Replace NAT Box with Commercial Broadband Router? 118
hjf asks: "Three years ago, when I got DSL, I set up a 486 box, with 8 megs and a floppy drive to run FloppyFW. It has been through a couple hardware upgrades: 16Mb RAM for running the 2.4 kernel and a 100MBit PCI NIC for the internal network. It has a little UPS which lasts for over 60 minutes. The only downtime it has is when there's a thunderstorm and I unplug it. Besides that, it has been running flawlessly since I set it up.
Lately I have been kind of seduced with this product from 3Com, and other similar to it. I know it says it can handle 253 simultaneous users and all that. My home network has 4 users, but most of us run eMule and other P2P, and as many of you know, those P2P programs can beat the crap out of your router."
"For example, the default NAT table of my box wasn't enough (syslog reported TABLE FULL - DROPPING PACKET), so I made it 32768 entries and that message doesn't appear anymore. Now, what I'd like to know is, how big is that router's (or any other which does that kind of job) NAT table? Will it handle that many concurrent connections? I know I'll lose most of Linux's flexibility but I think I can live with that, but I'd surely win lots of room in the closet. So Slashdot, what's your opinion about all this?"
These things are designed for home use (Score:5, Informative)
Absolutly not. (Score:3, Informative)
What I use (Score:5, Informative)
There's been upwards of 20 PCs on the network and there's been a few times when 1 of us will been on the phone (VoIP), 2 of us are downloading a lot of files via p2p and another downloading ISO after ISO off of MSDN - all at the same time.
The little smoothwall box handled it all wonderfully, plus there's a fairly large community out there writing custom modules and addins for it.
The best part? Well, besides the transparent web proxy, I really like how you can have an internal-only network and a seperate DMZ network to hang your web services off of.
It's not as small or sexy as that 3com, but for me it's a perfect fit - handles a lot, plenty of ways to monitor it, and the price is right. Give it a shot, see what you think.
Linsys WRT54G (Score:5, Informative)
It'll save you plenty on your home power bill too. Seriously, a 486 or simmilar running 24x7 can cost you 5-10 bucks a month, or even more in some areas. Home routers use significantly less power.
I used to play that game (Score:4, Informative)
Now I save my time and money from electricity and noise and use a little netgear router with 50mbit wireless. I do all the things that you described and never have had an outage, and it's silent.
Why use a 130wat power supply when you can use a 12, and 0 noise. Only router I have owned that routinely craps out is a linksys, I wouldn't touch it with a 10' pole. My 2 netgear routers have worked flawlessly.
If you haven't already... (Score:4, Informative)
Tried the 3Com, wouldn't recommend - go Soekris (Score:1, Informative)
Their web interface supported only IE, because of a brain-damaged applet authentication mechanism. Even Firefox on Windows with working Java wouldn't do it. The DMZ was switched to the WAN, not routed, so it did weird proxy ARP tricks.
It's since been relocated to a remote site, where it's doing IPSEC VPN for a few servers, and performing well in that role. I replaced it with a Soekris net4501 running FreeBSD with natd, KAME IPSEC and poptop, and it's been solid as a rock (although I might go with OpenBSD if I did it again, for the more-flexible firewall.) If you want to be rid of your NAT box, I highly recommend the Soekris boxes.
Re:Absolutly not. (Score:5, Informative)
Consumer grade broadband routers are notorious for causing problems, and are almost always badly underpowered. Using a PC based router to handle nat generally works much better, provided you have the know-how to set it up.
A few months ago I replaced an aging P133, an ancient 3com 12 port 10 megabit switch (with 2 100 megabit uplink ports, woo hoo!), and an 802.11b access point with a Linksys WRT54G.
I replaced the firmware with this [portless.net]. I've been very happy with it so far. I think the 200 mhz mips processor is probably a decent replacement for the P133. It takes up much less space, makes much less noise, and it's in much better condition that the old hardware it replaced. I can still ssh into it, and according to /proc/version it is running a 2.4.20 kernel.
I think it was approximately 70 dollars well spent.
Re:What I use (Score:5, Informative)
Of course, if you just want a standalone device, like others have said youe best bet is to get a LinkSys WRT54G/WAP54G plus alternative firmware, such as the Sveasoft one. See more info here:
http://www.seattlewireless.net/index.cgi/LinksysW
I have one (Score:3, Informative)
- 2 Mbit connection to internet
- 1 computer connected via 100Mb eth
- 1 computer connected via WiFi
- 1 pocket pc via WiFi
- 1 Kiss DVD connected via 100Mb eth
I never had any problems, even using eMule (PC), shoutcast (DVD), Skype (PPC) and browsing (notebook) at the same time.
The little critter even supports a VPN so i can remotely control it from work.
Very recomended!
In MN area? (Score:2, Informative)
Various brands
Power supplies for most
No hard drives
Re:FloppyFW or FreeSCO (free cisco) (Score:4, Informative)
How about a lower-power box? (Score:3, Informative)
Chances are if they run OpenBSD they will run Linux as well (although why you'd prefer the linux firewall features over the OpenBSD pf firewall escapes me).
If your main goal is lower electrical cost, that might be a good option anyway. If you are willing and technically competent enough to maintain your own box, you should. Othwerise you give up a _lot_ of flexibility (ability to run snort, dsniff, caching proxy, dns, honeypot, etc.).
I did this recently (Score:4, Informative)
In the end I spent $200 on a nice Xincom Twin Wan Router XC-DPG502. With all it's options and configuration, I got both ISPs working very quickly and got my server set up behind it with no problem.
Anything advanced for networking under Linux becomes very hard to implement, and even harder due to the fact that there are very few good documentation sites for such things. Most of your research will be from scraps of info off listserves from people attempting this before you.
linksys wrt-54g (Score:5, Informative)
if you do go down this route be sure to avoid sveasoft's firmware, for reasons illustrated here [slashdot.org]. basically, the guy writing it is a total cockbite. last time i questioned his (ab)use of the GPL here on slashdot he banned me from his forums, so if you do intend to send him $20 you'd better be nice.
Re:linksys wrt-54g (Score:3, Informative)
Re:Absolutly not. (Score:2, Informative)
the cheap hw routers are notorious for choking up on even "moderate" use, even when they have 100mbit ports(so they'll choke at natting something like 10-20mbit/s).
The only issue that I had with mine at all so far was that the default value of 1024 for ip_conntrack_max was too low. That caused problems with bittorrent and whatnot.
I don't have a 100 megabit link to the internet, and I don't think my p133 could nat much better than this box if that were the case. One of these days I need to install top on my WRT54G and see how much load it is under. My guess is not very much.
and yes usually even ~150mhz pc with decent network cards can kick the crap out of them when needing high speeds.
What does a 150 mhz pc have over this box exactly? They've both got a 33mhz pci bus and they both have capable processors.
(this may have changed, but i doubt it. and with most home connection speeds it of course doesn't matter because not everyone has 100mbit connection to home. it does for me though.)Well, most of us only have a 3 megabit connection. Therefore for 99.999% of us a WRT54G is more than enough. I would bet that if all you need is NAT at 100 megabit, it is still probably good enough. If I had more gumption I would do some testing... But if I ever need to put hardware on the end of a 100 megabit WAN link it will be a piece of enterprise class hardware. And it certainly wouldn't be the fastest WAN link I've ever had :p.
Bullshit (Score:4, Informative)
You, sir, are lying. My D-Link DI-604 router works perfectly with Linux. In fact, I don't think I've ever even touched the configuration interface under Windows.
It works beautifully, and I'd recommend one to anyone who needs a NAT. It's a tiny (5.5" wide, 4" long, 1" tall) silver box that sits in the corner of my desk, surrounded by whatever junk I have. I don't have a second machine to use as a router, and if I were to buy one, I'd be spending far more money--I bought this thing for $20. Not to mention the fact that another machine would take up far more space.
And you know what? It just works. I plug it in between my machine and my cable modem, and assuming my machine is set up to use DHCP, it's working. If I want to open some ports to my machine so I can have my servers publically accessible, it takes me about 10 seconds to do so. It's also never dropped me. Ever.
Of course, it depends on what kind of router you own. For example, I would never touch a Linksys product with a 10-foot pole. I have a friend with one...that piece of crap frequently stops working, and won't come back up for a couple of hours, even after it's unplugged and re-plugged into the wall multiple times (it's not the connection--plugging the machine into the cable modem works fine..it's just the piece of crap router that's a piece of crap). Of course, she's refused to listen to me when I constantly told her to get a D-Link router, so I've refused to ever help her on anything network-related until she does.
And I'd also say that if you do have a dedicated NAT machine, and it works, then there's no need to replace it. If it's not broken...
try an old notebook (Score:4, Informative)
This is the biggest secret out there, you can pick up old notebooks of decent speed (sub 200mhz, 586, 64-96mb ram, etc) and use it as a gateway, the benefit is:
- low power, low noise, low cost, small form factor;
- cheap, get them for sub $50 or free - nobody wants them;
- built in UPS (i.e. the notebook battery);
- simply install good firewall OS (OpenBSD);
- plug pcmcia wireless in the side (take your pick: 802.11b, b+, g
- use spare pcmcia slot for modem card to provide backup connectivity, or use it for fax server and even for voice mail / phone system (i.e. asterisk)
- use the USB slot for cheap-o USB DSL modem (e.g. accessrunner, etc)
The real benefit is that you can just upgrade parts of it as necessary (e.g. all the suckers on 802.11b DSL gateways are hosed while you just buy a new 802.11g card, install it, and throw the old one away), and of course, you get the confidence in a bullet proof system (e.g. OpenBSD).
Seriously, you'll get years of mileage out of it -- much more than a "closed" DSL gateway, you'll get better performance and functionality, all at a cheaper price.
Re:Bullshit (Score:4, Informative)
Check the environmental specs on that Linksys and your DLink, and I bet you'll find that there is a difference. I had a Linksys that consistently lost packets, and then a Netgear that consistently lost packets. I then noticed that if I blew into the vents on them while they were losing packets, they would stop losing packets for a bit. If I arranged a fan to blow over them, they were fine. Reading their specs, they are rated to 40C. I pointed an IR thermometer inside one of the vents...and it said 45C. Aha!
I then bought a DLink that is rated to 55C, and the packet loss went away. I gave the Linksys to a friend whose computers are placed where the airflow is better, and it worked great for him.
BTW, the DLink not only was rated 15C higher than the other two, it runs cooler.