I am at a small firm (12 PC on the internal network). We use this network architecture now:

Internet(Modem) --> Router --> Firewall --> Switch -- > Internal Network (clients PCs)
                |                       |
                |- Wifi Router          |- DHCP & AD Server
                |- HTTP file server 


The Main server and the clients PCs are (relatively) new (to other components), they were bought in 2005. But the other hardwares are creepy old ones, lot of them is older than 15 year. They became the bottlenecks of the network.

Here I describe all of the components in a short shoot:


The Router is an old ASUS (Rx3041) 
Firewall is a MS Server 2003 R2 with ISA 2006 installed (now formerly Forefront Threat Management Gateway) Definitely this is the main bottleneck of our network, we need to restart this server more than one per week, because it randomly start to drop allowed connections.
DHC & AD Server is a MS SVR 2008 R2 and it also operates as an internal file server and internal HTTP server (We run a Redmine issue tracker on it. But not on IIS.)
Wifi Router is just simply an access point to the internet outside of our firewall for our wireless devices such phones and tablets (but no laptops or computers, which we use for work.)
HTTP File server is an old laptop, which is out of the firewall too (However we have a rule for it to reach it from internal network, so we use it as a network drive to publish some stuff. 


While our programmers work out of office, so we don't have any sensitive information on most of the client PCs except one. Our server store sensitive information too. (source code, our clients information, etc..)

We want to fresh up our network a bit. We plan to use only one router instead of 2 routers and a firewall. It looks like this: 

Internet(Modem) --> Router with wifi --> Switch -- > Internal Network (clients PCs)
                           |                      
                           |- HTTP file server (DMZ maybe?)


We want to use the Asus RT-AC66U router.

I read this great answer from Bill Frank, but that question is three year old and things change fast. Maybe routers evolved enough to be able to secure a network. So my question: is this a viable option? Could a router protect us? Or must we use (still) a hardware firewall to protect our network? (We should, but must we?)

We choose this option because of the matter of money. If I could I setup a new router and place the whole network behind a firewall (on new machine) but management say there is no easy money can be spent for that. Should I fight for a new firewall server? Or the router will be enough?

The analogy of the bank and bank employee

You call the bank to request a new bank account, to make an appointment - whatever. Somehow you and the bank make sure that you are who you are, and the bank is actually the bank. This is the TLS process that secures the connection between you and the bank, and we assume this is handled properly. 

The roles in this play


The bank: a webserver
The bank employee: the OpenSSL service for that server 
You (the bank robber): a bot fetching all it can get from that server


Staying connected - the heartbeat

A bank employee answers your call. You request some information. The employee says to wait a minute and disables his microphone. He can hear you, you cannot hear him. Then it's quiet. For a long time. You start to wonder if he hung up. So you say "hello?" The employee is instructed to echo whatever you say, and replies with "hello". This is the heartbeat to check if there is still a connection. 

Now with this peculiar bank employee, you need to say first how many words you are going to use before you ask if the employee is still online. So instead of saying "hello", you need to say "one: hello", or "two: hello there". The employee now knows he can reply with repeating those (first) two words, and then can continue to work on your request. This is the heartbeat protocol. 

The problem - the heartbleed - no check on what is returned 

OK, you're bored, and you make a joke. You say "thousand: hello". The employee doesn't check that you only said one word (hello), and starts to reply with "hello" plus then the next 999 words that he says, or thinks about, or has in memory, before putting the mic off. This is the bug that causes the problem. 

Those 999 words are unrelated. Most of it will be useless, remarks about the weather, request for coffee, lunch appointments etc. Some of it can be important information about the bank or other customers. A transport of gold, a customer is going to bring in $1m, the code for entering the bank or the safe, etc. 

There is no check if there are actually 1000 words to be replied. Plus you can do this request over and over again - the employee won't complain and nobody else is going to notice what is going on. 

There is one limit. You will only get information from this one bank employee, and only the stuff he talks or thinks about. Other employees are not affected. You cannot see what is on his desk or in his rolodex. (Analogy: only data in memory (RAM) is at risk; data on the harddisk which is not read into memory, and data from other programs and processes is safe.)

Doing this you don't know what information you will get, but doing it for a long time over and over again, you will get enough information to finally be able to break in without anyone noticing it. You can enter the bank after hours, open the safe, etc. This is the risk involved. 

The solution - check request and renew codes

If the employee would think for a moment he would only reply with one word and then disable the microphone so you cannot hear anymore what he is discussing. By making this check, you will stay connected and know that the employee has not hung up, but will not hear any random info anymore. In effect the employee needs new instructions on what to echo. This is fixed with the update to the latest version of OpenSSL. 

The bank will have to renew security keys for entering the bank and safe, because it is unknown whether someone has the old codes. 
