Nekonomicon - ZyXEL firewall/routers

skywriter
From living in a linux-blunderland
Who joined March 14, 2003, 5:22 a.m.

Wrote the following at Dec. 13, 2012, 9:52 a.m...

Any use one of these before? My second netgear FVS318 started to get flakey; LAN side connection seems to disappear until I power cycle the box so I went shopping for another. Most reviews of the FVS's are poor althoughits worked OK for me. It has a billion settings that I can't believe they test... But I only use the bare bones stuff.

So, I bought another FVS and one of these ZyXEL 20w wired firewall, etc... It's a cheap looking little thing that has programmable firewall rules, and 390 page CLI reference manual for the series console port. It also, has a licensed features for content filtering, antispam, antivirus, IPD, etc... Not sure of the feature/license but it's a yearly fee.

DECUS Member 368596

mila
From Bålsta, Sweden
Who joined Dec. 31, 2009, 4:20 a.m.

Wrote the following at Dec. 13, 2012, 1:57 p.m...

Your second

I have used two firewall for the last hmm ~15 years, the first 10 it was a SS10 with dual 40MHz SuperSparc and now a U10 440Mhz!

Netgear is such a crap, as a Decus member you should know better

--
No Microsoft product was used in any way to write or send this text.
If you use a Microsoft product to read it, you're doing so at your own
risk.

skywriter
From living in a linux-blunderland
Who joined March 14, 2003, 5:22 a.m.

Wrote the following at Dec. 13, 2012, 3:59 p.m...

good for you.

now anyone have any experience with ZyXEL?

DECUS Member 368596

zmttoxics
Who joined Aug. 31, 2009, 9:11 a.m.

Wrote the following at Dec. 13, 2012, 4:11 p.m...

skywriter wrote: good for you.

now anyone have any experience with ZyXEL?

We miss you on IRC Sky, you should hang out and make the new guys feel bad again.

I have a dual wan port ZyXEL at work were not using, aquired it with a batch of other stuff (peplinks and some ciscos). It was supposed to be really good and reliable, but its 5 years old now and doesn't do the new VDSL speeds and such (caps out at 10mb/s on a 25mb line). But other than being old, it ran linux with a pretty complex feature rich web interface and still worked. Must say something.

Never used a netgear firewall appliance, but I buy the prosafe managed gigabit switches pretty regularly. They do great for the cost.

Stuff.

sgtprobe
From Sweden
Who joined Nov. 20, 2008, 11:18 p.m.

Wrote the following at Dec. 13, 2012, 4:56 p.m...

skywriter wrote: good for you.

now anyone have any experience with ZyXEL?

Always so lovely and to the point.

Regarding ZyXEL, well, imho they sux. Using a ZyXEL wireless router here at home. And it works good when it works, but when it get too much load on it, internet usually goes down (sometimes the wireless devices can't connect to Lan either), but wired Lan is still working. Granted, it's one of their cheaper units. So maybe shouldn't read too much into what I think.

Anyway, there you go

-----------------
Old polygon wrangler
___________________
http://www.edgeloop.se

hamei
From over the rainbow
Who joined Feb. 24, 2004, 4:10 p.m.

Wrote the following at Dec. 13, 2012, 5:27 p.m...

skywriter wrote: Any use one of these before? My second netgear FVS318 started to get flakey; LAN side connection seems to disappear until I power cycle the box ... So, I bought another FVS and one of these ZyXEL 20w wired firewall, etc...

Some people are slow learners

Look on fleaBay .. you can get a good 3745 for about a hundred dollars.

skywriter
From living in a linux-blunderland
Who joined March 14, 2003, 5:22 a.m.

Wrote the following at Dec. 13, 2012, 6:03 p.m...

zmttoxics wrote: We miss you on IRC Sky, you should hang out and make the new guys feel bad again. :D

no, it freaked poor regan out too much. with my kickass studio, and observatory on the way, I really don't have anytime for sitting in front of the computer anymore.

zmttoxics wrote: I have a dual wan port ZyXEL at work were not using, aquired it with a batch of other stuff (peplinks and some ciscos). It was supposed to be really good and reliable, but its 5 years old now and doesn't do the new VDSL speeds and such (caps out at 10mb/s on a 25mb line). But other than being old, it ran linux with a pretty complex feature rich web interface and still worked. Must say something.

Never used a netgear firewall appliance, but I buy the prosafe managed gigabit switches pretty regularly. They do great for the cost.

I have a pro safe 24 port core switch and four of the prosafe 9 port leaf switches that work together for trunking and stuff. they're been great. The prosafe router works fine too, except after 3 years it hangs up every couple of weeks; anything can be capable of that kind of failure, and it's not worth trying to debug it other than for heat... so, I bought a 10/100 replacement instead if the 10/100/1000 since it's only a router for the cable modem and don't use the built-in 8 port switch. so it was cheaper. which I was shopping the ZeXEL looked interesting, so I"ll give it a try. Oh yeah and a 6 disk NETGEAR Riad box; it works GREAT.

@hamei, the last of my ebay crap left with the last dumpster. I've happily bought brand new modern gear that works just fine. I'm done idolizing the past for what it really was; just someone's job.

DECUS Member 368596

hamei
From over the rainbow
Who joined Feb. 24, 2004, 4:10 p.m.

Wrote the following at Dec. 14, 2012, 3:27 a.m...

skywriter wrote: @hamei, the last of my ebay crap left with the last dumpster.

In that case, a quick call to your nearest Cisco reseller will get a you a shiny new 2800-series router by return post. No need to be concerned about some $20 piece of shit when you can buy the good stuff

fu
From constant traveler [nyc/london/berlin]
Who joined Sept. 29, 2005, 9:39 a.m.

Wrote the following at Dec. 18, 2012, 11:24 a.m...

sky, do you still have the zyxel or tossed it already?

i've found a kid in the support team that used to work for zyxel. want me to teleport any questions?

robespierre
From Boston
Who joined Sept. 12, 2011, 2:28 p.m.

Wrote the following at Dec. 18, 2012, 4:09 p.m...

sounds kind of like a sonicwall, but hopefully better support and performance?

I use a mikrotik RB532 with RouterOS. doing everything from a command line gives me a warm fuzzy feeling, and I don't need fancy virus scanning etc.

skywriter
From living in a linux-blunderland
Who joined March 14, 2003, 5:22 a.m.

Wrote the following at Dec. 19, 2012, 4:17 a.m...

fu wrote: sky, do you still have the zyxel or tossed it already?

i've found a kid in the support team that used to work for zyxel. want me to teleport any questions?

Thx fu! I'm waiting for the working FW to fail again. then I'll decide what to swap it out with. since I moved it to the basement it's only failed once.

DECUS Member 368596

hamei
From over the rainbow
Who joined Feb. 24, 2004, 4:10 p.m.

Wrote the following at Dec. 19, 2012, 8:27 p.m...

skywriter wrote: I'm waiting for the working FW to fail again. then I'll decide what to swap it out with.

China Telecom hands out ZyXel dsl modem-routers to their residential customers. If China Telecom gives it away free .... (mouths words "cheap junk" in background)

sgtprobe
From Sweden
Who joined Nov. 20, 2008, 11:18 p.m.

Wrote the following at Dec. 20, 2012, 7:52 a.m...

hamei wrote: (mouths words "cheap junk" in background)

And right you are :lol:

-----------------
Old polygon wrangler
___________________
http://www.edgeloop.se

skywriter
From living in a linux-blunderland
Who joined March 14, 2003, 5:22 a.m.

Wrote the following at Dec. 20, 2012, 2:43 p.m...

I have enough 'feedback' thx.

DECUS Member 368596

hamei
From over the rainbow
Who joined Feb. 24, 2004, 4:10 p.m.

Wrote the following at Dec. 21, 2012, 12:21 a.m...

skywriter wrote: I have enough 'feedback' thx.

Oh, we've moved beyond feedback. Now that we have Mr ZyXEL on the ground we're gonna give him a good kicking. "Take that, you useless piece of plastic crap ! and that ! and that ! Remember the time I had an important email to send but you wouldn't work ? Here's one for then, too !"

Ahhh. Feels good

jan-jaap
Who joined June 17, 2004, 10:35 a.m.
and authored 3658 notes

Wrote the following at Dec. 21, 2012, 1:09 a.m...

I was watching this thread hoping someone would come up with a good recommendation. So far I've only learned what not to buy. I had already disqualified the FVS318 myself after I read the reviews.

I'm looking for:
[1] Something I can trust.
[2] Reliability
[3] A router / firewall which can handle at least 500Mb/s WAN <-> LAN
[4] Wireless N on 2.5GHz and 5GHz bands
[5] Basic VPN capabilities
[6] A hardware DMZ and VLAN capabilities on the LAN side are a bonus
[7] A 'tap' for intrusion detection/ flight data recording purposes at Gb speeds

Doesn't have to be a single device (in fact I'm pretty sure it won't be). Large, loud, power hungry devices do not qualify because it has to be installed in my utility cabinet.

Right now I'm using an Engenius ESR9850 wireless router and a Netgear DS104 hub as a tap device.

The Engenius has proven reliable, but it's a closed device so I have problems trusting it. Trust is #1. So right now I'm using my Linux server as a secondary firewall and the actual LAN is 'behind' the Linux server. This effectively puts my wireless network in the untrusted zone which isn't practical in this age of laptops and gadgets. The DS104, being a genuine hub, is limited to 100Mb/s which is my current internet speed -- no future there either.

I'm considering something like this: http://www.dual-comm.com/gigabit_port-m ... switch.htm to replace the DS104 hub.

I want to replace the router with a DD-WRT based solution. Maybe that firmware will be maintained a little longer than the 6 month attention span of the original manufacturer.

This effectively reduces my search to 'the best DD-WRT' solution. So far I've seen the Cisco / Linksys E4200 (v1) come up a lot, and the Buffalo WHR-G300N . I intend to go to the bottom of this before I make my choice because 'reliability' and 'alternate firmware' are not necessarily a good match. Also, DD-WRT &co seem to target mostly el-cheapo consumer devices so I have to find something there with decent hardware specs and build quality.

_________________
Now this is a deep dark secret, so everybody keep it quiet

It turns out that when reset, the WD33C93 defaults to a SCSI ID of 0, and it was simpler to leave it that way... -- Dave Olson, in comp.sys.sgi
Currently in commercial service:

(2x)

In the museum : almost every MIPS/IRIX system.
Wanted : GM1 board for Professional Series GT graphics (030-0076-003, 030-0076-004)

smj
Who joined Nov. 12, 2007, 7:54 p.m.
and authored 1013 notes

Wrote the following at Dec. 21, 2012, 3:22 a.m...

I would like to get DD-WRT or OpenWRT on my Netgear WNDR3700 one of these days...

But here's what I did ~5 years ago. I got a pretty small (25cm x 15cm x 5cm, roughly?) box off eBay with a 600MHz Celeron, 4 x 100baseT ports, 2 Mini-PCI slots and a CF slot where I've put a 4GB Microdrive. The NORCO 7732 was obviously intended as some kind of wireless router, but I got it off eBay without any radios and generic docs for the bare board - I installed one but never spent the time to try and get it working, partly because the Linksys "just worked" and partly because I was searching for an 802.11n solution.

Pictures of the NORCO are on Flickr . I hung the Linksys off one port, wired network on another, WAN off a third, and later added the Netgear WNDR3700 off the fourth. It runs pfSense , which is based on FreeBSD, which I've found to be very solid. I use the OpenVPN support with TunnelBlick on the MacBook when I travel, and that works well.

I'm not sure what's out there in terms of current hardware for this approach, but I'm sure the Alix and Routerboard folks have something. There were usually a bunch of them in Linux Journal whenever I glance at a copy.

_________________
Then? :IRIS3130:

... Now?

-

+MLA

... Other: DEC :BA213:

Sun , DG AViiON , NeXT :Cube:

fu
Who joined Sept. 29, 2005, 8:39 a.m.
and authored 1015 notes

Wrote the following at Dec. 21, 2012, 3:30 a.m...

i guess that both jj and sky are looking for specialized firewall features but since jj mentions dd-wrt and reliability, here's a short nekochan story:

years ago i was looking for a solution to block ads & flashy unicorns at router-level and tillin pointed me to dd-wrt. reading high and low i ended up using tomato ( 1 , 2 ) on a common wrt54gs. it did (and still does) all i need and then some, all via a browser-based gui that folks like me can setup in 5 minutes ( also sports a cli for folks who don't like guis). besides ad-blocking, i just need file transfers between each base. i used to use the built-in vpn features too, but i offloaded most of my vpn needs to witopia since i'm mostly on the road.

i eventually bought 3 of them and found peace. the same old wrt54gs ones in ny & london are still up running -no problemo- for 6-7 years now. i only had to reboot them for a firmware update. i managed to muck up the one in berlin so i'm looking for a replacement, till then the AEBS undertakes router duties.

i stopped worrying about whatever cheap plastic box each ISP hands out w/ every dsl loop when i found out that i can just set it up in bridge mode, plug it into the wan port of my router and go.

my needs are simple, not sure if this will take the weight of a bunch of vpn tunnels or other demanding requirements. smallnetbuilder reports throughput figures & dd-wrt/tomato compatibility for newish models.

hamei
Who joined Feb. 24, 2004, 4:10 p.m.
and authored 8705 notes

Wrote the following at Dec. 21, 2012, 4:29 a.m...

jan-jaap wrote:

I was watching this thread hoping someone would come up with a good recommendation. So far I've only learned what not to buy.

In your case, a 3745. You won't go back.

jan-jaap
Who joined June 17, 2004, 10:35 a.m.
and authored 3658 notes

Wrote the following at Dec. 21, 2012, 4:49 a.m...

Oh, my needs are fairly straightforward. I don't even have large amounts of 'interesting' data on my intranet (to an outsider, that is). I just want to inspect a firewall before I will put my trust in it (*). After all, it is one of the things that keeps private data private.

I have FTTH (currently 100/100) and it would be a pity if I couldn't use part of what I'm paying for because of a crappy router.

The ASUS (shiver) RT-N66U appears to be a fairly powerful router and is said to run Tomato nicely too.

hamei wrote:

In your case, a 3745. You won't go back.

This?

Attachment:

cisco3745.jpg [ 33.47 KiB | Viewed 500 times ]

jan-jaap wrote:

Large, loud, power hungry devices do not qualify because it has to be installed in my utility cabinet.

'nuff said ...

(*) The question is not 'are you paranoid?', but 'are you paranoid enough ?' :mrgreen:

_________________
Now this is a deep dark secret, so everybody keep it quiet

It turns out that when reset, the WD33C93 defaults to a SCSI ID of 0, and it was simpler to leave it that way... -- Dave Olson, in comp.sys.sgi
Currently in commercial service:

(2x)

In the museum : almost every MIPS/IRIX system.
Wanted : GM1 board for Professional Series GT graphics (030-0076-003, 030-0076-004)

Miscellaneous Operating Systems/Hardware

ZyXEL firewall/routers - Page 1