Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a project in mind and I'd love to hear some ideas on some open source solutions with COTS hardware.

I have a few 24 and/or 48 port managed layer2 switches with customers potentially on each port (though its usually about 20-30). Right now the switch has a bridged network and backhaul the traffic to our core to a centralized DHCP server. I need to move them to a NAT solution and, while doing this, I'd like to protect the customers on each port from the customer traffic on the other ports. I also need to be able to port forward from the public side of the firewall/nat box to specific hardware on the inside of the nat machine (easy enough, I know).

My first thoughts are to build an appliance-like box (the fewer moving parts the better) that can do filtering and NAT with rfc1918 an address range being handed out via a DHCP server on the appliance. A caching DNS server on the appliance would be a plus since we backhaul everything to the core. I'd like to run FreeBSD but I'm open.

Now, to try to limit the broadcast traffic thats visible I was thinking of doing each port on the switch as a different vlan and have the switch do trunking to the private NIC on the FreeBSD/appliance. I'd probably need to do some magic on the freebsd NIC to get this working but it should.

We have the parts to build these systems. So, does this make sense? Are there any other solutions out there that we don't have to spend money on but can use our parts to create something? Are there any good distros that could do this already (monowall)?? I may or may not admin this solution so a secure web configuration and management tool would be a plus in the other admins' minds.


share|improve this question

closed as not constructive by voretaq7 Jan 25 '12 at 6:55

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 4 down vote accepted

I think you should try pfSense. It's FreeBSD based and fork of m0n0wall

share|improve this answer
+1 for the easy solutions. FreeBSD doesn't require any "magic" to trunk vlans, just set the switch port to tagged for each of the vlans, then run ifconfig vlan create vlan ## vlandev nic0 (where ## is the vlan number, and nic0 is the NIC that's connected to the switch); then configure the vlan devices as you want, you can bridge them or set them all up individually, or there are other ways too. – Chris S Dec 28 '10 at 14:51
I just started to play with it now. Very cool. Thanks for the suggesting. – Adeodatus Dec 28 '10 at 21:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.