3

I am looking for recommendations to replace a set of consumer grade (Linksys, Netgear, Belkin) routers with something that can handle more traffic while routing more than one static public IP into the same LAN address space.

We have a block of static public IPs, 5 usable, with Comcast Business. Currently four of them are in use for:

  1. General office access
  2. Web server
  3. Mail and DNS servers
  4. Download and backup web server for separate business

All systems (a mixture of physical and virtual) are in the same LAN address space (10.x.y.0/24) to enable easy access between them inside the office. There are 30 or more systems in use depending on which virtual machines are currently active. We have a mixture of Windows, Linux, FreeBSD, and Solaris.

Currently a separate consumer grade router is used for each of the four static addresses, with its WAN address set to the specific static address and a different gateway address for each:

  1. uses 10.x.y.1 - various ports are forwarded to various LAN IPs on systems with gateway 10.x.y.1
  2. uses 10.x.y.254 - port 80 is forwarded to a server with gateway 10.x.y.254
  3. uses 10.x.y.253 - ports for mail and dns are forwarded to a server with gateway 10.x.y.253
  4. uses 10.x.y.252 - ports as needed are forwarded to server with gateway 10.x.y.252

Only router 1. is allowed to serve DHCP and address reservation based on the MAC is used for most of the internal "server" IP addresses so they are at fixed values. [Some are set static due to limitations in the address reservation capabilities of router 1.]

And, yes, this really does work! But... I am looking for:

  • better DHCP with more capable address reservation
  • higher capacity so I don't have to periodically power cycle the routers

One obvious improvement would be to have a real DHCP server and not use a consumer grade router for that purpose.

I am torn between buying a "professional" router such as Cisco or Juniper or Sonic Wall verus learning to configure some spare hardware to perform this function.

The price goes up extremely rapidly with capabilities for commercial routers! Worse, some routers require licensing based on the number of clients - a disaster in our environment with so many virtual machines.

Sorry for such a long posting but I am getting tired of having to power cycle routers and deal with shifting IP addresses afterwards!

Improve this question

5 Answers 5

Reset to default
3

you can get a DrayTek 2950 router, supports multiple public IP addresses amongst other features. supports vpn tunnels (200) without purchasing extra licenses.

http://www.draytek.co.uk/products/vigor2950.html

You can search for a draytek dealer in your area.

Draytek will do all port forwarding, you can connect multiple WAN connections, can run them in either failover or load-balance mode, you can assign WAN IP Aliases (Public IP Addresses). You can even assign Public static IP to your servers and input the correct subnet and subnet mask in your router so it routes your public IP subnet too.

Hope that helps

Improve this answer
7
  • This looks quite interesting.
    – lcbrevard
    Jan 6, 2011 at 16:02
  • I found a version with 802.11g in the US at guideband.com/index.php/v2950g.html for just over $300. They also have a non-wifi version listed for under $300 at guideband.com/index.php/v2950.html but it shows out of stock.
    – lcbrevard
    Jan 6, 2011 at 16:17
  • Can you tell me if this supports multiple public IP addresses on a single WAN connection? Or is it only via the two WAN ports? I have a block of 5 with Comcast Business but have another separate block of 8 via DSL.
    – lcbrevard
    Jan 6, 2011 at 16:24
  • I would recommend to research according to your needs, drayteks are very good and I have used them for a long time now. there support is very good too, so you can re-confirm your requirements via there support. You can use draytek to bind multiple WAN Public IP Aliases, you can have it as a VPN Server and let your remote workers connect without paying extra. I like 2950, it has DUAL WAN, or if you need something like 4 WAN connections you can draytek.co.uk/products/vigor3300v.html
    – Mutahir
    Jan 6, 2011 at 16:33
  • depends on how you are using these Public IP Addresses, are you assigning the public IP Addresses to your Servers / Machines behind this router ? If YES - Then you can assign that Block of Public IP Address as a 2nd LAN Subnet and it will do the routing for you. It supports it on a single wan connection too. I would recommend to get in touch with the draytek pre-sales team - they will be able to tell you straight away. I am sure it will work !
    – Mutahir
    Jan 6, 2011 at 16:36
3

I'd recommend pfSense or Vyatta on hardware of your choice. Depending on how large your state table is and/or how much traffic you're pushing through, you could get away with an ALIX device for ~$200 or upgrade to a 1U entry-level server from Dell, HP, or a white box etc. with a dual NIC. I'm using a Hamakua from Netgate.com ($600USD) right now for a larger client that pushing alot of data with a lot of workstations (large state table) and servers and the thing barely budges, CPU/memory wise. Build quality is excellent; passively-cooled, low power consumption.

Improve this answer
2
  • Several people on the Sun Rescue list have recommended a pfSense including on an ALIX. If I put together my own hardware, I want it low power and all solid state - I'm spinning too many disks already!
    – lcbrevard
    Jan 8, 2011 at 18:21
  • And an important quality of pfSense is that it is designed/developed with the ALIX platform in mind, so measures have been taken to limit the amount of writes the OS/pfSense does to preserve the life of the CompactFlash card. You can mount a 3.5 hdd in it, but the CF is fine IMO.
    – gravyface
    Jan 9, 2011 at 16:26
2

Check out the Cisco ASA's, 5505's are reasonable. We use both 5505's and a 5510. the 5510 is excellent for utilizing multiple public IP's, firewalling, routing, DMZ, Vlan's, etc.

Improve this answer
2
1

Any of the better routers that will run DD-WRT, OpenWRT or similar firmware should be able handle this. I have seen reports that some of the newer routers are distributed with DD-WRT.

Any small computer that can run Linux with two or three good ethernet interfaces (buy and add good cards if needed).

I would run Shorerwall as the firewall on either. The OpenWRT solution would require Shorewall-lite with a separate system to compile the firewall rules.

You should be considering setting up a DMZ for the Internet accessible servers.

Improve this answer
1
  • See other comments regarding dedicating a small computer. I have looked at DD-WRT and several of the routers here (specifically a couple of Linksys WRT54G of various generations) can run DD-WRT. I think I can get the functionality but I'm not sure about the throughput or the stability.
    – lcbrevard
    Jan 8, 2011 at 18:25
1

$employer used to have a similar sort of setup (except without the multiple routers - that sounds crazy to me!). We replaced them with a Cisco 1801 and haven't looked back. It took a little while to define the firewall rules, and learn the way the Cisco applies them (zone pairs and policy maps are great, but I've not come across them before), but I think the benefits of having a simple setup will pay dividends in the long run.

Improve this answer
1
  • Multiple consumer-grade routers, one per public IP is a bit crazy but it does work and let me migrate from a fairly complex home office setup to one where: (1) all the servers are in the LAN - cowering behind NAT :-) and (2) I provide an increasing number of public services for several companies. BUT... it's time to get something more serious - for reasons in the original post.
    – lcbrevard
    Jan 8, 2011 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .