atcomsystems.ca/forum Forums VOIP Phones & IP PBX Networking Hub, Routers, Switches

I have a customer whose house is wire for 18 data wires ( 2 at each outlet). He wants 9 of the connected for internet access. What is the best router to use that will give me 9 connections and also easy to setup.
I was looking at the Linksys cable/dsl router w/4 port switch (model befsr41) and a Linksys 8-port workgroup switch (model ezxs88w). Any suggestions/comments? I guess a plain hub would be out of the questions. He will be running 4 or 5 laptops at a time on the internet.

the Linksys router will give you all the computers IP's while also protecting them from the internet. Linksys makes 1 single port router, then i would get a 16 port switch, remember you loose a port in the switch when you uplink the router to the switch.

i'd stay away from the hubs.

that setup would be ok

For security I would skip the router and get a firewall, if they plan on having that man similtaneous connections the network will be infected in no time at all, you could either go with a Sonic Wall TZW which will also provide you with a secure wireless signal or a TZ 170 sign them up with the various subscriptions for automatic protection, then drop down to the switch, I agree with Chris stay away from Hubs.

------------------
One stop Voice and Data Solutions VoIP

The Linksys router also has a built-in firewall. Been using them for years without any problems or hacks.

I would have to recommend the Linksys router also. The hardware firewalls are overkill for a small network like that. The best thing to do is purchase yourself a linksys router, either 1 or 4 port, doesn't really matter and also a decent 10/100 mbps switch. That will serve the customer well and provide a little room for expansion. The Linksys router has what is known as NAT, network address translation, which allows outbond traffic to be transmitted from the local machines but does not allow inbound anonymous, so to say, traffic to be received. If needed the linksys router also provides port redirection if they have a VPN at a business and such. This is a great deal that will secure broadband access for under $100. If you need help with setup just let me know...

-Austin

Linksys routers are not a true firewall, they simply run NAT but each user is still broadcasting their current IP address everywhere they go and I strongly disagree that a hardware firewall is overkill in any enviroment, you most definitely get what you pay for and all you have to do is ask the thousands of people who thought that they were protected and lost everything on there HD.

------------------
One stop Voice and Data Solutions VoIP

Let the flame wars begin...

Milestone, why don't you get a clue before you start acting like Mr. Know-it-all? Just because you're a Sonicwall distributor doesn't mean that hardware firewalls are the only thing that can protect a computer. Do some research and you'll find out that most if not all routers are classified as true firewalls, since they prevent anyone from getting into your network from the internet. True, Linksys does use NAT, but so does every other router and hardware firewall on the market. NAT does NOT broadcast the address of the computer to the internet, only the single public address of the WAN port. Private addresses such as 192.168.x.x do not exist on the internet and are not routed by the internet, so how can the address of my computer (192.168.1.77) be broadcast everywhere like you claim it is? Also, if you say that a device that "simply runs NAT" is not sufficient, why do you suggest Sonicwall TZW and TZ170 devices, which according to their web page also "simply run NAT"? You also said to "skip the router and get a firewall", but something that is just a firewall can only protect a single IP address. In order to have multiple devices using a single connection, a router is required, and the process of routing many private IP's to a single public IP implies at least basic firewall functionality. As for security, I've set up several Linksys routers (BEFSR41) that, unless they connect to you, simply don't exist (or don't appear to exist) to the public internet. They don't return a ping and they don't respond to port scans. If that doesn't classify as a "true firewall", then I can't comprehend what a "true firewall" is.

If what I said is wrong, show me how and why, and maybe together we can help others. Otherwise, get a clue.


P.S. I agree with Chris on the switch, a hub can actually slow down your network.


[This message has been edited by junkman (edited February 16, 2005).]

BAM!!! (ouch)

Let's go! I didn't call you names merely gave my opinion, though as we all know opinions are like assholes everybody has one. Firewalls offer many more services than "simply running NAT":
Firewalls offer subscription services that routers do not offer, this is why when we come in to trouble shoot networks we always find that people have gone out on the internet and filled their desktop with every available freeware to stop popups, spyware you name it it's on the desktop routers don't do anythiong to stop this kind of traffic, they do nothing for intrusion detection or virus protection. Go ahead o brilliant one

------------------
One stop Voice and Data Solutions VoIP

1. "Linksys routers are not a true firewall, they simply run NAT but each user is still broadcasting their current IP address everywhere they go" This is a statement (a false one at that), not an opinion.

2. Sonicwall's "subscription services" include a forced virus scanner. This virus scanner requires McAfee software to be installed on a Windows computer to allow any internet access from that computer. If the Sonicwall virus scanner is enabled, it will prevent any non-Windows device from accessing the internet, such as Macintosh, Linux, AND IP phone systems. It also denies users the freedom to use other virus scanners, such as Norton. (This info was condensed and paraphrased from Sonicwall's web site.)

3. In my previous post, I said nothing about viruses, popups, spyware, or intrusion detection because those were not an issue in the original posts. On Sonicwall's website, I saw nothing about intrusion detection, only intrusion prevention, which has already been covered by the firewall/router/NAT issue. I also saw nothing about preventing popups. If the Sonicwall prevented popups, how would the users be able to use sites that required popups? Also, some of the Linksys routers have subscriptions for Zone Alarm and (I forget what brand) antivirus.

Again, I state: If what I said is wrong, show me how and why.

1 you are right I stand corrected
2 you are wrong, depnding on how you set your firewall up you can runn any devices obn the firewall that don't have to use the "forced" virus protection it's a simple matter of alocating ip addresses to the machines that do use the subscription and those that don't, the same applies to machines running other virus software.
3 the original question was about the best way to set the network up, I think that firewalls and virus protection etc are an integral part of the network, yes you can use a router but is it the best way I don't think so. I didn't say that the Sonic Wall prevents popups I was referring to a lot of the common problems we find on networks that are not set up with adequate protection.

------------------
One stop Voice and Data Solutions VoIP

2. If you read my post carefully, it says that I got the information from Sonicwall's website. It doesn't say anything about selecting which machines use it, so my statement isn't completely wrong, just based on incomplete information. I stand corrected.

3. The original question was about which router to use "at his house" that's also "easy to set up". With all the features of a Sonicwall, how easy is it to setup compared to a Linksys? For home use, not many people can justify $500 for a router compared to $60 for a Linksys that also has wireless built in. This also applies to many small businesses.

I agree with you there cost is always a factor, we install very tight networks and we also do a lot of telecommuting setups, a hardware firewall is always a hard sell for residential and also small business but all we do is install a demo and come back after a week and show the customer how many attacks were made on the network and that normally closes the deal.

------------------
One stop Voice and Data Solutions VoIP

That's fine for people that call to have a network set up by someone else, but most want to do it themselves. I think the intent of the topic was to find out which brand would work and be easy for the end-user to setup.

Linksys also has a log viewer program that runs on the PC, it shows incoming and outgoing traffic by IP and port #. Easy for the user to review.

I think part of the confusion is caused by marketing. Linksys calls their product a router, Sonicwall calls theirs a firewall, but both are essentially the same thing with different features. They both run NAT to allow multiple computers to use the same WAN connection, they both offer port forwarding and blocking, they both prevent intrusion, and they both offer a subscription feature for antivirus. I run into this type of thing a lot when users know a feature by one name, and technicians call it something else. Both are saying the same thing, just using different feature names.

I'm not trying to insult or belittle anyone, just making sure that accurate information is given and false or misleading information is corrected.

Back to the original question - Dialtone, it looks like either Linksys or Sonicwall would work in your situation. Linksys is cheaper (around $60 with wireless) and easy for an end-user to setup, Sonicwall is more expensive ($600 with and $500 without wireless), Milestone can tell you about it's setup. You would connect the DSL or cable modem to the WAN port of the router, then connect a switch to the LAN port of the router. Both products support DHCP, so the computers wouldn't need any special configuration other than installing/enabling the network card. If you use a 4 port router and a 16 port switch, you can have all 18 connected at once, no swapping cables if you move computer locations. With an 8 port switch, you can have 10 connected. If you require VPN connections, Linksys has the BEFSX41 and BEFVP41 4 port routers with VPN capability, I can assist with VPN setup if needed.

(whoosh! sizzle!) Flames (hopefully) put out.

Whats a firewall?

OK, where's my ammo...

This is why we bailed on network services and now stick with phone systems and cabling - everybody has a different opinion and who knows what is truly the right way to do it. Question on Linksys versus SonicWall - i know that SonicWall does stateful packet inspection - does Linksys??

Yes, it does. As a side note, Netgear also makes routers that are comparable to Linksys in both cost and performance, I've setup a few of them and they seem to work well. D-Link, IMHO, isn't worth messing with. I've heard several people say that Zonet products are good AND inexpensive, but out of the few I've put in, I had about half out-of-box failures.

I would state an opinion but Junkman might pick on me.

Aw, come on, I'm not that bad. (chomp! snarl! growl!) Just trying to sort out some confusion and misunderstanding.

How is your client getting his internet access....if DSL, Westell makes a nice combo router/wireless AP....add one or two routers daisychained downstream & you are good to go....

I would avoid cascading routers running NAT. Use one router at the edge of your network, and switches and wireless access points inside the network.

Please, NO! Not this topic again!

There are a few times when cascading routers is useful, such as using the same internet connection for guest rooms and office computers in a hotel, put the offices behind a second router so the guests can't get to them. Normally, you only need one router.

Definitely don't chain the LAN ports of 2 different routers together unless you turn off DHCP on all but one router.

Why would a router be classified as a firewall? A router main function is to "route a routed protocol using a routing protocol."
Some routers have some basic "firewall" capabailities. NAT is actually an invention to limit the addressing shortage of IPv4 (2^32 address available.) A side benifit of NAT is a bit of security. However NAT can be cracked using a TCP seq attack of example.
A firewall on the other hand does not Route traffic, and is specifically for security. It deep scans packets and rejects or allows access through it based on predetermined policies. An example is if a packet has been altered it will be dropped.

Anyway I AGGREE with what you are saying a Router with NAT functionalty is good enough for home use, but it isnt a firewall.

Gentlemen,

First let me thank you for keeping things (mostly) civil. We're all professionals here, and with the rising popularity of this site it is important that we keep that in mind.

My own opinion is that Linksys routers (which do contain limited firewall capabilities) are adequate for home use, primarily because they are usually coupled with software-based A/V and firewalls.

However, when we're talking about a home office or a large family with 5-6 PCs running around the clock, then a hardware-based firewall should always be a consideration. The higher initial costs are offset by not having to outfit each PC with A/V & firewall software.

I see far too much consumer-grade Linksys gear being used in office environments, with typically poor results. Linksys also offers a reasonably-priced product line aimed squarely at the SOHO market. The originally posted scenario might be a good fit for the RV016, which is a 16 port router (with VPN and some firewall capability, plus redundancy and backup connection features typically found on much more expensive units).

Since this thread keeps resurrecting itself - here are my 2.5 cents. :nono:

The decision as whether to use a true Firewall really comes down to what you are doing with your Internet connection. If you will only be making "outbound" connections (surfing, mail etc.) then a NAT router or low-end firewall (linksys, etc.) will more than suffice.

Even if you had the most expensive Firewall on the market installed, it would not do you any good if it were not configured correctly (which the avg user can not do). Furthermore, in my experience, most people have any-any-any rules set for outbound connections. Therefore, the firewall is doing squat on outbound. Since most well written Malware utilize standard ports (like 80/www) a perimeter firewall (even properly configured) would happily pass these packets anyway, unless the firewall was equiped with Application Layer inspection (which is far from perfect).

A personal firewall (ass-uming that the user does not arbitrarily keep punching allow) would afford much greater protection against Trojans and other Malware as it informs you that an app or process is trying to establish an outbound connection (regardless of port or destination).

Network based antivirus (like on sonicwalls etc) Only afford a limited amount of protection and are not a substitute for a PC based product. They scan the datastream, which has a tendancy to slow things down, and poorly handle compressed files. They are a great supplement (if implemented correctly) for corporate networks but have little value in the home environment (considering the additional subscription costs).

Dave

This is default for ALL PIX firewalls, (high security level passes traffic to a lower security level) are you saying that the mighty pix is not a good firewall? To be honest in a corp enviroment, a firewall is to keep people out not to keep malware in. As you said it is preferable to have desktop applications to detect and destroy malware, i dont think this is a job of the firewall.

My 2.6 eurocents

Well, I won't even go there with PIX. Let's just say that they should stick with Routing and switching.

I disagree with what you say a firewall's job is. It should be configured to cut both ways. I have saved many a disaster by limiting outbound ports. For example, if you limit port 25 to only your legit mail hosts then you can stop worm propagation cold. You can also control many other bad places that users tend to go (like personal pop-mail hosts, usenet, etc.)

Chambers has his eye on everything... The Pix wasnt developed by cisco by the way, the technology was aquired. This is Cisco's Buisness plan it seems.

I understand what you are saying, however I dont understand how stopping outbound connections on your Eneterprise edge will help anything Within your AS. Can you explain?

Worm propogation should be stopped at the "Access layer" of your network not at the core, I would suspect most Enterprises have there WAN links at the core.

Anyway.. Every Engineer has a different way at looking at things.

Whats a firewall?

John,

When you're running wire and you have to go through a wall that is completely sealed to keep smoke and fire out, that's a firewall.

Just kidding, I know you know about that. A network/computer firewall is designed to do the same thing. It keeps all of the bad stuff on the other side of the wall (internet) from coming into your room (network).

Larry

I just couldn't resist, Test OK did it and I hurt myself laughing. Thought I'd try it myself before the post went nuclear. Instead of HOT TOPIC is was headed for HOT-HEAD Topic.

Come on guys!!!!!
Everyone knows what a firewall is!!!!

Its that thing you run into when pulling cables that stops you from seeing the other side so you have to poke a hole through it to get your cable through. No we know who doesnt seal the penetrations.

All the firewalls I have seen have all looked the same....Sheetrock partially painted and taped that goes all the way to the ceiling.

How do I identify the difference between a PIX, SONIC, or LINKSYS firewall?

DEuhh! eeert! deeert!

Now that's funny. :rofl: :rofl: giddy up

My two bits is that no matter how small or large any network is, when a PC has access to the Internet there should be protection from the outside world. Viruses, phishing, scams and such forth are existent and everyday more and more "Identity Theft" is accomplished from an improperly protected network. The lack of a true hardware firewall gateway straddling the infrastructure prior to the router which is prior to the switch connecting all PC's together is only trouble. Sonicwall is a good product and the Linksys I can never keep working long enough. I would suggest everyone taking a look at the WatchGuard product line which has excellent performance and is lower in price than the Sonicwall. Linksys and CISCO PIX I avoid, D-Link and Netgear and not worth the trouble

Just say screw it and get an old PC, throw in 2 NIC cards instead of one, load a good linux based firewall distro, configure IPChains and go for it, no need for the expen$ive sonic stuff or the cheap Linksys(low end Cisco) stuff either. Just plug it into a 10/100 switch and go to town. This method is more cost efficient and much much more configurable. If you wish to have a DMZ port you will however need to throw in a third NIC card into the firewall PC. Thanks for all the laughs reading thread, I love a good flame war!

The flames were put out back in Feb., but I still see a few puffs of smoke...

And like I said above,