard will let you configure it without any

hassle. Like Untangle, Endian has a couple of other versions of UTM available

such as hardware appliance, which you just need to plug into your network to get

your machine ready. There are a couple of good features available on the paid

UTM such as, high availability in case of failure, instant recovery/backup on a

USB stick, captive portal, etc.

Though the installation process was in textual mode, it was easy. For

evaluating, we installed this appliance on our Harpertown server, which took

10-15 min. Then we configured two different NICs, one acting as WAN interface

and other as LAN interface.

In the anti-virus test, the results were similar to those of Untangle with a

score of 93%. This was because both UTMs use the same ClamAV anti-virus

technology. Also, ClamAV itself is open source and free. Next was the anti-spam

test. We downloaded approx 1000 spam mails. The UTM scored slighty better than

Untangle, with 55%. Well, this number is not great, as we have seen devices

which can block spam by more than 90%. The paid devices like ZyXel 70 could

detect 96% of image based spam. Then we ran Nessus which showed zero warnings

and zero holes for the setup we did. We also tried jamming the Endian server's

LAN port by flooding the device by five different clients and the Internet

access in the internal network was blocked.

Endian provides you a real time picture of the connection being established over different protocols using the IPtables connection tracking.

Unfortunately, this attack was not logged or detected. We tested the device

for denial-of-service attack and for this, we ran the test from the public

network and attacked its public IP. The attack failed and the device kept

working without any errors.