Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a router that would fit the following requirements:

  • Two WAN interfaces: the primary is PPPoE, the secondary will link to a GigE port on another router (a 100Mbps link will suffice);
  • Two (ideally four) GigE LAN ports;
  • No requirement for a firewall;
  • No requirement for Wi-Fi;
  • Inexpensive.

The plan for the two WAN interfaces is as follows. All outbound traffic will go to the primary, with exceptions based on destination IP/subnet or possibly on src+dest IPs/subnets. Such exceptions should be routed to the secondary. It would be very nice if, should the primary go down, the secondary would automatically take over for all outbound traffic.

I am reasonably sure that I can put something together based on dd-wrt. However, I'd like to hear from you what alternatives are out there (especially something easier to set up for my use case, even if it means paying more for the hardware.)

share

locked by womble Nov 29 '15 at 0:14

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by womble Nov 29 '15 at 0:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 4 down vote accepted

Mikrotik 450G. 5 gigabit ports. 12 watt max power. about 100 USD.

Can a lot more (Firewall etc.) running a very specialized version of linux which you dont ahve acess too (i.e. there is a shell, but it is custom made and hides the file system from you).

VERY flexible. Whole range of routers. VERY powerfull (the 450G can run BGP4).

If that is too expensive, the 750G is cheaper, less memory, about 60 USD. Same features.

share
    
(+1) I haven't come across Mikrotik devices, but they look very interesting indeed. Thanks for the pointer. – NPE Feb 1 '11 at 17:10
    
The really funny thing is that they scale. You can run them on x86 hardware (routeros) and even the one you buy from them can handle 1gbit links as small data room internet backbone for a LOW price. Unless yuo scale quite high they are pretty much "handling your whole public needs". – TomTom Feb 1 '11 at 17:18

Have a look at Draytek (http://www.draytek.com), they do SoHo routers that fit your description, they also have both console and web configuration and are extremely resiliant.

If they don't offer what you want I would go straight to Cisco, but that'll increase the price of course

share

Have you considered any of the linux firewall projects?

My personal preference is PFsense, but you could also look at m0n0wall, ipcop, ipfire.

share

A Juniper SRX210 can have an ADSL PIM card in it and also accept ethernet connections... they're not cheap though :)

share

Juniper NetScreen firewalls running ScreenOS since about 5.4 or higher can do source policy-based-routing which sounds like what you want. The SSG5s are the entry units and go for less than $1000.

share

I've had a lot of success with OpenWRT on TL-WR1043ND boxes lately. They're cheap (< $50), low power(<10 Watts), gigabit ethernet etc. and then you can do whatever you like with it once it's installed, including splitting the switch into VLANs to suit your needs.

share
    
Thanks. As I mentioned in the question, dd-wrt -- which is closely related to OpenWRT -- is my default solution. – NPE Feb 1 '11 at 17:14
    
Poke around with the 'switch_vlan' option in /etc/config/network then and pull one of the LAN ports into a 3rd VLAN on any cheap compatible hardware. – Flexo Feb 1 '11 at 17:32

With inexpensive being a requirement, I would check out pfSense. It's a free open source router that is very robust and scalable with the company. I use it exclusively when cost is an issue, it's just so versatile and stable (last reboot was a 6mo. ago for maintenance).

One of the features is WAN load balancing with failover, you can pull bandwidth from both your PPoE, and your 2nd WAN line, and if one drops it still runs on the other. My book mentions policy routing which is like a firewall rule, but with a gateway field, it looks like you can get even finer control than just IP/Subnet. It does not mention limiting it to just one WAN but I would imagine it's very possible. If you do end up trying it, I would ask this on the pfSense forum (great resource if you run pfSense).

Is your 2nd WAN also PPoE? pfSense 1.2 does not support multiple PPoE connections, but version 2.0 does.

Also The built in firewall can be disabled if you already have a firewall solution.

I would try it out on a spare machine or the VMware appliance to see how it works for your setup.

share
    
The second WAN is a DOCSIS line with its own modem+router. To the router in question it's simply an IP/Ethernet uplink. – NPE Feb 1 '11 at 17:17
    
Mikrotik. The 450G is cheaper, the 750G a LOT cheaper - with softrware - than theh ardware you otherwise buy ;) – TomTom Feb 1 '11 at 17:17

If you don't wanna cough up some serious dough, nothing beats linux firewall distro's.

Some of the most popular distro's worth mentioning are:

IPFire

IPCop

PFSense

With IPFire being my favourite

You have all the flexibility to do whatever your heart desires with it, you don't have to sit with features forced on you by the manufacturer bringing your systems overall performance down(no matter how small that difference is) and you're not paying for a closed source OS or paying more for their hardware even though it's inferior.

I am reminded of Apple again...

You can build your own system(hardware) and then get to building your software system. Once you're done with all the small little changes and bring it into production you can clone the system.

You can install it on a Raspberry Pi if your needs are small or you can go buy a 10 000USD server and install it on that. Same security either way, for the most part.

I have had Pen Testers test some of my setups to check for security holes, and so far no one has gotten any access to anything past my firewalls.

What everyone has to understand is that ALL of the firewalls worth mentioning : RouterOS, iOS(Cisco, not those damn people from Apple, although they are applicable here too), Juniper, Fortinet etc are ALL derived from Posix kernels(that's to say all of them are derived from linux flavours).

The ONLY difference is that, that company spent some time and man hours setting their's up the way they want it and of course the fact that they closed their source code.

Now that's all good and well if you're running an enterprise business and don't have time to tweak everything up to the point where your security is @ the same standard as say Fortinet or RouterOS, however if you can sacrifice some time to spend some dough then go for a Linux Firewall distro.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.