Can't find a decent but simple wired router/firewall

[AlexandreG]

Hi
I've been browsing your website for a while and I decided to register on the forums

So... Here is my situation... I have a small 1mbits dsl line going to my home. From there, I want to have 2 separate networks to isolate my computers from the other family computers.

To do so, there is 2 options... Expensive equipment with Vlans... Or what I've done in the past using multiple routers.
Now... I am comfortable with the idea of using multiple routers since it works, it's easy and it's cheap...
My problem is, I want a wired only router... Well, I can use a wireless and disabling the wi-fi..

I don't need gigabit ethernet or fancy things like vpn...
But I want it to be good... To have a good SPI, and to have good documentation.

I remember a DIR-615 that I had in the past (I think it is the same with most dlink routers) where you have the option of the NAT endpoint filtering... I REALLY liked this option. In fact, I don't really need it, but I want it to be port AND address restricted for everything... both UDP and TCP!
And I kinda liked the spi! It was clear! It was simply tracking session numbers and tcp flags for the connection.

This is what I find to be a good design.

The problem with this is that I really don't like d-link... I had some problems with them and there is sooo much problem with their latest firmwares that I just don't want to go this way!

The routers having those options are, from what I saw, UBICOM-based routers. The thing is, except for dlink, there is not a lot of those routers...
I saw 2 Trendnet, but they seem to be at their end of live (unable to order them in canada). And they all seem to be cheap clones of a unknown brand (to me) and I don't like this idea

But I am willing to pay more! So I saw thing like the Zyxel Zywall2Plus, that I find too complex for absolutely nothing...

I also looked at the Cisco RV042... Seems very good! In fact, I really like it! But there is absolutely no information about the nat filtering and the SPI algorithms. And the tech support is useless.. All they managed to say is that the SPI tracks more things (yeah... but what!!!) and about nat endpoint filtering, they never understood what I meant...

So here I am... not knowing what to buy...
Any ideas??

Thanks a lot

Alex

 

[thiggins]

Unless my understanding of how NAT works, the default is that incoming traffic only gets through the firewall if it matches the IP address and port used by the client that initiated the connection. Providing the other options actually reduces firewall protection.

Consumers routers all provide essentially the same protection via their NAT firewalls. The SPI features are more for marketing purposes, with minor benefit if you forward ports to servers behind the router.

 

[AlexandreG]

Well... I have seen routers that are doing nat based on ports only... It may be older routers... I don't know...

EDIT2: You know, it must match the incoming port and of course need to be sent to the router's wan ip! But the option I mentioned also looked at the REMOTE ip... Don't know if some are looking at the remote port, that's more the job of the SPI...

Do you know any ways to verify that?

Talking about the rv042... I really start to like it! Is there a way to know the nat type?

And in that case, I think you used it a lot (edit: no, it's not you), what is the SPI looking at?

Last EDIT (I hope): I start to thing that I might have to buy the router and to some testing with wireshark and packet builder softwares...

Thanks a lot

Alex

 

[thiggins]

Last EDIT (I hope): I start to thing that I might have to buy the router and to some testing with wireshark and packet builder softwares...

If you really want to see what's going on, they yes, you need to do this.

 

[AlexandreG]

So... I am still looking...

Any ideas for WIRED only router with a SPI firewall? That's all I need actually... No needs for VPN and all that stuff...

Looking to spend 150-200$ canadian

 

[AlexandreG]

I am looking at the cisco (linksys) small business products...

What (based on my needs) would be the best?

RV042, RVS4000, RVL200??

If there is better in other brands, feel free to mention them

Thanks a lot

Alex

 

[thiggins]

RV042, RVS4000, RVL200??

Those are all VPN routers, which you said you don't need.

All SOHO/SMB routers have SPI. But it doesn't really add any value. See this.

 

[AlexandreG]

Those are all VPN routers, which you said you don't need.

All SOHO/SMB routers have SPI. But it doesn't really add any value. See this.

Yeah... But the quality of these routers is better than most basic cheap home routers... The hardware is better...

And I haven't found routers that were this good without the VPN capability...

Thanks

Alex

 

[AlexandreG]

I am still looking... Nobody is having an idea for me??

Thanks a lot

Alex

 

[rolaids-]

You will need a router that does VLAN...

To truly separate 2 lans you'll need to setup VLANS.

SPI is standard now on just about everything. What you seem to want is a fully configurable firewall. If you already have a DSL modem, grab this:
Vigor 2110

It does to vpn, but that's not enabled by default (you must set it up.)

Its 138+s&h, I'm not sure where you can get it in CA, but the exchange rate today puts that about ~$153CDN.

I've used a lot of draytek routers, and have been pretty happy with support when there actually is an issue. The hardware is also rock solid as well. I can still remember having to reset a dual wan Linksys router every other day because it would lock up...

 

[AlexandreG]

Well, yeah... VLANS or multiple routers... Like three routers... One main, and 2 other routers that are sort of 2vlans... Well, more than 2 vlans, two separate networks...

So for me it is 3 cheaper routers or one expensive one

I will give a look at this one... But I never heard of them...

It might be a good discovery!

Thanks

Alex

 

[AlexandreG]

Well.. problem is that I can't get this router in canada... And I don't want to have bad support, slow shipping... also EXPENSIVE shipping... customs fees... etc...

 

[AlexandreG]

I start to make a choice...

Now.. I have a small question for you

Between Cisco small business (http://www.cisco.com/cisco/web/solu.../small_business_routers/index.html-tab-Models)

and netgear prosafe series (http://netgear.com/Products/VPNandSSL/WiredVPNFirewallRouters.aspx)

what would you buy, and why?


Thanks

Alex