Choosing a Router/Firewall for the Home LAN

Dr. Zowie asks: "How should one choose a router for a home LAN? We just added a few hosts on our home ethernet, which is connected via DSL. There are an amazing number of new entries into the market for routers and even stand-alone firewalls. NetGear, Linksys, SMC, and even Panasonic all have boxen in the $99-$300 range, each of which will do some combination of NAT, routing, source-IP filtering, port filtering, and content filtering."

"It's not at all obvious from the packaging, the web sites, or the drool-proof pamphlets in the boxes which routers will do what. For example, we'd like to pass through packets for our two server machines, and use NAT/DHCP on a third address for the rest of the LAN. Nearly all the boxes advertise that they can do NAT routing, but many don't support NAT and static-IP routing simultaneously.

Die-hards will insist that one should run a standalone box with dual ethernet cards and the appropriate routing goodies -- but these standalone boxes, at 5-15 watts and a couple hundred bucks, seem like comparatively hassle-free solution. Which one do you use?"

Harddriveless

You don't need a hard drive for a firewall/router made from an old machine. Check out the LRP [linuxrouter.org] for a solution that fits on a single 1.44 mbyte floppy that can be write-protected and just needs to be power-cycled to be reboot.

Re:Old PC

Perahps, but compared to a dedicated device from D-link or linksys:

• How much more electricity does this use?
• How much more heat does this give off?
• How much more noise does this make?
• How much more space does this require?

Re:Old PC

But with a D-link or linksys:

• Does it support IPv6?
  
• Can you run a dynamic DNS client on it?
  
• Can you create a VPN between it and your parents' house?
  
• Can you call it with a modem for access from anywhere?
  
• Can it act as an answering machine?
  
• Can you run a mail server on it?
  

Other than IPv6, all the rest can be done with a separate 24/7 machine behind a linksys, but IPv6 tunnels do not work through a linksys on a dynamic IP, at least not with freenet6 or any other IPv6 tunnel service I know. Because of this I've personally been forced to stop using my linksys completely. What we need is an open-source linksys with a bios that can be programmed by the end user. I'd pay $100-200 for such a device.

Re:Old Laptop

I found old Pentium laptops to make excellent firewalls. They are a little more pricey than the old PC but they have a few advantages:

Built in battery backup
Low power consumption
Few (if any) noisy fans
Small, and fit nicely in a rack shelf
Built in collapsible console

Look around and you can find one for about the same price as the small NAT routers. The only real shame is they only have typically two PCMCIA slots, so you can't have a DMZ or wireless net interface seperate from the internal and external interfaces.

Re:Old PC

But you also need to know OpenBSD. People who are not interested in being sysadmins have a right to NAT too!

There are also people who do not want to, or do not know HOW to assemble a cheap PC from parts. There is no shame in a "black box" solution.

Re:Old PC

I think you are missing the point. Yes it may be the best solution to set up a PC. The person asking the question however wants to know which out of the box solution is best. Not what do-it-yourself solution is best.

How is it so many smart people have so much trouble reading?

A Good Source of Info

Practically Networked [practicallynetworked.com]
All kinds of good information and reviews on exactly what you're looking for.

Re:and the winner still is

> I can go and tweak out my iptables stuff but too
> many admins would prefer not to. Is there any
> good solution?

Try Firewall Builder: http://www.fwbuilder.org/

My experience

Linksys are OK but quite limited in their functionality. I am usuing it and quite happy.

SOHOWARE sucks big time - buggy and unreliable. Do not beleive words about "Stateful Packet Inspection" - even if it does it you could not use it.

What I really want to see is SNMP management for
such devices. Unfortunalty, best they could do
is read-only SNMP access.

Take a look at Smoothwall, perhaps?

http://www.smoothwall.com should get you to the main product page. It's a freeware GPL firewall running Linux, but designed for ease of installation and administration via a web browser afterwards. The new version 0.99 is due for release any day now, and the beta of 0.99 works quite well for me.

Since most people have an old 486 or Pentium lying around, the cost to set this up is next to nothing - and it has features the hardware firewall/router boxes don't include. (EG. Ability to auto-update your dynamic IP with the dyndns.org service and "snort" to log hack attempts with details on what was attempted.)

Re:Take a look at Smoothwall, perhaps?

I think you mean http://www.smoothwall.org

www.smoothwall.com is a real estate site.

Here's what I have.

I have 5 computers connected to the internet in my in-home LAN right now. My router/firewall/gateway is a 166MHZ linux box running redhat 6.0. I've been running this setup for about two years, upgrading as necessary. Using IP masquerading [local.net] this is all very simple and with IP Chains [linuxdoc.org], you can setup any firewall rules you want. I recently installed redhat 7.1 and it has a firewall wizard type thing that makes this all even easier! Take an old box and put linux on it, you won't be dissappointed.

I got the Linksys

I chose the Linksys (3 RJ45 + 1 USB connections) over a custom PC running Linux/*BSD because:

• For $160, I couldn't have built a cheap computer(I don't own enough spare parts yet).
  
• Its power consumption is so much lower than any custom computer I (=limited skills) could build.
  
• It is completely silent.
  
• If a friend visits me with his/her laptop, we can connect it without any extra hardware to the net via the USB connection (albeit, the laptop must run Windoze 2000 ... last time I tried, none of the Linux USB network drivers worked)
  
• 
  I love the IP forwarding of the linksys. All connections to port 80, 443, 21 and 22 are reditected to my Linux box, and all other ports that involve games and *apster clones are redirected to my Game box. Remaining ports are blocked.
  
• And then I choose Linksys over other brands because ... well ... it's Linksys, after all!
  

My Suggestion: Netgear RO318

I personally recommend the Netgear RO318. I used to have the Linksys BEFSR41, but I dumped it because it was causing problems playing Quake III Arena online. I did a lot of research, and found the the RO318 best suited my needs. Here's why:

• Price: In the $150 range, it's not cheap, but not expensive. However, its other features quickly make it worth every penny.
• 8 port switch: more than I've seen for this price. This is good, seeing as I have an obscene number of computers in my house.
• Web-based setup: I really didn't want to telnet into the router and set it up, so I made sure this one has web-based setup. It does, and it's easy to configure. It took me about 5 minutes to get it set up with my DSL (Verizon).
• Stateful Packet Inspection: The RO318 is a real firewall, not just NAT (although it does do NAT).
• Web-access policies: You can block certain computers from going to websites containing keywords, etc. This is useful if you don't want your kids to be visiting teenieporn.com
• Email reports: The router will email you and let you know if a) you are being attacked (automatically detects portscans, etc) and b) if sites are being visited that shouldn't be (of course, you set this all up).
• Design: It's flat and sturdy, which means I can put my other switches on top of it. Couldn't do this with the Linksys due to its design.

Overall, I love it. No problems with Quake III Arena, easy to set up, works flawlessly. The reasons the above poster listed are also true: with 8 ports, you can always plug in a laptop; port forwarding works well, and Netgear also has a great reputation.

Here is the product information page [netgear.com] at Netgear. It can be had from buy.com for $155.

OpenBSD

I use an old P133 (overkill, I know) running OBSD as my firewall/gateway/ntp server/dhcp server. I could have gone out and spent money on a nice compact unit, but I like the fact that I can upgrade my OS, tweak my filters and above all: learn more about OBSD, networking and OS hardening [geodsoft.com].

Priceless

Compaq 486/66: Free
2 old NICs sitting on shelf: Free
OpenBSD: Free

Laughing at hax0rs trying to hack your Bridge Firewall: Priceless.

SMC 7004ABR

I do not have any servers, but this works well and has the following features...

- DHCP server
- NAT
- RJ-45 for connection to Cable/DSL and a DB-9 for connection to a modem.

I particularly like the fact that it can do Cable/DSL and Dial-up. Since I am moving a lot, I never know what is going to be available. You can even use the dial-up as a backup, should the Cable/DSL fail. Web based administration is straightforward. But I can't comment on that beyond the basics.

Power consumption is low (22W I think) and it is a lot quieter and much smaller than a PC.

It is good for my simple needs, but you may need more for your servers.

Here [smc.com] is a link to the product page. You can download the product brochure and check it out for yourself.

A bevy of information on configuring your routers

Here! [dslreports.com]

I have a netgear router myself, and have locked it down pretty well with the advice I found.

Efficient SpeedStream

You might want to check out one of the Effecient SpeedStream routers. SWBell ran out of DSL modems and gave us a free SpeedStream 5660 DSL modem/router instead (with the warning that sharing the connection is perfectly legal according to our TOS but won't be supported of course, *nudge nudge wink wink*).

It's got probably everything you're looking for: NAT, DNS, port forwarding, hardware firewalling, and support for everything from PPPoE to static IPs on the ISP side. Plus it's got a nice HTML interface plus a UNIX-style Telnet interface (with lock-down support, of course) and even support for a serial cable so you can Telnet to it as a dumb terminal if the Ethernet's down. And the documentation, while not super-thorough, isn't drool-proofed. The only real complaint that I have with it is the way the firewall works; it blocks unopened ports if there's no outgoing packet to correspond with incoming ones. This is only a problem if you're serving something, but more software works like a server (as far as the router's concerned) than you may expect; it was a little weird having to manually open up AIM's port so my little brother could use AIM without having to initiate the conversation.

The main disadvantage is price and availability -- I don't know how easy these are for end users to get their hands on these, and it'll probably run upwards of $300. If you're lucky, your ISP might have some, but I've heard of ISPs giving out these routers and with the remote administration password-locked so people don't (ahem) accidentally enable NAT without paying for a static IP first.

My experience...

Wow, its amazing how many people suggested that you should use an old PC. I guess no one read your whole post, or the 57 posts that said the same thing before they posted.

First off, I've done the old PC thing myself. It was very flexible and I really liked having a linux box I could tunnel to. OTOH, it also sucked electricity and space which are 2 precious commodities here in California.

I eventually switched to the BEFSR41 from linksys. I picked it up for $100 (BestBuy just had them for $79) and its worked out wonderfully. Low power, silent, and very, very small.

One word of warning: if you intend on hosting any type of game server (quake, half-life, etc...) you should do a search on google first to make sure there aren't any weird problems with the device you decide on. For instance, I can run a half-life server behind the box, but it tends to kick people randomly.

The Linksys is nice

I have the BEFSR41 [linksys.com], which is the router plus a 4-port 10/100 switch. It was about $100 from CompUSA.

Dislikes: the web-based interface is a bit wonky with Netscape 4.7 on *nix. It works, but has some weird errors on occasion.

Likes: it works as advertised. I fought with PPPoE on an OpenBSD box for several hours -- I could not figure out why it wasn't working, and none of the so-called "How-tos" helped.

HOW-TO -- a definition

A cruel on-going joke between free unix-alike "documentation" writers that is mostly filled with "it worked for me, maybe you're stupid" insinuations and "this important part of the configuration is terribly, terribly important, but it's beyond the scope of this shitty How-To. Perhaps you are stupid?" notes.

So, I went and bought the Linksys, and within one hour (including the time it took to buy the thing), I was passing bits around the Internet.

The web-based interface does work somewhat with Lynx, but is very cantankerous when used so. I have ssh'ed into my server and then used Lynx to reconfigure the router.

You can forward ports to particular internal IPs, i.e. "all requests for port 80 goes to the computer at 192.168.1.100", and can even put one computer (one IP address) in a "DMZ", where it is completely open (all ports are available to answer).

If you want to do complex filtering or firewalling, it doesn't do such. If your needs aren't really complicated, it will work for you.

Score -1, Flamebait

God, do all you "old PC NAT box" folks have fears about your manhood or do you just not read? The man clearly stated that he was looking for info on router appliances, and just as clearly excluded homebuilt PCs as a topic of discussion, but everybody and their brother still has to trot out the damn things, perhaps to demonstrate their questionable 1337tness by tossing it off so casually, as if it were a trivial solution (which it can be, in terms of technical difficulty. But the man mentioned $$$ and watts).

God help us when you all have actual beowolf clusters in your basements to brag about at every opportunity...

Which "home router" do I choose?

Well, doing consulting and having setup a lot of NAT environments across many platforms, I would say that these "all-in-one" solutions are a great idea. That is, however, if you get the right one.

Certainly the first suggestion I have when I see a home business paying for extra ips, is to take an old machine and setup ip masqurading on a linux box. However, I have found that many people are "scared" of linux, and some don't have dedicated machines. Others want a firewall, public servers, and of course the full web/email site setup. While some businesses look at this as opportunities for recuring fees to unknowledgeable users, I try to lay it all out for the customer. Advantages and disadvantages, ease of administration, power consumption, maintenance. In most cases, customers LOVE the all-in-one solution devices.

For power users that want to control all aspects of filtering, routing, port forwarding, and hosting, this is not the best option. However, it can be a *good* solution. I have up until recently been a Linksys advocate. It is actually a great product, and can perform NAT, DHCP (may toggle off and use an internal DHCP server), "DMZ" port forwarding, and flashable firmware. However, don't be fooled by the claim that it is a "switch". I spent many hours trying to find out directly from Linksys what some specifications were on the advertised "switch". First of all, it does not have a backplane. Anyone that knows what to look for in a switch, will first want to know how much data can be shared. When there is no backplane in any specs, and the "engineers" at Linksys don't seem to know what you are talking about, one tends to rethink their purchase. There is no mac table, nor is there anyway I have seen to find any specifics about how it "switches". Does anybody know what these devices really are? They have to be some sort of "smart" hub. What i have ended up doing, is purchasing NAT/router devices, and separate switches that perform like switches. I have found some D-link and Addtron switches with backplanes and viewable mac tables.

Also, the only way to configure any options on a Linksys device, is through a web browser. I have been able to use lynx before, but this one particular 8-port switch/router had broken tags in the config. I flashed the firmware, and tried just about every browser, but each time I would get java erros and broken tags. When I called tech support, they told me to take it back to my retailer. What they don't know, is that I had just replaced it, because the firmware flash died halfway through, and fried the device. This is not very reliable IMHO.

Netgear, however, allows you to telnet in and configure via command-line, which IMHO, is the most important feature of a configurable network device. JetAdmin or telnet for managing HP printers? Are you kidding me? I'll take command-line anyday. We need a low-end cisco device is what we need.

Are there any other command-line configurable NAT/routers that have actual backplanes for the switching component and has flashable firmware (other than a cisco switch) aimed at this market?

But get the current firmware and set the password

The Linksys home-sized routers aren't bad if you have current firmware, but firmware from the first half of 2000 crashes frequently.

Also, and I cannot overemphasize this, set the password. Not only are Linksys routers administered via a web interface, and attackable that way, they accept firmware downloads via TFTP, and will accept a firmware download from the WAN side. So an attacker can patch the thing remotely if it's not secured.

For $51, just get a router!

Sure, you can build one out of an old computer and spare parts. But, think about the physical size, noise of the fans, and electrical consumption. Plus, you could use that old computer for something else. I got a D-Link DI-804 for $51 from Amazon.com this week. $80.00 - $30.00 rebate - $10.00 online coupon + 11.00 S/H. It seems to have all the features you want. It has a simple web interface for basic stuff but it also has a telnet interface for more advanced features. Look at the D-Link site for the product (http://www.dlink.com/products/broadband/di804/).

Note: The picture on the D-Link and Amazon.com websites is of an older design where the four switch ports are on the front, and the WAN port is on the back. On the one I received yesterday, all ports are on the back (much less messy). I emailed them telling them that the picture didn't look anything like the actual product and so they apparently pulled the webpage for the product temporarily.

The setup was painless (basically, just plugged it in, attached network cables, renewed my IP leases, and changed the admin password). I even upgraded the firmware in less than a minute. It is also silent (no fan) and it is about the size of the area of a keyboard between the [ESC] and the right-alt key. It is working great.

It has four ports in the built-in switch. Port one can be used either as a normal switch port or as an uplink. It also has a serial port that you can attach an external modem to share as a backup for then your cable/dsl connect goes out.

For $51, it is basically the same price as the 486 solution that someone else cited as $45, and it even comes with a one-year warrenty (apparently, D-Link used to have a lifetime warrenty but I guess they don't do that for the consumer stuff any more).

CPU 32bits ARM RISC CPU
Memory 512 Kbytes Flash Memory
4 Mbytes SDRAM
Standards IEEE 802.3 10Base-T Ethernet
IEEE 802.3u 100Base-TX Fast Ethernet
IEEE 802.3x Flow Control
ANSI/IEEE 802.3 NWay Auto-Negotiation
Protocols Supported
TCP/IP
NAT
DHCP
UPD
PAP
CHAP
MSCHAP
RIP1/RIP2
PPPoE
Virtual Server

VPN Pass Through Function*
PPTP
L2TP
IPSec

Firewall Protection: Built in NAT firewall using stateful packet inspection

Management: Web-Based - requires a PC, Mac, or Linux based computer with a Web Browser capable of running Java script.

Firmware Upgrade: Web-Based - requires a PC, Mac, or Linux based computer with a Web Browser capable of running Java script.

Ports:
4 x NWay 10BASE-T/100BASE-TX Fast Ethernet LAN
Port 1 has Uplink/Normal switch
1 x 10Base-T WAN
1 x RS-232 (230 Kbps, male DB-9) - for back-up analog modem connection

LED's
Power
WAN
Console
Link/Act. (Link / Activity)
10/100 Mbps

Power DC 5V 2A
Operating Temperature 0 C ~ 40 C
Storing Temperature -20 C ~ 70 C
Humidity Max 95% Non-condensing
EMI Certification FCC part 15 Class B in US

Answer: none of the above

Don't buy these dedicated boxes. Use Linux or BSD on an old PC. Others have addressed the technical tradeoffs - I want to address something else. By buying the packaged router, you:

1. Allow perfectly good computers to go into landfills while you buy the same thing in a different form factor.
   
2. Use closed-source software for a security-oriented application, with all that this implies.
   
3. Cut off your ability to fine-tune, modify, and learn from your firewall.
   

I use Freesco. See other posts for why it's great.

Linux 2.4 iptables...

If I were to buy a router / firewall, it would be either linksys or netgear. My current hub is netgear. Both are usually UNIX compatible to a degree.

The biggest advantage to using Linux or even BSD or any other UNIX is that you can configure the firewall as an actual gateway/router/firewall, DMZ whatever you want to make you feel safe on the net.

iptables is pretty easy and if you already understand ipchains going to tables makes things easier. As you can specify an interface to forward from to. -i eth0 -o eth1 kinda thing...

Cisco 1600

Why screw around? If you are serious about this spend $50 extra and get a used router off e-bay. You can get a 1600 series with 2 ethernet ports of around $225 plus shipping. You get a real router, a little experience with cisco kit and with the GUI config even my dad could set this up.

Experiences

I am a CCNA and CCNP, I work with networking equipment for a living.

A friend recently bought a Netgear MR314. It seemed okay. I rather like using my unix box to do filtering, mail, and other stuff, so I would never use one of these boxes. The http interface was fairly nice and easy to follow. Easy is good for networking novices.

One problem that I encountered was the telnet support. This one had me calling their support department, not that they helped any. They command line will only accept 8 character hostnames. My friend had a 10 character @Home hostname for his authentication, and the only way to enter it was through the http interface. That sucked. Telnet is not intuitive, like Cisco IOS, but not horribly horrible.

The MR314 is overall a good router, but I like more powerful stuff. The wireless interface was good. The construction of the box was very nice -- we took it apart. I think that it was using a Motorola processor.

I have also dealt with the Cisco 600, 700, and 800 series routers in my time. They are pretty decent. I wish that the CBOS would allow for access lists greater than 18 (or is it 16?) lines. They take set, show, and debug style commands. Pretty intuitive. Upgrading the OS on them is easy. They can do NAT and PAT very well.

Efficient Networks, formerly Flowpoint, routers are decent. They are command line based, and while help and documentation is really poor, they take some pretty good commands, do good syslogging, and a few other really neat things in their operating system. unfortunately, the commands are cryptic and you have to be a real networking pro to know what they are talking about.

Netopia routers are really great. One of the fantastic features about them is that they do IPSec (DES only, no 3DES)! That is incredible for a router of it's type. They also do GRE tunnels. The next thing up if you want to do IPsec is a small Cisco router or PIX firewall, or a unix box. Netopia's do great system logging and SNMP. Their are configured through a telnet menu interface -- no telnet. They do excellent filtering, but entering filters is sort of a pain. Good construction of the boxes.

A word about Qwest DSL. They only use DMT these days for DSL -- NO CAP. That means that you can no longer use the Cisco 675 on their networks. Use the 678 instead. If you own a 675 and move, you are fscked. I bought a 675 about a year and a half ago, recently moved, and was screwed for $300. I managed to hassle a poor Qwest tech into sending me a 658 at a very steep discount, nearly free -- it took a lot of work and insider knowledge to pull off though. CAP, DMT, and G.lite are like line codes or modem modulation types. They are the analog modulation codes that the DSL interface uses to get it's data across the line. Wrong modulation = no workie.

BTW: Are there linux 2.4 kernel driver for the Intel 2200 DSL NIC? I have two of these things that Qwest sent me, and I would love to use them in my boxen. I do not know of drivers existing though. I need to google that.

Netgear

I have had very good luck so far with my Netgear fr314. It has excellent logging capabilities and periodically sends all logs and alerts by email. It was easy to set up and allowed me to set up a web server behind the firewall. My main reason for getting it was that I have several computers and don't want to dedicate a computer to just being a firewall.

The Netgear allows me to block all Active X, java, and many cookies (I have Active X blocked for most sites for my roommate's windows computer).

Performance wise it seems pretty good. I havn't noticed any degredation in performance, often downloading at over 400KBps (Kbytes/sec).

It has the option of content filtering, but that's not something I want (except for things like doubleclick.net).

It has many common services already configured and allows for more to be added quite easily.

I wish it allowed some more complicated rules, however. For example, I want to allow some ports to only be accessed from certain IP addresses. I can configure the ports allowed or denied and the IP addresses allowed or denied, but not combinations of both. To handle that I run a secondary firewall on the server which allows more options.

Also, the Netgear is limited to 8 clients without buying an upgrade.

In terms of logging, I am quite impressed. It logs all port scans, attempted accesses to known trojans like netbus, pings of death, and other malicious behavior. It also classifies port scans as either possible or probable.

It also draws only around 10 watts, and here in CA where my electric rate is hitting upwards of 0.20$/kwh,

Best deal - most features - lowest price

TigerDirect has the 3COM 3c510 NAT Router for $49, no rebates, that's the real price!

It includes:

1 port WAN (DSL/Cable Modem)
4 port 10/100 Switch
Parallel port with Print server
Serial port with FAX and dialout sharing support.

Why so cheap? It's a discontinued model.

BUT... the insides are exactly the same as models sold by SMC, D-LINK and others, and you can use the drivers and firmware upgrade from the original maker (AMIT) in Taiwan which you can find here:

http://www.amit.com.tw/download/firmware/

The printer server works with standard LPD support in Linux.