# Need router and firewall but not ISP box



## Solaris17 (Jun 15, 2015)

Or really any conventional router to be honest. I already have a server 2012R2 system that is hosting a few VMs with a webserver etc. However it connects to my ISP FIOS router. I dont really want to deal with RRAS and was thinking of going with another box for PFsense smoothwall monowall etc.

Does anyone have any recommendations as far as this goes? Id like a low wattage system to run this the rest of my network will be run off a switch.


----------



## remixedcat (Jun 15, 2015)

Well I use a Cisco Meraki Z1 with 3 VLANs, tons of group policies, etc.. and I got 3 server 2012 systems and it works very nice.
Review: http://remixedcat.blogspot.com/2014/02/cisco-meraki-z1-review.html

Meraki even gives you free DDNS as well which is a neat extra

Unsure of power draw to it but it's lower than a Pfsense/IPcop/Untangle box.

If you are really cash strapped just go the 'box way....


----------



## Solaris17 (Jun 15, 2015)

Well like I said im not really interested in any kind of pre-built router at all. Not to mention I dont really want to deal with the costs involved in the high end ones when I can make a microbox that potentially has the same options. Nor do I want to take the risk of it NOT having the options that I need.

Can anyone shed some insight on these types of setups? how is the interface between them? do they have a decent amount of options?  can anyone recommend good low power hardware for such a machine?


----------



## RCoon (Jun 15, 2015)

Eh, we just use a nice plain and simple Mikrotik router attached to our core fibre switches that do the routing and a smoothwall for webfiltering/firewall.

Gimme a sec, I'll go up to my server room and take a picture, I don't remember the model.


----------



## Ferrum Master (Jun 15, 2015)

RCoon said:


> Mikrotik



Vouch for them, made and designed in my small turf...


----------



## RCoon (Jun 15, 2015)

This thing, hasn't blinked in 5+ years


----------



## remixedcat (Jun 15, 2015)

Mikrotik is still pre built tho  I almost got one of those instead of the Z1 but they were all out of stock of all the decently priced ones and would have been for 3 weeks so....


----------



## Aquinus (Jun 15, 2015)

You could always build a cheap AM1 machine and use an old 4-port gigabit Intel 1000PT card and use pfSense or something. If you know how to use IPTables, I would say do a bare Debian install. It's what I did (2-port instead of 4, since the motherboard has 2 already on it,) and it has been rock solid since.


----------



## Rhyseh (Jun 16, 2015)

Mikrotik or a ubiquiti edge router lite is a good option for the CLI savvy. Pre-built but it's power draw is minimal. I'm testing a ubiquiti unifi security gateway in my home lab (it's managed similar to the UniFi AP's), it's similar hardware and and OS to the Lite.

All the ubiquiti kit runs a modified version of Vyatta, which is pretty similar to Juniper's JunOS. There's not much from a networking perspective that you can't do with them... Obviously it's not an IDP or UTM though so if you want those features without the cost you will need to spec up a small server/PC. I'd have a look at mini-ITX configs. An Intel NUC style system could work using sub-interfaces. What is your switching infrastructure like? Managed CLI? Layer 2 or 3?


----------



## m&m's (Jun 16, 2015)

pfSense + whatever you have lying around will work as long as you have 2 NICs.


----------



## Rhyseh (Jun 16, 2015)

If you have a managed switch you could just VLAN it onto a VM running pfSense/Monowall/Whateverthehellyoufeellikevirtualising. Probably the lowest power option.


----------



## remixedcat (Jun 16, 2015)

Just make sure you have a processor that supports VT-X and VT-D.


----------



## Aquinus (Jun 16, 2015)

remixedcat said:


> Just make sure you have a processor that supports VT-X and VT-D.


There is no reason to need VT-d unless you're running everything in VMs and are passing physical devices through to VMs using VT-d/IOMMU. The VT-d option gets expensive really fast and isn't necessary for this kind of setup.

I like how there are a bunch of recommendations for pre-builts when the OP specifically said:


Solaris17 said:


> Well like I said im not really interested in any kind of pre-built router at all.


----------



## remixedcat (Jun 16, 2015)

Thing is with some NICs they work better with it for VMs....


----------



## Aquinus (Jun 16, 2015)

remixedcat said:


> Thing is with some NICs they work better with it for VMs....


Only if you use PCI-E passthru, otherwise VT-d legitimately does nothing. Hypervisors don't use VT-d out of the box, you usually have to configure pass-thru manually and you have to tell KVM or whatever hypervisor you're using to pass through the specific PCI ID of the device. I wouldn't run a VM to do this as adding VT-d to the mix adds to the price and complexity of setting it up significantly.


----------



## Rhyseh (Jun 17, 2015)

You don't need VT-d to assign virtual NIC's to separate VLAN's. There is no need to pass-through physical devices to the VM, simply tag the vNIC's to the correct VLAN's (assuming the Hypervisor is configured correctly) and you're done. I use this setup quite regularly for setting up Virtual appliances like Citrix Netscaler's, virtual security appliances or voice servers. Really you don't need VT-d unless you are expecting large IO's on the interface.


----------



## Solaris17 (Jun 17, 2015)

Thanks everyone. currently my setup looks like this. From fibre (FTTP) I run to a verizon provided router/moca box (CAT6). this patches to a set top box (STB) via moca a 4 port switch and server are on the routers lan.

I would LIKE to run internet (from ONT) to a OPNsense box --> 48port switch (layer 2 unmanaged) --> Server/Moca Bridge (for STB)

the rest of the house will be hard lined via data drops to panels on the wall. im re-doing my entire home network (I own a house) I want to do this correctly above is my target topology. I want to dump the verizon box as soon as possible.


----------



## brandonwh64 (Jun 17, 2015)

Solaris17 said:


> Thanks everyone. currently my setup looks like this. From fibre (FTTP) I run to a verizon provided router/moca box (CAT6). this patches to a set top box (STB) via moca a 4 port switch and server are on the routers lan.
> 
> I would LIKE to run internet (from ONT) to a OPNsense box --> 48port switch (layer 2 managed) --> Server/Moca Bridge (for STB)
> 
> the rest of the house will be hard lined via data drops to panels on the wall. im re-doing my entire home network (I own a house) I want to do this correctly above is my target topology. I want to dump the verizon box as soon as possible.



Just a kinda off/on topic question but what brand ONT do they use? 

*On topic experience* 
I run a core2duo with 2GB of ram with a PCIex dual intel gig nic running IPcop and its very stable (Minus charters horrible issues). I almost never have to restart it and the times I do its my ISP that is at fault. This build was extremely cheap and actually better than some of the sonicwalls I have to deal with out in the field


----------



## Solaris17 (Jun 17, 2015)

brandonwh64 said:


> Just a kinda off/on topic question but what brand ONT do they use?
> 
> *On topic experience*
> I run a core2duo with 2GB of ram with a PCIex dual intel gig nic running IPcop and its very stable (Minus charters horrible issues). I almost never have to restart it and the times I do its my ISP that is at fault. This build was extremely cheap and actually better than some of the sonicwalls I have to deal with out in the field



A really bad storm just started but tomarrow ill go out there and open it up again and grab you a manufacturer.

Does anyone know if like the NUC and other small prebuilt net tops have dual nics? I'm interested in small because all of this will be on a rack mounted to the wall. the gigabyte bricke tc seem like they would be powerful enough for this kind of thing.


----------



## tong (Jun 17, 2015)

Go to : netgate and order an apu4 kit, it's dual core 1 gig cpu with 4 gigz of ram, slap a 30gig mSATA drive on it, and throw pfsense on it.  I personaly have that setup and it's fantastic, 3 gigabit nics, handles everything I've done with it.


----------



## brandonwh64 (Jun 17, 2015)

Solaris17 said:


> A really bad storm just started but tomarrow ill go out there and open it up again and grab you a manufacturer.
> 
> Does anyone know if like the NUC and other small prebuilt net tops have dual nics? I'm interested in small because all of this will be on a rack mounted to the wall. the gigabyte bricke tc seem like they would be powerful enough for this kind of thing.



A intel atom ITX with dual nics are available (almost pulled the trigger on one) and would be well capable of running a home network. I run a PFsense server at work on a older P4 1U rack mounted server with multiple vlans and over 200+ devices arped in and it does not break a sweat. Ran a speed test during the middle of the day at peak traffic times and got 700+ down and 500+ up on a open gb circuit.


----------



## Rhyseh (Jun 18, 2015)

tong said:


> Go to : netgate and order an apu4 kit, it's dual core 1 gig cpu with 4 gigz of ram, slap a 30gig mSATA drive on it, and throw pfsense on it.  I personaly have that setup and it's fantastic, 3 gigabit nics, handles everything I've done with it.



Nice option and a good price with enough physical interfaces. Looks like a winner to me.


----------



## Solaris17 (Jun 19, 2015)

Rhyseh said:


> Nice option and a good price with enough physical interfaces. Looks like a winner to me.



Indeed it does. Thanks for the patience and help in this everyone. Based on the same CPU I did a quick search and came up with this for $100 cheaper. Other than the wifi that I wouldnt use I have both RAM and an SSD I can throw in it would this be any worse for wear vs the APU4 which is currently out of stock?

http://www.newegg.com/Product/Product.aspx?Item=N82E16856107110


----------



## Rhyseh (Jun 19, 2015)

Solaris17 said:


> Indeed it does. Thanks for the patience and help in this everyone. Based on the same CPU I did a quick search and came up with this for $100 cheaper. Other than the wifi that I wouldnt use I have both RAM and an SSD I can throw in it would this be any worse for wear vs the APU4 which is currently out of stock?
> 
> http://www.newegg.com/Product/Product.aspx?Item=N82E16856107110



It appears to use the same base hardware. Purely looking at the specs (bear in mind I have no practical experience with either product) I can't see a reason why it wouldn't work. If anything it will probably be easier to setup and maintain.


----------



## tong (Jun 19, 2015)

You can get the combo I mentioned cheaper than that newegg one if you bring your own OS (basically do your own install) they have it for 200 http://store.netgate.com/kit-APU1C4.aspx .  Beautiful thing it's 3 gigabit nics, and uses less power than my shaving razor... Make sure you grab the serial to usb cable, you will need it.  I've been running it 8 months and no throughput problems. of course the more modules you install the more it slows down.  Max throughput I've seen someone posted with snort,squid,and a bunch other scanning things running was somewhere in the 300 meg (this was a massive amount of modules running and pretty much all traffic was fully filtered.

You can wait if you want, Intel is supposed to be releasing a quad-core atom in a smaller package that takes independent modules that you can throw up to 6 gig nics on.  It was showcased at computex this year.


----------



## taz420nj (Jul 21, 2015)

I use a modded Watchguard Firebox X550e with pfSense.   I've installed more RAM, upgraded the processor, and installed a PicoPSU so it can run on a DC power supply with battery backup.  All told it cost me about $80.


----------



## Solaris17 (Aug 15, 2015)

Just wanted to update you guys on this for reasons. Went ahead and bought the following. Knowing after that realtek chips apparently arent that great at this kind of thing. /shrug.

The machine.

http://www.newegg.com/Product/Product.aspx?Item=N82E16856101162

The CPU

http://www.newegg.com/Product/Product.aspx?Item=N82E16819116974

the ram

http://www.newegg.com/Product/Produ...1768&cm_re=gskill_1333-_-20-231-768-_-Product

SSD

http://www.newegg.com/Product/Product.aspx?Item=N82E16820211717

and opnsense 15.7

https://opnsense.org/

Currently it works great!

http://www.speedtest.net/result/4583687351.png

I totally forgot an AP though (DAMNIT) but ill get one next week or so.

I had a bit of an issue setting up. forgot to release the IP provided by my ONT which kept my router from gaining a WAN IP but I got it figured out. The thermal probs, smart data, and graphs work fine with this setup. im loving the options and granularity so far. Happy to have gotten off of consumer routers. Loving the experience so far!


----------

