Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for recommendations to replace a set of consumer grade (Linksys, Netgear, Belkin) routers with something that can handle more traffic while routing more than one static public IP into the same LAN address space.

We have a block of static public IPs, 5 usable, with Comcast Business. Currently four of them are in use for:

  1. General office access
  2. Web server
  3. Mail and DNS servers
  4. Download and backup web server for separate business

All systems (a mixture of physical and virtual) are in the same LAN address space (10.x.y.0/24) to enable easy access between them inside the office. There are 30 or more systems in use depending on which virtual machines are currently active. We have a mixture of Windows, Linux, FreeBSD, and Solaris.

Currently a separate consumer grade router is used for each of the four static addresses, with its WAN address set to the specific static address and a different gateway address for each:

  1. uses 10.x.y.1 - various ports are forwarded to various LAN IPs on systems with gateway 10.x.y.1
  2. uses 10.x.y.254 - port 80 is forwarded to a server with gateway 10.x.y.254
  3. uses 10.x.y.253 - ports for mail and dns are forwarded to a server with gateway 10.x.y.253
  4. uses 10.x.y.252 - ports as needed are forwarded to server with gateway 10.x.y.252

Only router 1. is allowed to serve DHCP and address reservation based on the MAC is used for most of the internal "server" IP addresses so they are at fixed values. [Some are set static due to limitations in the address reservation capabilities of router 1.]

And, yes, this really does work! But... I am looking for:

  • better DHCP with more capable address reservation
  • higher capacity so I don't have to periodically power cycle the routers

One obvious improvement would be to have a real DHCP server and not use a consumer grade router for that purpose.

I am torn between buying a "professional" router such as Cisco or Juniper or Sonic Wall verus learning to configure some spare hardware to perform this function.

The price goes up extremely rapidly with capabilities for commercial routers! Worse, some routers require licensing based on the number of clients - a disaster in our environment with so many virtual machines.

Sorry for such a long posting but I am getting tired of having to power cycle routers and deal with shifting IP addresses afterwards!

share|improve this question

5 Answers 5

up vote 3 down vote accepted

you can get a DrayTek 2950 router, supports multiple public IP addresses amongst other features. supports vpn tunnels (200) without purchasing extra licenses.

http://www.draytek.co.uk/products/vigor2950.html

You can search for a draytek dealer in your area.

Draytek will do all port forwarding, you can connect multiple WAN connections, can run them in either failover or load-balance mode, you can assign WAN IP Aliases (Public IP Addresses). You can even assign Public static IP to your servers and input the correct subnet and subnet mask in your router so it routes your public IP subnet too.

Hope that helps

share|improve this answer
    
This looks quite interesting. –  lcbrevard Jan 6 '11 at 16:02
    
I found a version with 802.11g in the US at guideband.com/index.php/v2950g.html for just over $300. They also have a non-wifi version listed for under $300 at guideband.com/index.php/v2950.html but it shows out of stock. –  lcbrevard Jan 6 '11 at 16:17
    
Can you tell me if this supports multiple public IP addresses on a single WAN connection? Or is it only via the two WAN ports? I have a block of 5 with Comcast Business but have another separate block of 8 via DSL. –  lcbrevard Jan 6 '11 at 16:24
    
I would recommend to research according to your needs, drayteks are very good and I have used them for a long time now. there support is very good too, so you can re-confirm your requirements via there support. You can use draytek to bind multiple WAN Public IP Aliases, you can have it as a VPN Server and let your remote workers connect without paying extra. I like 2950, it has DUAL WAN, or if you need something like 4 WAN connections you can draytek.co.uk/products/vigor3300v.html –  rihatum Jan 6 '11 at 16:33
    
depends on how you are using these Public IP Addresses, are you assigning the public IP Addresses to your Servers / Machines behind this router ? If YES - Then you can assign that Block of Public IP Address as a 2nd LAN Subnet and it will do the routing for you. It supports it on a single wan connection too. I would recommend to get in touch with the draytek pre-sales team - they will be able to tell you straight away. I am sure it will work ! –  rihatum Jan 6 '11 at 16:36

I'd recommend pfSense or Vyatta on hardware of your choice. Depending on how large your state table is and/or how much traffic you're pushing through, you could get away with an ALIX device for ~$200 or upgrade to a 1U entry-level server from Dell, HP, or a white box etc. with a dual NIC. I'm using a Hamakua from Netgate.com ($600USD) right now for a larger client that pushing alot of data with a lot of workstations (large state table) and servers and the thing barely budges, CPU/memory wise. Build quality is excellent; passively-cooled, low power consumption.

share|improve this answer
    
Several people on the Sun Rescue list have recommended a pfSense including on an ALIX. If I put together my own hardware, I want it low power and all solid state - I'm spinning too many disks already! –  lcbrevard Jan 8 '11 at 18:21
    
And an important quality of pfSense is that it is designed/developed with the ALIX platform in mind, so measures have been taken to limit the amount of writes the OS/pfSense does to preserve the life of the CompactFlash card. You can mount a 3.5 hdd in it, but the CF is fine IMO. –  gravyface Jan 9 '11 at 16:26

Check out the Cisco ASA's, 5505's are reasonable. We use both 5505's and a 5510. the 5510 is excellent for utilizing multiple public IP's, firewalling, routing, DMZ, Vlan's, etc.

share|improve this answer
    
"Only" $2716 at Amazon! ;-) amazon.com/Cisco-5510-Security-Appliance-ASA5510-SEC-BUN-K9/dp/… - a bit more than I wanted to spend just yet. But thanks for the recommendation. –  lcbrevard Jan 6 '11 at 16:03
    
I think around $500 ish for the 5505's... –  jherlitz Jan 6 '11 at 19:39

Any of the better routers that will run DD-WRT, OpenWRT or similar firmware should be able handle this. I have seen reports that some of the newer routers are distributed with DD-WRT.

Any small computer that can run Linux with two or three good ethernet interfaces (buy and add good cards if needed).

I would run Shorerwall as the firewall on either. The OpenWRT solution would require Shorewall-lite with a separate system to compile the firewall rules.

You should be considering setting up a DMZ for the Internet accessible servers.

share|improve this answer
    
See other comments regarding dedicating a small computer. I have looked at DD-WRT and several of the routers here (specifically a couple of Linksys WRT54G of various generations) can run DD-WRT. I think I can get the functionality but I'm not sure about the throughput or the stability. –  lcbrevard Jan 8 '11 at 18:25

$employer used to have a similar sort of setup (except without the multiple routers - that sounds crazy to me!). We replaced them with a Cisco 1801 and haven't looked back. It took a little while to define the firewall rules, and learn the way the Cisco applies them (zone pairs and policy maps are great, but I've not come across them before), but I think the benefits of having a simple setup will pay dividends in the long run.

share|improve this answer
    
Multiple consumer-grade routers, one per public IP is a bit crazy but it does work and let me migrate from a fairly complex home office setup to one where: (1) all the servers are in the LAN - cowering behind NAT :-) and (2) I provide an increasing number of public services for several companies. BUT... it's time to get something more serious - for reasons in the original post. –  lcbrevard Jan 8 '11 at 18:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.