I need help with XG configuration for my home network.

Question

Background: I am new to networking, my only previous networking experience is setting up a home Netgear wireless router (only the very basics). Last night, I setup XG on a small PC that has 4 ethernet ports. I just got it set up and running so it has the configuration like new with no changes. I hooked it up to my modem and my home PCs all get the internet just fine through it. 
 Since I have teens and pre-teen kids in the house, the main bandwidth hogs are Spotify, youtube, and Netflix 4K. For us parents, we need our network secure so that our accounts, financial and private information and data are secured from outside threats/ hackers. 
 Goal: 1. Can you suggest an XG security setup guide or other suggestions on how to set up XG so that if the kids accidentally download a malicious video game or visit a bad website that has malicious HTML or software will somehow be caught by XG? Ideally, XG would catch or prevent the malicious code from doing harm, exposing private data, or giving hackers control of our networked PCs. Sorry, I'm new to the network security world so my terminologies might be off a bit. 
 Thanks so much!

JesseB. · Accepted Answer

I'll give you some samples that I use in my own network. And mind you, I'm a very security conscious person, so I do try to personally maximize security, while keeping the network fairly open (not blocking many things except for malicious stuff and ads). 
 
 Now, let's begin. 
 Setting up Web Filter policies for catching certain things is a great first step for web protection. 
 This is a policy I setup on my network, you can use it as an example, it matches pretty much the type of web policy you'd like: 
 
 This kind of policy can be setup in Web -> Policies . Click the "Add Policy" button, then start customizing. Make sure that the Actions allow and block both HTTP and HTTPS, depending on what you want. Default Action should always be Allow, unless you want to manually whitelist every single website and service people can use online (which can be A LOT, and very time consuming). 
 Under Web -> General Settings , I have these settings: 
 
 To maximize virus protection, I have virus engines set on Dual, which will use both Sophos and Avira. Blocking Potentially Unwanted Apps (PUAs) is also great, as that reduces the chance of someone downloading adware or something of that nature. I personally have file size on the maximum it can go, to make sure it scans as much as it can. 
 
 Another great tool for network security is Application Control . With this, you can completely block malicious or ill-intent type of applications from connecting. 
 I'd recommend creating your own policy for this, so you can customize it to your liking. You should check out the categories and risk options the most. 
 For instance, I block all applications with the risk level of "Very high". And having checked the applications in that, I don't see any use for them on my network. I additionally block the P2P category, since I don't really plan on torrenting anything. You can also block the "Can bypass firewall policy" characteristic. 
 But really, when it comes to App Control, I'd recommend you just go through this yourself and block what you feel doesn't belong on your network. 
 
 And lastly, you can set this all up in a Firewall Rule . 
 I'd suggest you create your own firewall policy, and have it be the last one on the list (very bottom). 
 You can take my setup, as an example: 
 
 Now, let me explain my policies. 
 I've had the QUIC policy in place, before the option was given to simply block it. Never removed it. 
 LAN -> Smart TV is blocked because I don't want people in my house casting video content to any Smart TV's. 
 Email scanning is a default, which I leave alone. 
 I created a rule specifically for Netflix, so it can function without any issues. You can read more about setting that up by clicking here . 
 LAN -> WAN is my "allow LAN to WAN" connection policy.

Make sure you set your policies you created by their name, in the App and Web policy settings. 
 And there you go! I hope I was of some help!

JesseB. · Answer

Yeah, that looks good.

Ashen1 · Answer

check out this easy to understand vid library from Sophos which will benefit all levels (beginner - advance) 
 www.sophos.com/.../xg-how-to-library.aspx 
 
 its approach is step-by-step and straightforward, Hope this one helps as well.