Miscellaneous Operating Systems/Hardware

ZyXEL firewall/routers - Page 2

fu wrote:
i guess that both jj and sky are looking for specialized firewall features but since jj mentions dd-wrt and reliability, here's a short nekochan story:

years ago i was looking for a solution to block ads & flashy unicorns at router-level and tillin pointed me to dd-wrt. reading high and low i ended up using tomato ( 1 , 2 ) on a common wrt54gs. it did (and still does) all i need and then some, all via a browser-based gui that folks like me can setup in 5 minutes ( also sports a cli for folks who don't like guis). besides ad-blocking, i just need file transfers between each base. i used to use the built-in vpn features too, but i offloaded most of my vpn needs to witopia since i'm mostly on the road.

i eventually bought 3 of them and found peace. the same old wrt54gs ones in ny & london are still up running -no problemo- for 6-7 years now. i only had to reboot them for a firmware update. i managed to muck up the one in berlin so i'm looking for a replacement, till then the AEBS undertakes router duties.

i stopped worrying about whatever cheap plastic box each ISP hands out w/ every dsl loop when i found out that i can just set it up in bridge mode, plug it into the wan port of my router and go.

my needs are simple, not sure if this will take the weight of a bunch of vpn tunnels or other demanding requirements. smallnetbuilder reports throughput figures & dd-wrt/tomato compatibility for newish models.


I run Tomato on a Netgear WNDR3500L as my home firewall/router. Does OpenVPN, my DDNS, excellent traffic monitoring, etc etc. I hung a 4500 off it not too long ago (summer maybe) as an AP to beaf up my wireless wireless performance. The Router has been solid for 2 years now though, and it was only ~$40. :D

_________________
Stuff.
jan-jaap wrote:
Large, loud, power hungry devices do not qualify because it has to be installed in my utility cabinet ...

'nuff said ...

2U of rack space. You do have a rack or two, right ? Two fans. The one I have at home has no fans, thus silent, but you want the big ponies. Could probably replace the fans with quieter ones. I'm going to do that to the 3660 because it has six fans and is a touch noisy. Power draw depends on how many external devices you connect (PoE) ... you could go with a 3725 but if you like stuff, you'll want the extra slots later. They are not power-hungry.

Firewall, telephony (want intercom capability in the house ? built into the Cisco), almost any kind of interface, reliability ... did I mention [b]reliability[/n] ? plus capabilities you haven't even considered yet. Ain't no two ways about it, j-j. If you are a computer freak the Cisco is the only way to fly.

They are extremely nice. Honest.
So nice you posted it twice? ;)

IOS is something I almost never want to play with at home. At home I just want to work. I have stacks of 3750s and all kinds of cisco stuff at work. Work should stay at work, home should be relaxing.

_________________
Stuff.
zmttoxics wrote:
So nice you posted it twice? ;)

Sorry, clicked the wrong button :oops: Those things are tiny !

Quote:
IOS is something I almost never want to play with at home. At home I just want to work. I have stacks of 3750s and all kinds of cisco stuff at work. Work should stay at work, home should be relaxing.

Cisco is relaxing. You get it running then you forget it exists.

Code:
3640# sh ver
Cisco Internetwork Operating System Software
IOS (tm) 3600 Software (C3640-JK9O3S-M), Version 12.2(15)T9,  RELEASE SOFTWARE (fc2)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Sat 01-Nov-03 02:47 by ccai
Image text-base: 0x60008950, data-base: 0x6203A000

ROM: System Bootstrap, Version 11.1(20)AA2, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

3640 uptime is 1 year, 1 day, 7 hours, 11 minutes
System returned to ROM by power-on
System restarted at 10:03:28 Beijing Thu Mar 11 2010
System image file is "flash:c3640-jk9o3s-mz.122-15.T9.bin"

That was in 2011. It went another six months before I had to disconnect it to move it across the room.

Before I got carried away with the current phone project, I hadn't even touched the thing since then. Literally. Prior to that, during an equal amount of time we went through two Buffalos* and a Linksys. (It gets very hot here in summer.)

And oh yeah, the Zyxel that fried at home (belonged to China Telecom, who cares), replaced by a TPLink (never buy one of those, more cheap junk but easy to get on a Saturday morning) finally replaced by another Cisco.

Smartest thing I ever did network-wise was go to Cisco. (Not Linksys.) When I get a hair up my ass I can play with it. Otherwise it just runs.

I don't like shit that's a pain in the ass. The Cisco router is anything but.

I can see where a lot of people would rather have a nice small Buffalo or whatever. And they are a good choice for most people. But j-j has a miniature NORAD command center for a hobby. I think he can handle it.


*Once you get the hang of it, I find IOS more logical and easier to use than the graphical interface of dd-wrt.

----------

While you're here, toxics ... you're a Solaris guy, aren't you ? I started ntp running a few days ago on a V100 (Cisco router acting as ntp server, took a couple small entries

Code:
ntp clock-period 17180462
ntp master
ntp server 216.218.192.202 prefer
ntp server 209.81.9.7
ntp server 128.2.1.22

in the config, ahem) - the ntp client in Solaris shows up as

Code:
online        21:47:48 svc:/network/cswntp:default

but the computer is still about fifteen minutes slow. I know it takes a while to catch up but how long should this take ?
I think a Cisco RV180 VPN Router would be more realistic for a SOHO network. For the big hardware you need a support contract to access firmware updates. Oracle practices, bleh :(

I haven't forgiven them yet for yanking the firmware updates for the WS-C1100 and WS-C1400 FDDI concentrators from (public) FTP and restricting it to active support contracts. Anybody have a copy of ftp.cisco.com from the 2002 - 2007 era?

The RV180 doesn't have wireless, so I'd need an access point. Why oh why is a wireless N access point at least twice as expensive as a wireless router with similar (5GHz band, 300 or 450Mbit) capabilities :roll:

_________________
Now this is a deep dark secret, so everybody keep it quiet :)
It turns out that when reset, the WD33C93 defaults to a SCSI ID of 0, and it was simpler to leave it that way... -- Dave Olson, in comp.sys.sgi

Currently in commercial service: Image :Onyx2: (2x) :O3x02L:
In the museum : almost every MIPS/IRIX system.
Wanted : GM1 board for Professional Series GT graphics (030-0076-003, 030-0076-004)
If you can afford it I second Cisco. I went from fighting "consumer-grade" stuff at work (resets once a month, odd bugs) to Cisco router/WAPs and haven't had to touch it since.

The downside is learning IOS and figuring out exactly how you want the thing set up. I wish Cisco would just cancel their GUI program and attached documentation. It doesn't work anyway (I've tried- you'll be going along and then either something will not be supported or it won't configure the device right), and the resources from the GUI group could be put into producing good "IOS CLI for people who haven't used it before" documentation.

Anyone here deployed Vyatta on a laptop? I've been considering that for home use.

_________________
Damn the torpedoes, full speed ahead!

There are those who say I'm a bit of a curmudgeon. To them I reply: "GET OFF MY LAWN!"

:Indigo: :Octane: :Indigo2: :Indigo2IMP: :Indy: :PI: :O3x0: :ChallengeL: :O2000R: (single-CM)
jan-jaap wrote:
I think a Cisco RV180 VPN Router would be more realistic for a SOHO network. For the big hardware you need a support contract to access firmware updates. Oracle practices, bleh :(

To some extent I have to agree with you. As a company Cisco management is despicable.

However, several of their products are good. I can't say about the RV180 'cuz I don't have one. Maybe it does everything these older boxes do, too. But the 3640 was excellent. The 3745 is very similar but slightly updated and a three-times faster cpu. It's MIPS, too :D There are newer units but the cost zooms way up. The 3700 series seems to be a good point in the cost-vs-benefits curve. I went 3660 only because one became available here, importing is a pita. That and I have developed network module lust ...

Did a touch of research, with a single power supply and a couple network modules the power draw is ~ 60 watts. I was mistaken, the 3745 has four fans where the 3640 had two. But people have succesfully replaced the windtunnel models with quiet units. The six fans in the 3660 have to go :evil: I'm thinking two 140 mm units will move the same air but with a lot less noise.

The reason I think you'd be happier with a more industrial unit is that you really can do a lot of things with these older boxes for a low cost. With the network module system they are extremely versatile. Most used network modules are cheap .. you can have serial interfaces (built-in terminal server for all your antiques, accessible from anywhere with an internet connection), T1, ISDN, ADSL, SDSL, Ethernet, Fastethernet, Gigabyte Ethernet (that one is expensive), modems, frame relay, maybe FDDI, telephony, twisted pair, optical, you name it. In a small installation you don't need a separate firewall - everything a PIX will do, IOS will do in the router. Faxes to an smtp server so those little mass-marketing jerks can't use up all your ink and paper. Internal 80 gigabyte transparent proxy server. The slow-ethernet adapters have AUI connectors as well, so you could run FatWire to the Indigos. Token Ring (never can tell, maybe you'll find an IBM you like some day.) Four-port ethernet switch, 16 port fast-ethernet managed switch. Want intercoms throughout the house ? Grab a few 7900-series phones for $30 each and away you go, call anywhere in the house. Hit 82, "Help ! the baby shit his diapers ! You better come up here and change him !" Grab an FXO module and connect the phones to the outside phone company. Hardware IPsec VPN. NTP, DNS, DHCP, all in the router. PoE. Vlans, of course. QoS. IOS is straightforward once you get used to it. (Admittedly the getting used to part is a bit of a hurdle in the beginning.) ACL's are not simple but hey, that's true anywhere :(

Converged, man. Converged :D

I didn't come to this conclusion as a fanboy - "Oh Cisco is so kewl d00d ! they're like so high-tech that we don't need like farmers no more man, we'll all be Knowledge Workers !" I hate Cisco. Their management is despicable. They cheat on taxes, they cheat the stockholders and society by lying about their books to "increase profits quarter over quarter", John Chambers and all his buddies should be in prison taking the big ten inch up the ass hourly. Put it up on an Internet video-sharing rich user experience channel. They are scum.

I was forced into it by failing soho stuff. Cisco routers work. *

Quote:
The RV180 doesn't have wireless, so I'd need an access point. Why oh why is a wireless N access point at least twice as expensive as a wireless router with similar (5GHz band, 300 or 450Mbit) capabilities :roll:

I get used 'junk'. Some of the 2800 series machines use network modules as well, I believe you can get them with wireless built-in and they aren't totally expensive on price ? But a few versions back is double-cheap. I have found that a little bit slower industrial-grade equipment is still faster than less-reliable soho stuff. But then again, our environmental situation is terrible (it is very hot and humid in summer, cold and dry and lots of static electricity in winter) so ymmv. But I will say that the Assistant is not averse to snivelling at slow network speeds. Complaints have been way down on the networking front since I went Cisco. And I get to surf for pr0n instead of rebooting the router :P



* This endorsement only applies to the ones I have bought. Mine are all kind of elderly, from back in the times when bad products meant the company failed. Due to "free market forces" and protection-racket legislation there are now two or three companies which control everything, zero choice and precious little quality control. Yippee.
what i meant by 'feedback' was worthless product bashing. because, you see, it doesn't help me at all. like most else here lately, it's a waste of my time to even read any of it.

_________________
:Skywriter:

DECUS Member 368596
skywriter wrote:
what i meant by 'feedback' was worthless product bashing. because, you see, it doesn't help me at all.

Hmm. Well, two people in this thread have owned ZyXEL products and would not recommend them in any way. Another person has the item you asked about and said it was okay but very slow. A fourth person whom I believe to be more electronically savvy than most of us discarded that device from consideration after checking out its reputation.

If that is worthless bashing, may I suggest that you look for a Circuit City flyer or a Ziff-Davis 'review' of the product in question ? That should be more helpful to you.
Hamei find different thread to practice your perverse form of communication will you? I'm not interested in dueling with you anymore.

_________________
:Skywriter:

DECUS Member 368596
* So I mentioned the Cisco RV180. I read a review on a Dutch site: wasn't much good. Bottom line: buy IOS based enterprise gear or top of the line consumer gear (Cisco/Linksys E4500 etc) but not this. Flesh nor fish, and had some nasty bugs. May or may not have been fixed over the last 12months, YMMV.

* Hamei mentioned the Cisco 3745 to me. http://www.trygve.com/no_duct_tape.html says:
Quote:
The 3745, on the other hand, sounds like you mounted an early model dustbuster on your server rack and kept it running 24/7. Besides being a whole lot quieter to begin with, the 2851 also has fan speed control and it's an option you can activate on the 3620s, but apparently there's no such provision on the 3745.

If you take a quick look at the fan tray assembly, you get an idea why--this little 3u router is cooled by four of the second-noisiest 92mm fans Delta Electronics makes. Each individual fan has a rated airflow of 54 qubic feet per minute, which theoretically should mean 216 cubic feet being pumped through a half-cubic-foot box every minute. That's a lot, especially considering that the entire machine only consumes 58 watts according to the Kill-a-Watt power meter I have it plugged into...thirteen of which is used to run the fans, if they are, in fact, using their rated .28 amps at 12 volts.

In addition to this, firmware updates (and this includes security fixes) require an active support contract. Fatal error, as far as I'm concerned.

So, in my case, either I'm going to go with a decent 'consumer' (integrated wireless blabla) router, or I'm going to slap together a real, dedicated router. See, there's one thing I didn't mention so far because a dedicated router simply never was something I considered: I still have an FDDI network segment. Right now I use my Linux server to route between FDDI and ethernet.

Energy isn't cheap here, so low power is crucial. A dedicated router would have to be some Atom platform, with a PCI slot (for the FDDI card). With 3x gig ethernet (WAN, LAN, DMZ).

Something like this:
chassis: http://www.morex.com.tw/products/produc ... ?fd_id=150
mainboard: http://ark.intel.com/products/56462/Int ... rd-D2500CC

I don't mind to spend some money on a 'real' solution but then it has to be good. I don't want to simply add another Linux server to the zoo and spend countless hours maintaining things that don't add any value.

_________________
Now this is a deep dark secret, so everybody keep it quiet :)
It turns out that when reset, the WD33C93 defaults to a SCSI ID of 0, and it was simpler to leave it that way... -- Dave Olson, in comp.sys.sgi

Currently in commercial service: Image :Onyx2: (2x) :O3x02L:
In the museum : almost every MIPS/IRIX system.
Wanted : GM1 board for Professional Series GT graphics (030-0076-003, 030-0076-004)
jan-jaap wrote:
*
I don't mind to spend some money on a 'real' solution but then it has to be good. I don't want to simply add another Linux server to the zoo and spend countless hours maintaining things that don't add any value.

Take a look at Vyatta Community Edition (assuming it's still going to be around now that Brocade bought them). It's Linux-based, but set up for routing/firewalls.

_________________
Damn the torpedoes, full speed ahead!

There are those who say I'm a bit of a curmudgeon. To them I reply: "GET OFF MY LAWN!"

:Indigo: :Octane: :Indigo2: :Indigo2IMP: :Indy: :PI: :O3x0: :ChallengeL: :O2000R: (single-CM)
I had a cisco wifi router; it was absolute garbage. Model wrt54g2 or something like that. It's only saving grace was it was $29 and when I moved out, I left it set up in the house I was at so others could use it... it did barely sneak by as a basic wifi hotspot and the land-lady was appreciative.

_________________
:Onyx: (Maradona) :Octane: (DavidVilla) A1186 (Xavi) d800 (Pique) d820 (Neymar)
A1370 (Messi) dp43tf (Puyol) A1387 (Abidal) A1408 (Guardiola)
guardian452 wrote:
I had a cisco wifi router; it was absolute garbage. Model wrt54g2 or something like that. It's only saving grace was it was $29 and when I moved out, I left it set up in the house I was at so others could use it... it did barely sneak by as a basic wifi hotspot and the land-lady was appreciative.


That's not a commercial-grade Cisco - that's Linksys. Sure, they're stamping "Cisco Linksys" on them now, but they aren't the same.

_________________
Damn the torpedoes, full speed ahead!

There are those who say I'm a bit of a curmudgeon. To them I reply: "GET OFF MY LAWN!"

:Indigo: :Octane: :Indigo2: :Indigo2IMP: :Indy: :PI: :O3x0: :ChallengeL: :O2000R: (single-CM)
SAQ wrote:
guardian452 wrote:
I had a cisco wifi router; it was absolute garbage. Model wrt54g2 or something like that. It's only saving grace was it was $29 and when I moved out, I left it set up in the house I was at so others could use it... it did barely sneak by as a basic wifi hotspot and the land-lady was appreciative.


That's not a commercial-grade Cisco - that's Linksys. Sure, they're stamping "Cisco Linksys" on them now, but they aren't the same.



One of those was the 'last straw' that caused me to sweep all the windows/Linux/multibrand gizmos and computers not the dumpster and replace everything with apple, and netgear. The netgear stuff has all worked flawlessly, the netgear RAID boxes are wonderful! And it all interoperates nicely. The only glitch has been the router/firewall FVS318's. Thier code is buggy, and the first one bricked during a code upgrade, and second one has started to hang every couple of weeks or days. I bought another one to swap out and the ZyXEL because the consumer network gear boards rate them fairly well, a little weak on throughput, depends on what your throughput IS of course, and the 390 page CLI manual, 160 page usermanual, is a far cry from a quick start guide and embedded help on management web pages that tells you what the button does.

Anyway, happy holidays kids.

_________________
:Skywriter:

DECUS Member 368596
skywriter wrote:
Hamei find different thread to practice your perverse form of communication will you? I'm not interested in dueling with you anymore.

Best to stay on the porch then, sky.

guardian452 wrote:
I had a cisco wifi router; it was absolute garbage. Model wrt54g2 or something like that.

Correction : you had a Linksys Linux-based piece of shit.

There is the problem with the "let's buy an el-cheapo brand so we can grow the business" philosophy. If your reputation is based on quality, then you try to infer that the low-priced crap is just as good as your good stuff, what happens is the opposite. A turd will remain a turd no matter how it's painted but now the good stuff is smeared with the turd's reputation.

Of course Chambers and three other people made a bundle when the stock got a boost because he was going to "grow the business" and all the Bloomberg tech writers gobbled up his shit like it was ham and cheese sandwiches ... that's what really counts in corporate-land. They teach it at Hahvud, gotta have a business degree to really understand why this is better for the US !

When Linksys was cheap stuff for people who only needed cheap stuff, that was okay. When they pretend to be butter not margarine, then they become liars and cheats.

Ain't "business decisions" a wonderful thing ?

jan-jaap wrote:
Hamei mentioned the Cisco 3745 to me. http://www.trygve.com/no_duct_tape.html says:
Quote:
The 3745, on the other hand, sounds like you mounted an early model dustbuster on your server rack and kept it running 24/7. Besides being a whole lot quieter to begin with, the 2851 also has fan speed control and it's an option you can activate on the 3620s, but apparently there's no such provision on the 3745

That's a pretty funny site, by the way. Been there in the past, did you notice his Origin 3200 ? The guy is kind of a trip :D

It does sound like the 3745 is noisier than the 3640. 2800 is also an option, quieter but more money. Not as many slots for network modules tho. The FDDI thing is something of a hurdle.

But ya know, it was only a suggestion. I have been happy as a clam with my Cisco experience. Sure, they aren't perfect but there's lots of good things about real routers. When they say "converged" they mean it - there's lots of advantages for small operations in putting everything into a single box. And dependability ... there's a reason that the first thing an ISP's tech support says is "reboot your router." (With the Cisco I refuse. I always tell them I did but never do. It's not the Cisco's fault. Ever.) If i look harder I could find the uptime record of a year and a half and even that was only cutoff because I had to move the rack. That ain't no boolsheet, grandma.

There really is a reason that many companies choose to use Cisco. In theory a Linux "solution" could be as good or better. But in practice it doesn't seem to work out that way.

Quote:
In addition to this, firmware updates (and this includes security fixes) require an active support contract. Fatal error, as far as I'm concerned.

Well, 6.5.30 requires an active support contract as well ... < cough cough> :D

I'm not so sure that firmware updates are really a problem with this class of equipment anyway. If the firmware is right in the first place, you don't really need so many fixes, dui bu dui ?

Besides that, the free firmware updates for all classes of equipment seem to be going the way of the dodo anyhow :(

Quote:
So, in my case, either I'm going to go with a decent 'consumer' (integrated wireless blabla) router,

I wonder if there is one ?

Quote:
... or I'm going to slap together a real, dedicated router.

and be stuck with another half-assed wet dream ... it's not an easy problem to solve. What you want is something commercial-grade but at the size (and price, to some extent) of the consumer stuff. You're a prosumer, but there ain't no prosumer equipment :P

Quote:
I don't mind to spend some money on a 'real' solution but then it has to be good. I don't want to simply add another Linux server to the zoo and spend countless hours maintaining things that don't add any value.

Exactly. I have been happy with the 3600 Cisco but it's not for everyone. Just worth looking at seriously, that's all. A 3700 would be better but not very obtainable here. The 2800 is beyond what I am willing to spend, but closer to what you are talking about.

As far as consumer routers and switches, I've had nothing but bad luck here. Well, not exactly bad luck. They did the job they were intended to do for the price they cost. I'll say that the SMC I had lasted the longest and gave the least trouble. But it was built fifteen years ago, times change. I don't know about now. Maybe take a look there ...

p.s. ... feel free to discount what I think on this, I'd be the first to say I am not an IT Professional. But I inherited the job of keeping five or six small offices with a few people each spread all over China plus one shop with 400 people, twenty-five or thirty computers, and a manufacturing network of twenty machines, etc etc all running. It took Cisco to quell the "I can't go to the Internet ! help ! help ! the world is ending !" screaming.
Hamei it isn't even a little bit funny anymore.

_________________
:Skywriter:

DECUS Member 368596
skywriter wrote:
the netgear RAID boxes are wonderful!


Good to hear. I'd heard Synology was good, but it's nice to have multiple decent options.
Don't trust WD anymore, and a bit unsure about Iomega.

_________________
Damn the torpedoes, full speed ahead!

There are those who say I'm a bit of a curmudgeon. To them I reply: "GET OFF MY LAWN!"

:Indigo: :Octane: :Indigo2: :Indigo2IMP: :Indy: :PI: :O3x0: :ChallengeL: :O2000R: (single-CM)
SAQ the first RAID I bought was a on of the first four drive Iomega units that, while it had excellent performance and was very easy to use, has a poor drive replacement strategy; you had to bring it down and replace the drive while it was off. Once you turned it on again it spent 24 hours rebuilding. Often it would just hang after a day and I could never recover the data. Luckily by the time I ended to save the data, I had a second drive to mirror the data too. That drie was one of the old ReadyNAS four drive units. Pretty slow but definately better. After the Iomega barfed a couple of times, I bought a six drive ReadyNAS that has been chugging along for a couple of years now. Once in a while it will toss a drive, but rebuilding is fast and never fails. I have a 12TB RAID 6 config for storing my DVD and CD rips.

Another good RAID is the direct attach Drobos. I have a four drive RAID 5 SATA for A/V in the studio, and an eight drive RAID 6 iSCSI as a backed to a power Mac file server and time machine target for all the macs here.


Although the Iomega was a fairly good design at the time; their customer service on their self help website was very poor. Except a very few bits of info, all their responses to questions were "call the customer service line for help". It was maddening. The Netgear website had developers answering all kinds of questions. They nearly always followed up on every hard question.

The worse thing about Iomega was that I had somehow I failed to register the unit after I bought it and they wouldn't help me with it. Even after I identified myself, and the guy KNEW who I was! What good is notarity if you can't cash in on it...

_________________
:Skywriter:

DECUS Member 368596
jan-jaap wrote:
So, in my case, either I'm going to go with a decent 'consumer' (integrated wireless blabla) router, or I'm going to slap together a real, dedicated router. See, there's one thing I didn't mention so far because a dedicated router simply never was something I considered: I still have an FDDI network segment. Right now I use my Linux server to route between FDDI and ethernet.

Energy isn't cheap here, so low power is crucial. A dedicated router would have to be some Atom platform, with a PCI slot (for the FDDI card). With 3x gig ethernet (WAN, LAN, DMZ).


If it weren't for your >100Mbit requirement, I could recommend the Soekris net5501. It has a 32-bit PCI slot that could host an FDDI attachment (although my SK-NET card won't fit in the standard case). I know it's looking long in the tooth now, but most of the new Atom embedded boards do not have classic PCI and won't be able to host FDDI. The Soekris firmware is special in that it transforms PC BIOS calls to serial console operations, so almost any x86 operating system can be installed headless. The power consumption is 6W.

_________________
:PI: :O2: :Indigo2IMP: :Indigo2IMP: