I'm in the process of figuring out what types of devices I'll want to use at a new colo install. We have some experience configuring Cisco routers but our knowledge is much deeper on the Linux sysadmin side. (Contracting a CCNA is an option but I'm concerned if they'll be available when we really need them.) Therefore instead of using a Cisco/Juniper router I'm tempted to use a Linux box running Shorewall. This would also allow us to leverage our existing configuration management and compliance infrastructure. Most of it will be setup will be fairly simple NAT. No BGP, OSFP, RIP or other real routing protocols.

Here's the imagined setup:

  • 100Mbit throughput max on the circuit. Our standard peak throughput more like 10Mbit.
  • 20-30 hosts behind this
  • Mostly HTTPS traffic. Some HTTP, SMTP and SSH
  • /24 IP block

My main concern is ease of implementation and maintenance. Cost isn't the primary concern, but I would prefer not to go over $2500 for a new device (I've had bad luck with refurb gear). Our current network gear will stay where it is. Whatever we use will be new purchases.

On the Cisco side I was looking at something like a 2901. If I were to go with the Linux solution, what would I be giving up? Can a modern Xeon-based Linux/Shorewall box handle 100Mbit of NAT with ~300 rules? Would the Cisco device handle a DDoS attack considerably better?


Yes, your specified hardware could easily handle this workload, and quite a bit more honestly, with decent NICs.

Have you considered pfSense instead of Linux/Shorewall? pfSense is based on the FreeBSD network stack and pf - as such its network performance, stability, and security is second to none when it comes to "software" router platforms. It comes with a nice web browser-based configuration interface. I've had extensive experience with pfSense in this sort of environment, and I've never been disappointed in its performance or functionality.

Sure, the Cisco device may be able to deal with a DDoS better than a pfSense or Shorewall box would be able to, but not necessarily. The 2901 is not a high-powered router and is doing all of its routing/switching in software anyway, so even if configured optimally, it may not fare any better than the alternative.

One recommendation - ditch the NAT idea if you can. You're getting a /24, so you'll have plenty of IP addresses. Turn off NAT on the router, set up a default deny firewall policy, and then add allow rules for only the hosts/ports you need. NAT adds additional load on the router, adds additional management complexity, and doesn't buy you any additional security.

  • 2
    As a reference, at home I run pfSense on a tiny embedded board with a 400 MHz AMD Geode CPU. The whole thing draws ~6 watts max. I'm able to push 80Mbit through it. The hardware you specified is several orders of magnitude more powerful than this setup, so 100Mbit is no problem. – EEAA May 19 '11 at 22:26
  • pfSense is an option, and I've looked at it somewhat. But I put a lot of emphasis on having a standard server platform, so the benefits would need to be significant. Ditching NAT actually isn't something I considered because we use it currently. But you have a point that it might not make sense. I would want something larger than a /24, but it's something to consider. – mmalone May 20 '11 at 17:26

Providing a basic firewall with NAT and routing, but without deep packet inspection, is not a particularly CPU-intensive task. The PFsense hardware sizing guidelines indicate that a 1 GHz CPU is adequate for 100 Mbps wire-speed performance.

Inexpensive, dual-core Atom-based servers built around the Supermicro X7SPE-HF (or X7SPE-HF-D525) board are popular for this type of application. These can mount in a telco rack alongside switches and patch panels, come with dual gigabit interfaces on board, and have a PCI-express slot that makes it easy enough to add up to four more. Using this type of hardware, you can build an open source firewall appliance with $500 or less in brand-new components. Here's one suggested parts list to give you an idea of what the possibilities look like.

Of course, commercial firewalls and security appliances may be built on very similar hardware. It's typically the reputation, software features, and support that one is paying for when one purchases a commercial firewall appliance.

  • The pfsense hardware sizing guidelines are helpful. Even if I decide to go with Shorewall I would be that the requirements are at least in the same ballpark -- i.e. I have enough horsepower. – mmalone May 20 '11 at 17:31

I'm pretty handy with linux/iptables, but I prefer using pfsense just because it is so much easier to maintain and add nifty features like content filtering and vpn (though I've not gotten OpenVPN to work, but I barely tried, once). We have 10mbit up and down, using an old 3Ghz Xeon with 512mb of RAM but the cpu usage never goes above 10% and the memory usage never goes above 64mb.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.