I am a developer and haven't dealt with server admin or networking in years, so "rusty" is very generous. I am setting up a new web server cluster (starting with two 1U web servers and one DB server). As I haven't done this in a few years, I don't really know what options are available today.

I would like all in one device:

  • Small, basic gbit switch
  • Small, basic firewall
  • Small, basic router/DHCP/gateway
  • Small, basic VPN access
  • Fits in a 1U space

Something simple with a minimal web interface I can set up and then forget about - 2 steps above a home router device, I suppose.

Edit: the initial reaction from sysadmins is often "no way" because to them, devices that do all this are usually crap. Please realize for my purposes, that's currently OK. My setup (and budget) are just not big enough to justify dedicated equipment that does this stuff really well. I just need something that does this stuff at all.


  • If you find one, let us know - I've been keeping an eye out for somethign similar too! – Mark Henderson Jun 18 '09 at 1:58

10 Answers 10


Here's what I'd recommend:

  1. Stay away from Linksys consumer routers (even putting DD-WRT on it, etc) at all costs for any server scenario, they get flaky under load and more advanced scenarios (VPN, etc) and I have a little pile of dead/bricked ones. They were made for home use and you should keep it that way.
  2. Separate the switch from the firewall/gateway. A consumer/prosumer gigabit switch would probably be fine for this (i.e. a Netgear 5-port). In the setup you're asking for, simple and efficient is better - putting your servers together on a simple fast Layer 2 switch gives you a solid and simple backbone, and some firewalls or all-in-ones will add additional overhead to their built-in switchports and/or Layer 3 functionality that you don't need here.
  3. For the firewall / DHCP / gateway / VPN - Some of the Cisco all-in-one's are great, but may have more functionality and enterprisey-ness than you're looking for. Check out a Juniper SSG-5. These used to be Netscreen NS5-GT until Juniper bought Netscreen. I think the SSG-5's are about $600 a piece new and if you wanted you could find an eBay Netscreen NS5-GT for under $200 now, and make sure you find the "Unlimited User" version.
  4. VPN - Juniper/Netscreen will do VPN, but you need the Netscreen client software. Alternatively, you could just set up Routing and Remote Access on a Windows server for a simple PPTP VPN to use without any client software. If you wanted to go even more "just make it work", use Hamachi from LogMeIn, works great.
  5. On Windows Network Load Balancing - This works OK but in some cases does NOT play nicely with Cisco Layer 3 routing (as it relies doing some magic tricks with ARP caching to 'share' a IPv4 address across servers, and Cisco devices view this as an evil force that must be stopped). So if you go the Cisco route make sure you configure the Cisco device correctly for this (there are a bunch of articles on it).

With a Juniper/Netscreen + 5-port gigabit switch you should be able to fit both in 1U and you'll have a simple, fast, and reliable infrastructure that can do some pretty advanced stuff if you ever need it.

Hope that helps!

P.S./edit: - A couple people recommending Vyatta, Linux, etc: Those are not bad solutions, (also, the Untangle.com offering looks like it has potential), and I have used them and love them for office endpoint routers... but I did not recommend this type of solution because this is an application hosting scenario; in principle, the idea behind modular software running on generic hardware is to squeeze all of the normally 'expensive' features you can into the most cost-effective and lowest common denominator hardware. I think this is fine for the user-endpoint (home, office, branch office VPN, etc), but even for small/basic hosting scenarios I think the 'datacenter' side warrants specifically designed hardware coupled with specifically designed firmware.

  • I'll second the "separate components" piece. If you're truly using a firewall (stateful inspection, not just access-lists) then anything going through it won't get near gigabit, probably not even 100 Mbps. Ditto with the VPN. Hardware that can stateful inspect and encrypt at gig speed will be way past your budget. So keep the local servers that need fast connection on the switch, and put the firewall/VPN at your slower edge (say, Internet connection) – Geoff Jun 22 '09 at 14:23

Go take a peek at Vyatta. They have a pretty comprehensive product that uses Linux Kernel, offering such things as VPN, Router, NAT, DNS Forwarding, DHCP Server, and More... www.vyatta.com or www.vyatta.org for the community versions. You can run it on their appliance, your own hardware, or as VM. Their model 514 device is full-featured with RIPv2, OSPF, and BGP, OpenVPN, IPSEC VPN, etc. for < $800.00.

This link is pretty impressive: http://www.vyatta.com/products/product_comparison.php

  • 1
    Their entry level appliance is the 514, and it comes with four 10/100 ports that can be either switched or routed. There's an additional PCI slot that allows you to add your own 1-/2- or 4-port Gig-E card as well, so you can really expand this appliance out pretty well. Low-power. Small foot-print. Very flexible. – netlinxman Jun 18 '09 at 3:11

Linksys has some decent routers which are above a home router, but below a full on kick a** router. Something like the WRV54G. It's small, supports IPSec VPN, is a router, DHCP, etc. Only part it doesn't fit is that it's 100 Meg. But to overload 100 Meg you'll have to push a lot of traffic.

This won'd handle load ballancing (which wasn't in your requirement list, but with two web servers I assume that's needed, so you'll need to find something to handle that).

  • 1
    100mb part is a little concerning, as I hope to put the DB on the same network starting out. Maybe I can put a 1gb switch and this guy on the same unit shelf. RE load balancing, these are Windows servers so I was thinking I'd use Windows NLB to start. Any further thoughts? – Rex M Jun 18 '09 at 2:28
  • You could use Windows NLB to handle that. There's also a little load ballancer I've been using (via a linux VM under ESX, but could probably be recompiled for Windows) called Pen which works much better with Cisco gear. I use using NLB for some internal stuff and had problems with it thanks to the Cisco switches so switched out to Pen. If you think you'll be pushing more than 100 Megs internal, then go for a Gig switch connected to the front end router. This should work fine. – mrdenny Jun 19 '09 at 3:33

I see two ways:

  1. By Cisco router. It can do everything above and does this very good but costs $$
  2. Do it yourself. Buy 1U server, put in NICs and setup BSD/Linux. It can do everything above + much more (i.e loadbalansing)

PS. Do you really need all-in-one? May be separating router and switch is acceptable?

PPS. added to favorites in case you will find cheap 'n cool hardware.


I'd suggest a Sonicwall device in the SMB category. I have managed a few of these devices, and they did not ONCE let me down. The interface is a bit better than the typical Linksys.

I won't be the first to suggest to use this only as the gateway/VPN/firewall device. Of course all the heavy switching needs to be done by the 24 port devices.


To add the list my personal preference would be the Juniper SRX line.

But as soon as you need more ports use a real switch, don't keep adding modules.


I've had a lot of luck with my NetGear ProSafe FVS338. NetGear also has a Gb switch - FVS336G. US $200 and $300 respectively.

Pretty much does what you need it to do, and doesn't break the bank.

p.s. I do run Windows NLB behind this. No big deal at all - I didn't have to do anything.

  • So the FVS336G is, for most purposes, the gigabit version of your much-recommended 338? $300 isn't bad. – Rex M Jun 18 '09 at 2:45
  • Looks like it. And again, I really like this product. It intelligent about reconnections - I can power cycle my cable modem and not have to touch this box. In fact, I think the only time I've had to power cycle it is my last firmware update. Best thing about this box is that you just don't have to think about it. – Christopher_G_Lewis Jun 18 '09 at 15:34

OpenBSD is especially nice for setting up a firewall as it is "secure by default", meaning that there are no holes if you don't make them.

Also, the configuration itself is very easy, even when you dig deeper into NAT, IPsec VPN, ...

Of course you'll have to know networking with any box (what NAT means, basics of how IPsec works, what are ports, netmasks, ...).


You might be interested in pfSense.


If you really want a single box, doing all that, you could go for a Cisco 3750 (or comparable switch), it can do basic (admittedly VERY basic) firewalling (access-lists, nothing really fancy) and route packets. Don't know to what extent they provide a "simple" VPN config, but you should be able to configure IPSEC endpoints as needed.

But, to be honest, you are probably better off doing these as separate boxes.

Not the answer you're looking for? Browse other questions tagged or ask your own question.