Slashdot Mirror

Go on ebay and look for Cisco routers with FE ports, you can find them for a few hundred dollars.

You might be able to find some Cisco routers that have FE ports for cheap, but they can't route packets anywhere near the 100Mbps speed. I got a 3620 with a NM-2FE2W module for my 20Mbps fiber connection, and the thing can barely do 15Mbps. I ended up using m0n0wall on a spare machine that can route MUCH faster than 20Mbps I currently need. I love Cisco equipment, it has great features, and very reliable, but for the performance you get with the low end stuff, the price is a joke. The 1800/2800 routers have better performance, but with all the software features they can get really expensive. Check out this document for some realistic routing performance.

You only need machines with 32-48 MB system memory for LTSP, machines with 4-8 MB are a bit stuck although they could be purposed with SVGALIB VNCviewer or SVGALIB rdesktop. It should be possible to acquire suitable machines for under $100 used, or $150 new.

To minimize the hardware needed and improve administration you might want to try running Edubuntu (a Linux terminal server specialised for education) diskless, and use a directory to store all account information in. There is a directory server project dedicated for small Linux terminal server environments to act as a boot manager for LTSP clients and servers, and account store for users. Team this up with m0n0wall and FreeNAS and you have a complete solution.

What's so new about this? http://smoothwall.org/, http://ipcop.org/ and http://m0n0.ch/wall/ could easily be custimized to perform a similar function. Easy as installing a bittorrent application, and using SSH.

By the way, these 3 options happen to be free and upgradable.

Humf. I have a third gen WAP-54G (I believe SveaSoft & co. only work for gen1 and gen2) and bricked it repeatedly before figuring this out. I originally bought the thing because I don't (or want) a wireless router--the WAP is hanging off the third interface of my PCEngines WRAP running M0n0wall.

That thing is a bit more expensive than the WRT, but M0n0 is such an awesome firewall distro that it's worth it.

Where's the difference between this box and a linuxbox with samba/nfs/fstab properly configured?

The interface for this is easy to use? I haven't checked this out yet, but the interface looks identical to the one for m0n0wall, and it would be cool if it is as easy to configure as m0n0wall is. Maybe it is made by the same people, I don't know. I haven't used it yet, but I think that it is worth checking out, unless of course you need a smaller or more power efficient device.

I setup an IBM x300 server and m0n0wall as my router and it has worked fantastically. It supports IPSec tunnels, as well as PPTP connections. I have two IPSec tunnels to remote sites which both have PIX routers (501 and 506E), as well as connections from remote PPTP clients which is easy to setup and I have never had any problems. Highly recommended for anyone looking for both a simple and powerful solution.

We use m0n0wall (http://www.m0n0.ch/wall) for this exact thing...it supports a number of different hardware platforms, including PC, but my favorite is the pcengines WRAP boards (pictured in silver with antennas here)

http://img.m0n0.ch/gallery/brandon_kahler/01_19_06 _WRAP_Wireless_DSL_Large_Text.jpg

They run off of compact flash and the WRAP boards + case are ~$200. They will act as your NAT firewall behind the commodity broadband interface (dsl/cable) and have a great number of features, including a captive portal if you want to allow customers to use the wireless network.

pfsense is based on m0n0, but not meant for the embedded platforms

We use m0n0wall (http://www.m0n0.ch/wall) for this exact thing...it supports a number of different hardware platforms, including PC, but my favorite is the pcengines WRAP boards (pictured in silver with antennas here)

http://img.m0n0.ch/gallery/brandon_kahler/01_19_06 _WRAP_Wireless_DSL_Large_Text.jpg

They run off of compact flash and the WRAP boards + case are ~$200. They will act as your NAT firewall behind the commodity broadband interface (dsl/cable) and have a great number of features, including a captive portal if you want to allow customers to use the wireless network.

pfsense is based on m0n0, but not meant for the embedded platforms

m0n0wall http://m0n0.ch/wall/
Ubuntu www.ubuntu.com
QEMU
Most codecs...
ebay (for the JDM car parts, Yo!)
The Reg www.theregister.co.uk
5fm www.5fm.co.za (uncensored music and cool accents...)
I can't say NO loud enough.

...though the Linux stuff can be a bit harder to configure at first.

Not to say I don't like Linux (or BSD.. I use m0n0wall), but I think that is the point of why people won't use it in those critical environments.. atleast for now. Throughput of many Cisco platforms (low end to mid range) is shit compared to what a PC with a couple NICs can do, but the features Cisco products have blows anything you get from Linux/BSD/etc out of the water.

complete control over source code and ability to patch in/pay for patches of missing features or support for other protocols.

This really means nothing to a company unless they are going to take the features that Linux supports and incorporate it into a product that they sell. Most companies don't care about whether the source is available, they just want something that will support their infrastructure.

It would be great to see a BSD/Linux based product that incorporates all those features (IPSec, BGP, OSPF, Frame Relay, etc, etc, etc) into ONE package, that doesn't require you to go out and configure and download 10 seperate programs. I know I already mentioned it, but a perfect place to start would be a product such as m0n0wall. It lacks MANY of the features I am talking about, but it is a good example of a product that keeps the transparency of the OS from the user - whether that might be command-line or web-based. Just a few ideas. Anyways, I would like to see the day when some commercial Linux offering can compete with Cisco, but it isn't there yet.

I have a Cisco 3620 router, maxed out on RAM, that couldn't even keep up with my fiber internet connection. I know it is an older router, but even with a NM-2FE2W (100Mbps) network module, it could barely do over 10Mbps. The performance specs on Cisco's site says 10-20Mbps, and with IP inspection and access lists enabled, it could maybe do 13Mbps at the most. I decided to buy an IBM x300 eSeries on eBay for $250 and run m0n0wall on it. Sure as hell beats the performance of any Cisco product for that price, and also can support much higher speeds for when my fiber service gets even quicker :) It might not have all of the features of Cisco (which I majorly miss), but I like to be able to use the speed of my connection I am paying for.

Yeah, BSD licenses sure have killed a lot of projects.
That's just five minutes of searching for BSD licensed projects, I didn't look for MIT licensed projects.

You get what you pay for.

Pay a bit more for high-speed DSL. At our end of the DSL line, we have 6Mbps down, 600kbps up, and latency generally isn't an issue. We have a traffic-shaping firewall (m0n0wall), with rules to give TCP ACKs, small packets, etc., higher priority), which really helps to maintain household serenity (no one can hog the DSL line).

Sample ping times that I see: 1-2ms from my PC to our firewall, ~19ms to the box at the other end of the DSL line, and ~24ms to my ISP's shell server.

How can there be no mention yet of monowall? Its an excellent tool for simple reliable firewalling. We're running it off an old P2 class machine. The system software is on CD with our config file on a floppy. Its been completely reliable for going on a year and even this old machine happily keeps our T1 maxed out without blinking an eye. We actually replaced a failing WatchGuard box ($$) with monowall, increasing the feature set at near zero cost. The actaul hardware is a retired desktop (free) and we just added 3 PCI NICs (~$20 each). Eventually, we'll probably buy a rackmount system built for monowall, but even that only runs $500-$800.

I'll throw out my recommendation for m0n0wall. It's a livecd-based firewall package which is based on FreeBSD. Boot off of the CD, and config is held on a floppy, flash drive, etc. It has all the benefits of the FreeBSD network stack w/ the addition of a very robust web administration page. It's a snap to set up, and given decent hardware (fairly recent PC, Intel NICs, half-gig of RAM, etc), it'll outperform Symantec's offerring by several orders of magnitude, both in terms of feature set and network throughput.

In shine runners, you're competing to pick up shines (from Mario Sunshine). You can knock shines loose from other players with shells, etc. Every 20 seconds or so, whoever has the fewest shines gets dropped off until one person is left.

Unfortunately, neither of those modes are available online.

I was disappointed when I saw that shine runners wasn't available via WiFi. And I was also wondering if it would be something that might be added to the WiFi network at a later date? The main racing game is tons of fun, but I really like shine runners as well.

Also, I have a non mainstream Wireless Access Point and I had no problem getting online with Mario Kart DS. My WAP is a Soekris net4801 running m0n0wall.

Can't wait for Metroid Prime: Hunters!

I can't wait for this to hit m0n0wall's stable release. 6.0's unstable branch was used on the beta for a while, but was then pulled. I need it for wireless so I can eliminate another embedded system, consolidating my network further. (and create a single point of failure ;)

I'd highly recommend you check out m0n0wall. It's a BSD-based router distro. M0n0 comes in several forms, a hard drive image, a compact flash image, and a bootable cd. I use the bootable cd. The entire thing runs from a RAM disk, storing configuration on a floppy disk. All administration is done from a very robust and feature-complete web interface. You can make m0n0 as simple or complex as you wish - it includes traffic shaping, wireless support, PPTP & IPsec VPN support, multiple interfaces, a captive proxy, etc.

The captive proxy support would be especially useful for you - from the web interface, you can remotely add/delete/change the usernames and passwords for the captive proxy.

Yes - there are other captive proxy projects out there (NoCatAuth etc.). I evaluated several of them, but ended up sticking with m0n0wall due to the ease of implementation and the foolproof architecture it has.

Is it? Remarkably bad performance for a linux box. I was thinking of this linux distro for linksys routers. Maybe it's the hardware. /shrug

It's still no substitute for a real firewall IMO.

IpCop
Smoothwall
m0n0wall

I've played with perhaps a dozen little firewall distros like these and I'd prefer any of them to the default linksys setup. These three are my favorites for features, power, ease of use, speed, and tinkering ability. m0n0wall isn't easy to tinker with, but runs quite well from a 6MB ISO image and strikes me as pretty unhackable. Maybe someone should hack that onto the linksys.

You could give m0n0wall a shot, as it's a very nice, lean NAT/firewall package based on FreeBSD.

Ditto the postfix bit. I have used it for several small companies, and it runs beautifully. Spam filtering (blacklists, spamassassin, greylisting) works nicely, you can easily view statistics via munin or something similar, and there are a ton of log analysis scripts and proggies out there.

My preferred combo is FreeBSD + Postfix with TLS/SMTP (for "outside" clients) + Dovecot secure imap + OpenSSL + Openwebmail. If you absofuckinglutely must, you can drop this setup in a DMZ or third interface of a PCEngines WRAP box running M0n0wall and have it talk to an exchange server in your "inside" network. That way the monkeys can use MAPI, although you'll probably run into problems with different mail spools and all that.

For added fun, some decent PHP-based groupware like PHProjekt or PHPGroupware is a nice touch.

As for redundancy, do nightly incrementals, use a decent RAID-5 controller (adaptec 2810SA or equivalent) with hot standby and don't forget to use hard drives from different lots, and maybe mirror your drives to another box if you're paranoid (I've never needed to do this but if you're really worried you can do RAID-10. Also don't forget to have a secondary MX that will actually deliver mail (can be a backup hot standby mail server that's just a mirror image of your primary) and a tertiary MX that just queues mail until you're up and running again.

I'm assuming, of course, that you're willing to do this in-house. Get good support contracts (despite what people say, I've had good experiences with Dell) and hardware warranties, make a complete backup of your system once you've installed it and before putting it online.

To conclude, I have absolutely no problem whatsoever with an entirely homebuilt freeware-based solution, assuming you have (a) good backups, (b) redundancy as described above, and (c) hardware support contracts from your vendors. That's the only thing I would not ever skimp on.

I highly recommend m0n0wall as well. It satisfies all of my firewall needs. I'm running it on a box that I found lying near a trash bin. 400Mhz AMD K6III, 64MB of RAM, CD-ROM, 1.44MB floppy, and a 200 watt power supply. Take a look at http://www.m0n0.ch/wall/ for more info. It also has a nice webGUI that can be accessed from a connected computer. Take a look at these installation instructions first. http://www.m0n0.ch/wall/installation_cdrom.php

I highly recommend m0n0wall as well. It satisfies all of my firewall needs. I'm running it on a box that I found lying near a trash bin. 400Mhz AMD K6III, 64MB of RAM, CD-ROM, 1.44MB floppy, and a 200 watt power supply. Take a look at http://www.m0n0.ch/wall/ for more info. It also has a nice webGUI that can be accessed from a connected computer. Take a look at these installation instructions first. http://www.m0n0.ch/wall/installation_cdrom.php

What about M0n0wall?

You don't need to use a full blown PC and consume heaps of power.

I bought a Soekris net4801 close to 2 years ago now specifically to run m0n0wall on. Best computer decision I ever made. The power consumption is somewhere around 20W.

On my 1526/256kbps connection it works an absolute treat. I have 1 machine that is used solely to play games. All traffic from this machine is fed into a seperate queue from the rest of the LAN. Downloading at 140K whilst playing Battlefield 1942 with no lag is a blast and I never have to give a thought as to what might be downloading (or uploading) on the network. Prior to using m0n0wall and despite my best attempts with Smoothwall, CC and Mandrake with some scripts - the best I could do was around 60KB/s download before lag became an issue.

After seeing my setup a mate didn't want to fork over the cash for a net4801 but wanted to do the same thing. He uses a fanless 486 with 8MB RAM which boots from a CDROM and loads the config from the FDD. Once the machine boots the only moving part is the PSU fan. That's about the 2nd lowest amount of power you could consume for this kind of set up. Images for the net4801/4501, CDROM, WRAP boards etc are all available from the m0n0wall website. Battlefield 1942 for example needs 4 rules. 3 outgoing and 1 incoming.

If you want to route specific gaming traffic from your PC, just start the game, ALT+TAB and run netstat -a to find out what is going where. For Windows users, I found TinyPersonalFirewall v2 to be very helpful. It will show you specifically which apps are using which protocal and to which port is came from and/or is going to.

As a bonus, m0n0wall supports a bunch of wifi cards, VPNing, SNMP, Captive Portals, DMZs and multiple NICS. My net4801 for example has 3 onboard ethernet interfaces (modem, lan & dmz for web server), 2 addon ethernet ports. 1 for my local wifi lan & 1 for an AP on the roof to a local mesh network. Both use VPN. To help with this it also has a TypeIII Mini-PCI hardware accelerator to offload work from the CPU for VPN encryption. Best free router OS ever!

There's a really excellent general email list for users of m0n0wall. As a subscriber I've seen quite a few users with problems like yours get very quick responses that solve their problems. And it almost never turns out to be a software bug, though sometimes one might fault inadequately clear and comprehensive documentation. -S.

I am surprised nobody has mentioned m0n0wall. It is based on Free BSD, and seems pretty cool.

http://www.m0n0.ch/wall

Alas, I have no good suggestions for a cheap firewall router.

A cheap PC running m0n0wall would work very well. When I got a DSL installed, I took a spare PC and set up m0n0 to act as the router/firewall and it has been simple and solid.

" Although I admit, FreeBSD is a bit of work to get the firewall turned on."

Have you looked at this "easy-to-use" FreeBSD firewall solution?

m0n0wall http://www.m0n0.ch/wall/ and an old 486

m0n0wall is a stripped down (6MB) version of FreeBSD design to run on embedded systems.

It will run on the following hardware:
*Soekris Engineering net45xx/net48xx boards.
*PC Engines WRAP board.
*Generic PC with a CompactFlash (ATA), IDE, or Zip Drive.
*Generic PC with a CD-ROM (bootable) + Floppy.
*VMware.

It supports more then 4 network interface cards, including wireless cards.

Its main features are:
* well designed web based admin interface (supports SSL)
* serial console and VGA interface for setup and recovery
* captive portal
* 802.1Q VLAN support
* stateful packet filtering
* NAT/PAT (including 1:1)
* DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
* IPsec VPN OpenVPN tunnels (IKE; with support for hardware crypto cards and mobile clients)
* PPTP VPN (with RADIUS server support)
* static routes
* DHCP server
* caching DNS forwarder
* DynDNS client
* DMZ * SNMP agent / syslog
* traffic shaper
* firmware upgrade through the web browser
* and many other features

Main website:
http://www.m0n0.ch/wall/

Download links:
http://www.m0n0.ch/wall/downloads.php
http://www.m0n0.ch/wall/beta.php

Install help:
http://www.m0n0.ch/wall/installation.php
http://www.m0n0.ch/wall/physdiskwrite.php

m0n0wall is a stripped down (6MB) version of FreeBSD design to run on embedded systems.

It will run on the following hardware:
*Soekris Engineering net45xx/net48xx boards.
*PC Engines WRAP board.
*Generic PC with a CompactFlash (ATA), IDE, or Zip Drive.
*Generic PC with a CD-ROM (bootable) + Floppy.
*VMware.

It supports more then 4 network interface cards, including wireless cards.

Its main features are:
* well designed web based admin interface (supports SSL)
* serial console and VGA interface for setup and recovery
* captive portal
* 802.1Q VLAN support
* stateful packet filtering
* NAT/PAT (including 1:1)
* DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
* IPsec VPN OpenVPN tunnels (IKE; with support for hardware crypto cards and mobile clients)
* PPTP VPN (with RADIUS server support)
* static routes
* DHCP server
* caching DNS forwarder
* DynDNS client
* DMZ * SNMP agent / syslog
* traffic shaper
* firmware upgrade through the web browser
* and many other features

Main website:
http://www.m0n0.ch/wall/

Download links:
http://www.m0n0.ch/wall/downloads.php
http://www.m0n0.ch/wall/beta.php

Install help:
http://www.m0n0.ch/wall/installation.php
http://www.m0n0.ch/wall/physdiskwrite.php

m0n0wall is a stripped down (6MB) version of FreeBSD design to run on embedded systems.

It will run on the following hardware:
*Soekris Engineering net45xx/net48xx boards.
*PC Engines WRAP board.
*Generic PC with a CompactFlash (ATA), IDE, or Zip Drive.
*Generic PC with a CD-ROM (bootable) + Floppy.
*VMware.

It supports more then 4 network interface cards, including wireless cards.

Its main features are:
* well designed web based admin interface (supports SSL)
* serial console and VGA interface for setup and recovery
* captive portal
* 802.1Q VLAN support
* stateful packet filtering
* NAT/PAT (including 1:1)
* DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
* IPsec VPN OpenVPN tunnels (IKE; with support for hardware crypto cards and mobile clients)
* PPTP VPN (with RADIUS server support)
* static routes
* DHCP server
* caching DNS forwarder
* DynDNS client
* DMZ * SNMP agent / syslog
* traffic shaper
* firmware upgrade through the web browser
* and many other features

Main website:
http://www.m0n0.ch/wall/

Download links:
http://www.m0n0.ch/wall/downloads.php
http://www.m0n0.ch/wall/beta.php

Install help:
http://www.m0n0.ch/wall/installation.php
http://www.m0n0.ch/wall/physdiskwrite.php

m0n0wall is a stripped down (6MB) version of FreeBSD design to run on embedded systems.

It will run on the following hardware:
*Soekris Engineering net45xx/net48xx boards.
*PC Engines WRAP board.
*Generic PC with a CompactFlash (ATA), IDE, or Zip Drive.
*Generic PC with a CD-ROM (bootable) + Floppy.
*VMware.

It supports more then 4 network interface cards, including wireless cards.

Its main features are:
* well designed web based admin interface (supports SSL)
* serial console and VGA interface for setup and recovery
* captive portal
* 802.1Q VLAN support
* stateful packet filtering
* NAT/PAT (including 1:1)
* DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
* IPsec VPN OpenVPN tunnels (IKE; with support for hardware crypto cards and mobile clients)
* PPTP VPN (with RADIUS server support)
* static routes
* DHCP server
* caching DNS forwarder
* DynDNS client
* DMZ * SNMP agent / syslog
* traffic shaper
* firmware upgrade through the web browser
* and many other features

Main website:
http://www.m0n0.ch/wall/

Download links:
http://www.m0n0.ch/wall/downloads.php
http://www.m0n0.ch/wall/beta.php

Install help:
http://www.m0n0.ch/wall/installation.php
http://www.m0n0.ch/wall/physdiskwrite.php

m0n0wall is a stripped down (6MB) version of FreeBSD design to run on embedded systems.

It will run on the following hardware:
*Soekris Engineering net45xx/net48xx boards.
*PC Engines WRAP board.
*Generic PC with a CompactFlash (ATA), IDE, or Zip Drive.
*Generic PC with a CD-ROM (bootable) + Floppy.
*VMware.

It supports more then 4 network interface cards, including wireless cards.

Its main features are:
* well designed web based admin interface (supports SSL)
* serial console and VGA interface for setup and recovery
* captive portal
* 802.1Q VLAN support
* stateful packet filtering
* NAT/PAT (including 1:1)
* DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
* IPsec VPN OpenVPN tunnels (IKE; with support for hardware crypto cards and mobile clients)
* PPTP VPN (with RADIUS server support)
* static routes
* DHCP server
* caching DNS forwarder
* DynDNS client
* DMZ * SNMP agent / syslog
* traffic shaper
* firmware upgrade through the web browser
* and many other features

Main website:
http://www.m0n0.ch/wall/

Download links:
http://www.m0n0.ch/wall/downloads.php
http://www.m0n0.ch/wall/beta.php

Install help:
http://www.m0n0.ch/wall/installation.php
http://www.m0n0.ch/wall/physdiskwrite.php

Prior to that I used ipnat & ipfilter and I can't say I've had any loss of functionality.

Or there is always Monowall.
It is based on *BSD and the most important feature
is that it is the only stand alone firewall
that also can use a wireless card as an AP.

http://www.m0n0.ch/wall/

Easy to configure, can run on low end hard ware, I've set it with a P75, 128mb ram, 1gb hard disk, 2 ethernet cards. Run two school labs off it at university. It's based off of FreeBSD. Check it out for yourself: http://www.m0n0.ch/wall/

You should check out m0n0wall

All you need is an old pc with 2 network cards, a cd-rom drive, and a floppy drive.

After initial ip assignment, you use the web interface to configure everything.

Okay under $100. It's free
It has a nice php interface.
It is very tiny in size.
And you can run it just off the CD if you want to.
It's based on FreeBSD
http://www.m0n0.ch/wall/

http://www.m0n0.ch/wall/index.php

Well, you should definitely check out m0n0wall at http://www.m0n0.ch/wall/!! Based on FreeBSD, configured with a webserver and PHP and stores its complete configuration in a single XML-file. Very nice indeed.

Why not m0n0wall? It works very well.
Right now I'm testing pfSense as it uses pf. pfSense is still aplpha code, but the critical parts work very well.
Check them out:
http://m0n0.ch/wall/
http://www.pfsense.com/

http://m0n0.ch/wall

FreeBSD based and runs from a CD and a floppy so you don't even have a hard drive to worry about. I think it's the best of the bunch out there other than for pay vendor items (PIX, IronPort, etc.)

This is my personal favorite as well. I used to use Smoothwall, which is not a bad choice, but from what I can tell, m0n0wall is more secure, and takes a lower powered machine to operate. I'd give it a try. Get it from http://m0n0.ch/wall It's got a nice user base, post to the mailing list if you need help.

OpenBSD is great if one can afford dedicated hardware. I actually find m0n0wall (based on FreeBSD) to be a great solution myself.

However, it sounds like this particular admin can't afford a hardware solution. In this case, I would hope that Sygate Free would be pushed for PCs that are the property of students. Again, it is free for personal use.

Unfortunately, it doesn't sound like a firewall will solve the problem as it looks more like a user-education issue. If a user is downloading zombie software, then it will likely disable or open ports necessary to operate. In this circumstance, I'd do a comprehensive sniffing of network traffic and possibly lock things down at the router/switch level. This sounds Evil but sometimes it is the only way to deal with uneducated users. Perhaps an automated system could be developed for savvy users to unblock ports on an as-needed basis.

Pull an old pentium box out of one of the skips at the university (in my day they were always ripe with 386s) and stick one of the million linux firewall distros on, or my personal favourite m0n0wall, which is FreeBSD based.

http://m0n0.ch/wall/

Your question is chillingly basic however. I'm a programmer rather than a sysadmin, and even I can select and set up a firewall without having to ask slashdot.

Perhaps you should request some training for yourself and the sysadmins in Liberal arts. Seriously, this would be a good first step to securing your network.

http://www.astaro.com/
http://www.m0n0.ch/wall/
http://www.clarkconnect.org/

those few and some unused hardware will get you going.

Worse case use monowall.. it is free and runs linux

try FreeBSD there sparky:
m0n0wall is based on a bare-bones version of FreeBSD, along with a web server, PHP and a few other utilities.

Or even easier to install: m0n0wall