Network Security — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
1. Firewall Platform - Virtual / Edge NGFW
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitspfSense CE: Free OSS unlimited, community support. pfSense Plus: $129/yr/instance. OPNsense: Free. FortiGate-VM: $0.80/hr = ~$576/mo PAYG, BYOL $600/yr + support. Palo Alto VM-300: $1.50/hr = ~$1080/mo PAYG, bundle $3000/yr with Threat Prevention. Free tier limits: Community edition unlimited throughput, no TAC.
2. VPN Gateway - Remote Access VPN
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWireGuard: Free OSS unlimited. OpenVPN AS: Free 2 concurrent users, $15/mo for 10 concurrent, $0.50/hr for 20. Tailscale: Free 100 devices/3 users, Pro $6/user/mo, Enterprise $18/user/mo. Pritunl: Free tier 1 gateway. Overage: Tailscale $6 per extra user.
3. Site-to-Site VPN / SD-WAN Edge Router
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsstrongSwan: Free OSS. ZeroTier: Free 25 nodes, Basic $50/mo 50 nodes. Fortinet SD-WAN: Included in FortiGate license $800/yr per edge. Meraki vMX: $600/yr + license. Palo Alto Prisma SD-WAN: $1.2k/yr per site. Free limit: WireGuard unlimited tunnels, manual mesh.
4. IDS/IPS Engine - Network Intrusion Detection/Prevention
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSuricata: Free OSS unlimited, community rules. Snort: Free community rules delay 30d, Subscriber Rules $29/mo, Snort 3 integrated $99/mo. Palo Alto Threat Prevention: $2000/yr per VM-300. FortiGate IPS: $1200/yr. CrowdStrike Falcon IDS: $59.99/host/mo. Free tier: Suricata/Snort handle 10Gbps on commodity HW.
5. Network Access Control (NAC)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsPacketFence: Free OSS unlimited endpoints, community support. OpenNAC: Free 50 endpoints. Cisco ISE: Base $50k/yr + $4/endpoint/mo, ~$120k/yr for 1000 endpoints. Forescout: $50k/yr base + $8/endpoint. Aruba ClearPass: $15k starter + $10/endpoint. Free limits: PacketFence supports 10k nodes on 1 VM.
6. Network Segmentation / Microsegmentation Controller
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCalico OSS: Free. Illumio Core: $50k/yr starter 100 workloads, $500/workload/yr scale. Guardicore: 30-day free trial, then $60k/yr 100 workloads, $400/workload. VMware NSX microseg: $6k/CPU/yr. Free limits: Manual VLAN ACLs unlimited but no visibility.
7. Network Traffic Monitoring / NDR (Network Detection & Response)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsZeek: Free OSS, needs 16GB RAM per 10Gbps. ntopng Community Free 30-day retention. Arkime: Free OSS. ExtraHop: $50k/yr base 1Gbps, $95k/yr 10Gbps. Darktrace: $100k/yr starter, $8k per 1Gbps sensor. Vectra AI: $70k/yr. Free limit: Zeek unlimited sensors community support.
8. DDoS Protection / Anti-DDoS Edge & Transit
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFastNetMon OSS: Free. AWS Shield Standard: Free included. Cloudflare Free: Unlimited unmetered mitigation L3/4. Magic Transit: $5000/mo base includes 20TB, $0.05/GB overage, $10k/mo for 100TB commits. AWS Shield Advanced: $3000/mo + $0.05/GB + $0.10/hr WAF. Akamai Prolexic: $7500/mo. Imperva: $6000/mo. Free limits: Self-hosted handles <20Gbps with BGP blackholing.
9. Log Management / SIEM for Network Logs (Firewall, Flow)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsElastic OSS: Free self-hosted unlimited ingest. Elastic Cloud: $95/mo 1GB/day, $0.15/GB overage. Graylog: Free 5GB/day, Enterprise $1500/mo. Splunk: $150/GB/mo, Cloud $2k/mo 5GB/day. Wazuh: Free. Devo: $80/GB. Free limits: ELK 100GB disk per node ~2TB/month flows on 1 node, retention 7 days.
10. Secrets Management for Firewall / VPN Credentials
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS: Free unlimited secrets, self-hosted. Infisical: Free 10 users, Cloud $20/mo. Doppler: Free 5 users/100 secrets, Pro $15/user/mo. HCP Vault: $0.03/hr cluster (~$22/mo) + $0.10/secret/mo >1000. CyberArk Conjur: $30k/yr. Free limits: Vault OSS 0$ but HA needs 3 nodes.
11. Network Infrastructure Monitoring / Uptime & SNMP
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPrometheus/Grafana: Free OSS unlimited metrics. LibreNMS: Free. Zabbix: Free. Checkmk Raw: Free 750 services. Datadog: $15/host/mo infra + $30/host/mo network monitoring, $5/GB logs. SolarWinds NPM: $2.5k/yr 100 nodes, $15k/yr 1000 nodes. PRTG: Free 100 sensors, then $1800/yr 500 sensors. Free limits: LibreNMS monitors 10k ports on 4 vCPU.
12. Web Application Firewall (WAF) / L7 Firewall Edge
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsModSecurity: Free OSS. Cloudflare Free WAF: Free 1 rule, Pro $20/mo 5 rules. AWS WAF: $5/mo per ACL + $1 per million req, ~$25/mo small site. Imperva: $500/mo starter, $3000/mo full. FortiWeb Cloud: $350/mo. F5 Advanced WAF: $2k/mo. Free limits: ModSecurity unlimited but self-hosted.
13. DNS Firewall / Secure DNS Filtering & DNSSEC
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsPi-hole: Free. BIND RPZ: Free. Cloudflare Gateway Free: 50 users free DoH filtering. NextDNS: Free 300k queries/mo, $2.99/mo unlimited. Cisco Umbrella: $5/user/mo DNS, $10/user/mo full. Infoblox: $2/infra/mo. Quad9: Free. Free limits: Pi-hole unlimited but no threat intel feeds.
14. Load Balancer / Reverse Proxy (L4/L7 + Global LB)
Runs in multiple regions for speed and resilience. Enterprise-grade reliability and the hardest to retrofit.Pricing & free-tier limitsHAProxy/Nginx OSS: Free unlimited. Caddy: Free. Cloudflare LB: $5/mo + $0.50 per 1M req. AWS ALB: $16/mo base + $0.0225/LCU-hour ~$25-80/mo. NGINX Plus: $2500/yr/instance. F5 BIG-IP VE: $2k/yr lab, $8k/yr prod 1Gbps. Free limits: OSS handles 100k rps per core.
15. Packet Capture & Forensics Storage (Full Packet Capture)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsArkime: Free OSS, storage cost only ~$20/TB/mo S3. Stenographer: Free Google OSS 10Gbps per node. NetWitness: $80k/yr starter 10TB. ExtraHop Packetstore: $60k/yr 48TB. EndaceProbe: $120k/appliance 100TB. Free limits: Arkime single node 50TB with 30-day retention on 10Gbps sampled 10:1.
16. NetFlow / IPFIX / sFlow Collector & Analyzer
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsnfdump/nfsen: Free OSS unlimited. pmacct: Free. ElastiFlow Basic Free 4k fps, Pro $2500/yr 25k fps. ntopng Pro $149/yr. Kentik: $15k/yr starter 10k fps, $2 per 1k fps overage. Scrutinizer: $5k/yr 10k fps, $25k/yr 100k fps. SolarWinds NTA: $2k add-on. Free limits: nfdump handles 100k flows/sec on 8 vCPU.
17. PKI / Certificate Management for VPN & Firewall TLS
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsLet's Encrypt: Free auto certs rate 50/week/domain. Smallstep OSS: Free. Cloudflare ACM: Free edge certs, $10/mo for custom certs. Venafi: $50k/yr base 1000 certs, $15/cert/yr overage. Sectigo: $20k/yr 500 certs. DigiCert: $8k/yr 250 certs. Free limits: Let's Encrypt unlimited but 90-day expiry, no S/MIME.
18. RADIUS / TACACS+ AAA Server for Network Admin Access
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFreeRADIUS: Free unlimited. tac_plus: Free. JumpCloud: Free 10 users, $7/user/mo after. Cisco ISE AAA part of $50k/yr suite. ClearPass: $12k base + AAA licenses. Radiator: $1800 one-time. Foxpass: $4/user/mo. Free limits: FreeRADIUS handles 10k auth/sec on 4 cores.
19. IP Address Management (IPAM) / DDI Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsphpIPAM: Free OSS unlimited. NetBox OSS: Free. NetBox Cloud: Free 50 IPs, $500/mo 10k IPs. Infoblox: $20k/yr 1000 IPs, $8/IP/yr overage. BlueCat: $25k/yr 2000 IPs. SolarWinds IPAM: $2k/yr 1024 IPs. Free limits: NetBox CE handles 100k IPs self-hosted.
How this small scale network security checklist works.
Each requirement below is something a small scale network security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.