Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a very simple small business network that I set up about 10 years ago using a pair of Linksys routers. Over the past couple of years, the routers have become increasingly unstable as the amount of network traffic has increased. There has not been a firmware update for these devices for over half a decade, so it's time for them to go.

Here is the network architecture

                                WAN IP          192.168.1.4  192.168.4.1 
 Internet <------> DSL Modem <---------> Linksys A <--------------> Public Wireless AP (WDS)
                                           ^ ^
                                           | | 192.168.1.2  192.168.2.1
                                           | +------------------> Second Public Wireless AP
                                           |
                                           | 192.168.1.3   192.168.3.1
                                           +---------------------> Linksys B (Intranet) <---> Switch 

All of the intranet devices get IP address via DHCP in the 192.168.3.1/24 subnet. All of the public access occurs on the 192.168.2.1/24 and 192.168.4.1/24 subnets. The Linksys A router is configured to block traffic between the public and provate subnets. It is also set to forward SSH connections from the WAN to the 192.168.3.x subnet.

I would like to replace the Linksys A and Linksys B devices with a single device that allows the same configurations.

I am currently considering either the Netgear FVS318G or the D-Link DSR-250. I appears that both can be picked up for $100 - $150, which is right in my ideal budget.

Will either of these devices handle this kind of network configuration? Is there a reason to prefer one over the other?

Also, I have a lot of the wireless access points running as dd-wrt devices in a WDS configuration, so I'm not opposed to buying a different device and flashing with an alternative firmware.

Edit

Found some information that the FVS318G does not support VLAN or Jumbo Frames. In addition, the default firmware only allows two internal subnets (DMZ on port 8, LAN on parts 1 - 7). I think that will eliminate it from consideration.

Followup

I ended up purchasing a Routerboard 750. Very happy with the results so far.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Your configuration is not that complex. You really don't need "prosumer" NAT router/firewall boxes if you don't want them.

What you DO need is proper isolation of your "public" and "intranet" networks -- you don't really have that here (Public devices can't hit your intranet's internal IPs, but they can see all of its traffic, and your intranet can hit public network's IPs -- that leaves you open to man-in-the-middle attacks).


My recommendation for you would be real firewall solution.
Commercial products exist from Juniper and Cisco, but you could do it with a spare commodity computer and pfSense too if you're willing to support the solution yourself.

You would need three NICs (or two NICs and VLAN-capable hardware on the inside), and your end network should look something like this:

[Internet]----[MODEM]----[Firewall]-------(Public network switch & Devices)
                             |
                              ------------(Intranet switch & Devices)

With the firewall configured to prevent traffic from the Public and Intranet networks from mixing (implemented as separate security zones).

share|improve this answer
    
Thanks for the advice. I was leaning toward a prosumer device because I needed enough gigabit ports for all the intranet devices and because I thought that a simpler device might not be able be to be configured to segregate and route traffic per port. A Cisco or Juniper device is overkill. –  Lucas Jun 14 '13 at 12:57
    
Also, wrt network isolation, the public and intranet are isolated. These are not wireless Linksys boxes in the diagrams -- the access points are separate devices on their respective subnets, so there is no opportunity for any devices on the .2 or .4 subnets to see .3 subnet traffic. I verified that with wireshark (ethereal back then) when I initially set up the network. –  Lucas Jun 14 '13 at 13:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.