Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 6 windows workstations, spread out over a fairly large area. Need to share a DSL connection (upgrading to 100/100 mbit fiber in a few months) with these machines over a 1gbit network. Also need Wifi to be available for laptop use. Plan to add 2 rackmount servers for internal use as well.

Can someone suggest a decent (preferably low cost) setup that will let me achieve the stuff mentioned above.

share|improve this question
up vote 2 down vote accepted

Don't let the router/firewall throttle your 100/100 fiber. Options:

  • Low-end: pfsense and old PC(s), 2 Netgear GS-108 @ $45 ea after rebate (unlikely both die at once), Linksys WRT-54GL @ $50 (add free DD-WRT firmware if you like, and a better antenna if coverage requires)

  • Higher: Cisco ASA-5505-50-Bun-K9 @ $500, Cisco Linksys E4200 WiFi @ $180, Netgear GS-116E smart switch (Windows-app-managed) @ $195 OR Cisco's new SLM2016T-NA (web-managed) @ $275

  • My Preference: Cisco RV220W-A-K9-NA Gig/Firewall/VPN/WiFi @ $270, Netgear GS-116E @ $195

share|improve this answer
A pfSense box with an 800MHz-1GHz CPU with 512MB RAM and Intel or 3com NICs should manage a 100Mbps connection at wire speed just fine. Gigbit is a different story, but if you've got a gigabit WAN link you likely won't be beige-boxing it for a firewall. +1 for the other recommendations, RV220W is a great small-office unit with a lot of features built in. – nedm Feb 12 '11 at 5:05
What about something like PROSAFE WIRELESS-N VPN FIREWALL SRXN3205 instead of the Cisco? Any good? – user11350 Feb 12 '11 at 8:41
Newegg's commenters say the SRXN3205 VPN client won't do Win 7, if that matters. The RV220W is VERY new, with IPv6, a fast Cavium CN5010 CPU, 1 yr phone support, SNMP mgt, 2.4 OR 5 GHz (not concurrent). I like the beta notes at… – Paul Feb 12 '11 at 15:03
Yah, we use win 7, so that counts that one out. On the Cisco, 2.4 or 5.0 is a bit of an issue also. Beh. – user11350 Feb 12 '11 at 19:24
Well, if it's enough of an issue to be worth $50, use the Cisco for 5.0 and pick up a WRT-54GL for 2.4. Remarkably solid, especially with the classic version of DD-WRT. – Paul Feb 13 '11 at 2:17

Does "spread out over a fairly large area" still mean the same physical office or building? If so, I'd suggest you put a second NIC in an old, unused desktop or server box and install pfSense as a WAN/gateway to share the DSL line. It's extremenly easy to install and configure and has a very intuitive web management interface. Depending on your business/security requirements you can either plug this directly into you LAN switch or create a DMZ with any outward-facing resources (web hosting, email, VPN, etc.) that you need to host yourselves. A second pfSense "beige box" would then separate your LAN from the DMZ.

If you plan to add a wireless access point to your LAN , ensure it supports up-to-date connection encryption (WPA2) and secure this and the admin access to the WAP device BEFORE you deploy.

share|improve this answer
No, they're on the same floor, just scattered over 3 different rooms. Running cables is not an issue. – user11350 Feb 12 '11 at 1:54
Good, then the above should apply :) – nedm Feb 12 '11 at 1:58
Make sure the cables are terminated carefully, use Cat5e or better for all components. Wiring problems are worth avoiding. – Paul Feb 12 '11 at 2:19

I would be hesitant to advise a homebrew box if you don't have in-house expertise with the free OSes and related hardware. You can definitely do wonders with even a cheap PC running either an appliance-style Linux/BSD install or a homespun environment.

I would consider a Juniper SSG5 or SSG20 with wireless, along with a 16-24 port gigabit switch. I think the routers would run you around $500... you can add a license for antivirus/antispam/IDS type features if you want.

Another option would be Cradlepoint's MBR1200, which will let you do multiple connections (use the DSL as a failover for the 100mbit connection) and back that up with USB cellular modem (Verizon, Clear, AT&T, whatever). You also get 802.11b/g/n. It's probably about $300. (I've used an MBR800 and MBR1000 myself)

share|improve this answer
Can't speak to Juniper, but having worked with both pfSense and Cisco, for example, I certainly don't think pfSense is any more difficult to install or configure than getting an ASA or Pix up and running. Your point is taken for a real homebrew setup using iptables or pf directly, but web-managed appliances like smoothwall or pfSense are really pretty simple to set up. – nedm Feb 12 '11 at 6:04
Setting up is fine, but the concern I'd have is when something goes wrong. They can probably get commercial support if the internal staff don't have networking expertise. As long as nothing goes wrong, either way should work fine. – Robert Novak Feb 15 '11 at 8:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.