Endian UTM

This UTM doesn't have rack concept and you don't have to download the apps
since all the features are bundled inside a single ISO. Apart from the usual
anti-virus, anti-spam, anti-malware capabilities, it also provides features like
SIP/VoIP support, stateful packet inspection, etc. You need to open its
configuration panel from a Web browser. You can configure the UTM from the
client application as well which is pretty easy. As you access the browser
interface for the first time, a wizard will let you configure it without any
hassle. Like Untangle, Endian has a couple of other versions of UTM available
such as hardware appliance, which you just need to plug into your network to get
your machine ready. There are a couple of good features available on the paid
UTM such as, high availability in case of failure, instant recovery/backup on a
USB stick, captive portal, etc.

Though the installation process was in textual mode, it was easy. For
evaluating, we installed this appliance on our Harpertown server, which took
10-15 min. Then we configured two different NICs, one acting as WAN interface
and other as LAN interface.

In the anti-virus test, the results were similar to those of Untangle with a
score of 93%. This was because both UTMs use the same ClamAV anti-virus
technology. Also, ClamAV itself is open source and free. Next was the anti-spam
test. We downloaded approx 1000 spam mails. The UTM scored slighty better than
Untangle, with 55%. Well, this number is not great, as we have seen devices
which can block spam by more than 90%. The paid devices like ZyXel 70 could
detect 96% of image based spam. Then we ran Nessus which showed zero warnings
and zero holes for the setup we did. We also tried jamming the Endian server's
LAN port by flooding the device by five different clients and the Internet
access in the internal network was blocked.

Endian provides you a real time picture of the connection being established over different protocols using the IPtables connection tracking.

Unfortunately, this attack was not logged or detected. We tested the device
for denial-of-service attack and for this, we ran the test from the public
network and attacked its public IP. The attack failed and the device kept
working without any errors.