NETGEAR in the core...

OK, not really "in the core", but the subject made you look at least. :slight_smile:

I'm interested in people's experiences with consumer-grade routers
functioning in non-NAT mode; that is to say, running PPPoE to the ISP
and routing a /29 or a /28. A sane filtering language and stateful
firewall that can operate in non-NAT mode is a plus.

My experiences with Linksys (and Netscreen, which isn't really at the
price point I wanted anyway) have caused me to rip out substantial
amounts of my already insufficient hair.

"Cisco 1700 series" or "Cisco 2600XM" would be nice answers if their
price had the decimal point moved one place to the left. Linux or
other non-vendor-supplied firmware, while cool, represents an
unacceptable support load for my application.

Any thoughts?

                                        ---Rob

OK, not really "in the core", but the subject made you look at least. :slight_smile:

That's for sure! :wink:

I'm interested in people's experiences with consumer-grade routers
functioning in non-NAT mode; that is to say, running PPPoE to the ISP
and routing a /29 or a /28. A sane filtering language and stateful
firewall that can operate in non-NAT mode is a plus.

Have you looked at the cheaper (<$200) Netopia routers which have built in hardware IPSec, stateful inspection, and reasonably useful packet filtering capabilities? We also use and like the CyberGuard SnapGear series of routers which are cheap, fast, and reliable and the PIX501 is a great basic firewall for low traffic loads. Here are some links:

http://www.netopia.com/equipment/products/3000/3300_bus.html

http://www.cyberguard.com/products/firewall/SG_Family/

The 1721 is a good little box, but not in the same range with throughput (too low) or price (too high.)

We have used NetGear's little 5 port switches for smaller colo clients, but their routers are too flaky to deploy to customers. Linksys is the same way. They work great 99% of the time, but every once in a while they have to be power cycled for some unknown reason. Good luck with your search!

-Robert

Tellurian Networks - The Ultimate Internet Connection
http://www.tellurian.com | 888-TELLURIAN | 973-300-9211
"Well done is better than well said." - Benjamin Franklin

I think linux runs inside those. Vendor-supplied, yes, but if the OP
wants to avoid linux altogether...

No personal experience, but could a LinkSys/WRT45g with
custom linux load be even cheaper?

Can a cisco 1600 run PPPoE?

> >I'm interested in people's experiences with consumer-grade routers
> >functioning in non-NAT mode; that is to say, running PPPoE to the ISP
> >and routing a /29 or a /28. A sane filtering language and stateful
> >firewall that can operate in non-NAT mode is a plus.

> http://www.cyberguard.com/products/firewall/SG_Family/

I think linux runs inside those. Vendor-supplied, yes, but if the OP
wants to avoid linux altogether...

That's correct. It is claimed to be quite hardened. We have around one hundred of their 550 and 575 boxes deployed and they seem to work pretty well although I prefer the PIX. The SG can do much more, but the PIX does what it does better.

No personal experience, but could a LinkSys/WRT45g with
custom linux load be even cheaper?

Probably.

Can a cisco 1600 run PPPoE?

I've never tried it, but if they can run 12.2, they should do PPPoE.

R

Tellurian Networks - The Ultimate Internet Connection
http://www.tellurian.com | 888-TELLURIAN | 973-300-9211
"Well done is better than well said." - Benjamin Franklin

Rob

Can a cisco 1600 run PPPoE?

I've never tried it, but if they can run 12.2, they should do PPPoE.

R

Only suitable one is the 1605R (because you would never dial on the same ethernet that your lan is on right?)

20mb flash card and 16mb SIMM you have around and your up and running with 12.3

Go with 1720 and 48/16flash and you still require a WIC-1ENET. (cheaper than 1721 however since cisco pppoe dialer does not support dot1q [for absolutely no good reason] it makes little difference)

Cisco has targeted this segment with the 83x series....they are fairly decent but you would need to run 123T/124

You can also target this with the obsolete 2610,2620,2621,3620......using Network modules with additional ethernets.

Joe

Robert E.Seastrom wrote:

OK, not really "in the core", but the subject made you look at least. :slight_smile:

I'm interested in people's experiences with consumer-grade routers
functioning in non-NAT mode; that is to say, running PPPoE to the ISP
and routing a /29 or a /28. A sane filtering language and stateful
firewall that can operate in non-NAT mode is a plus.

I have changed from directly PPPoE to Linux.

It was an experiment only, but the box still stays here and I still have
to use it from time to time.

I have changed again. For a friend a had to connect a portable to the
internet. I choose the Seimens Gigaset 105. I have seen that box with
differnt names again but it seems not to be to widespread.

I literally grilled the first box. It was sitting on top of a wardrobe.
Friday it worked. Saturday not so shure. Monday the firealarm went off.

The box was silently replaced by the wender. The new one had a new
software version with new bugs, mustly about the wireless part. The
ethernet part works fine for a pharmacy with five computers. They use
only NAT and PPPoE and they use it as access point for the laptop.
They dont dare to connect the laptop to their pharmacy system not
even for printing.

The box is stable now - but I would not choose it again. But it tought
me I need a router too.

I choose a GrandStream ATA-486. The box is a VoIP gateway for old analog
phones. That is why I choose it.

It did not work behind my old linux router (IBM 486-SCL/II 66 MHz)
guess why? Too slow!

The ATA is a NAT Router, that is why I choose it. It replaced my linux
router and works fine since then.

Problems:

It breaks from time to when my ISP forced disconnect hits every 24 hours.
Mostly works but sometimes I have to reset it manually.

It breaks traceroute. I dont know if it always did. But there could have
been an automatic software update. It could have happened then

Experimenting, I have used the box as router. I have used the box with
both PPPoE and DHCP. It only does NAT.

Now I am looking dor a real router.

The CISCO PIX would be my choice if I had the money and if CISCO was a
bit more adult.

But seeing them mudwrestling now, having experienced first hand how
difficult and expensive it is to get updates that copany is out of
question.

My next choice probably will be some kind of linux box that is supported
but that I can fix it I ever need too.

I am still using my linux router. Mostly it is a server now. For me
their support is great:

http://www.fli4l.de/
http://www.eisfair.org

If I did not speak german, I dont know if I chose it.

But my box did run for years without me looking at. I know quite some
people who use it without ever looking after the box

My experiences with Linksys (and Netscreen, which isn't really at the
price point I wanted anyway) have caused me to rip out substantial
amounts of my already insufficient hair.

Have a look at HP. Their support is great. I could get all my updates
for free. Their downloadable handbooks, free, were good. I never had
any problems with them.

"Cisco 1700 series" or "Cisco 2600XM" would be nice answers if their
price had the decimal point moved one place to the left. Linux or
other non-vendor-supplied firmware, while cool, represents an
unacceptable support load for my application.

The support load for CISCO will be much higher than for the linux box.
Dont forget their red-tape departement :slight_smile:

Any thoughts?

http://www.nat32.com/nat32e/htm/dg834g.htm

Overview

The Netgear DG834G is a combined DSL Modem,
NAT Firewall/Router,
4-port 10/100 Ethernet Switch and 802.11b/g Access Point
housed in a rather large (26cm x 17cm) plastic case.
The device can be wall-mounted to improve WLAN range,
and an external antenna can be connected if needed.

Internally, the DG834G contains a 150 MHz MIPS 4KEc CPU
running Embedded Linux, the source code for which is available

Note that the D-Link G604T uses the same CPU and OS,
so it most likely has very similar features and performance.

                                        ---Rob

Regards,
Peter and Karin Dambier

Robert E.Seastrom wrote:

My experiences with Linksys (and Netscreen, which isn't really at the
price point I wanted anyway) have caused me to rip out substantial
amounts of my already insufficient hair.

What netscreen's did you try, with what version of ScreenOS? I admit that some of the newer (5.1 & 5.2) trains of ScreenOS have yet to stablize, but 5.0.0r10 is pretty decent. In fact, the bits of this email are going to be sent through my 5XT on their way out to the 'net. :wink:

As for linksys, the WRT54G is a neat little box, but I've never found a sveasoft or dd-wrt firmware that was rock solid. The linksys boxes sort of remind me of Windows - OK if you don't mind rebooting them once in awhile. :wink:

I can recommend http://www.portless.net/menu/ewrt/

SCO Unix runs on cyberguards older than 6.0 (aka Classic)
Linux 2.6 kernel runs on the 6.0 (aka TSP) as for SG line... I don't
know...

At home I run WRT54g w/ a opensource firewall image loaded into it... it is
a little buggier than I'd risk my job on...I find CG's to be an enormous
PITA, better that Sonicwalls, but not a good as a Netscreen or PIX

YMMV

Suresh Ramasubramanian wrote:

I can recommend Portless Networks

Thanks, I'll check it out.

Does anyone here have experiences to share (good/bad) about m0n0wall on soekris devices?

http://m0n0.ch/wall/

Suresh Ramasubramanian wrote:

Unfortunately neither of them supports native IPv6 (via pppoed). Or did this change recently?

Arnold

The Cyberguard line was bought from Snapgear, who in turn bought it
from Ozzies Moreton Bay. They have always run Linux, and they do it
very well.

While their user interface has improved over the years, there are still
some things I'd like it to have that it doesn't, and it's not as pretty
as, say, Netgear'.

But from an operational perspective, I've got a couple dozen of these
out as edge routers for client sites behind DSL and RoadRunner, and
they Just Work. Easy install and config, gets the job done, never been
attacked successfully from outside (so far as I know :-), and I have to
reboot one roughly once a year, if that.

Nice boxes, not too pricey.

I'd shortlist them.

Cheers,
-- jra

I've heard really good things about m0n0wall, and we're planning on using it on one of the open-source projects I work on (but not on a Soekris). I'm also planning on using it on a Soekris net-4521 here at the house. I'm not fond of their DNS server or their time server (both of which I might try to replace or remove), but overall it seems pretty good.

After looking over the various WRT54G options, do any of them support
native ipv6? :slight_smile: (not the tunneled v6 over v4... native v6)

I've used m0n0wall to great effect, and with pleasure, but alas not on a soekris box -- just on an old dell hanging out in the office. It worked like a champ.

//jbaltz

Looks like a Cisco 1760 is $1086.65 'on the street' (well, online
actually).

Whereas the Cisco 837 is $448.96 'on the street'. Supports both NAT and
DMZ interface (if you're running a new enough IOS), access-lists, easy
to administer VPNs; in fact everything that we'd like them to at our
smaller branch offices...

Sadly not a decimal point shift, but much more affordable.

-a

Sveasoft's Talisman does.

"Yes, support is in Talisman/basic. Current support is CLI-based up to
layer 3 and includes radvd. Web interface additions to configure IPv6
options are planned.

To enable support, do the following:
nvram set ipv6_enable=1
nvram commit
reboot"

http://www.sveasoft.com/modules/phpBB2/viewtopic.php?t=5812

Correct. You can create an in-memory startup script to do tunnel
configuration, as well, with something like this:

(make script as text file in /tmp; for example, I'll use /tmp/mystartup)

$ nvram set rc_startup="$(cat /tmp/mystartup)"
$ nvram commit

As an in-use example, the contents of one such script I use is as follows.
Note the explicit deletes, because the rc_startup can be run in a "warm
boot" reset mode, where the interfaces are already up. I didn't bother
masking any data from this list post, since anyone could look up my
addresses via my Received: header, DNS, and traceroutes. <g>

(Though I don't use 6to4 locally, I do have an outbound 6to4 interface --
something I recommend for all tunnelling users, so that 6to4 clients can get
packets originating from your network more reliably/quickly.)

You mean that the other way round -- IPv6 over PPPoE natively, without
tunnelling?

I don't know if the pppoe implementation in the firmware does the necessary
IPv6CP negotiation to transit IPv6 natively (as I don't have an uplink where
that is possible).