In reply to a post by F00tS0re:

The Unify Pro 4/ Edgerouter-4 (basically the same kit with differently coloured case and firmware) should easily handle any FTTP connection from Openreach with the proviso you don't want QoS.

I run my 330/30 link at full speed with a USG3...

My installation has been going great the last week or so. Lots of Openreach activity, cabling and jointing apparently all done right up to the house then they hit a snag. The last duct to the house is blocked as it comes out of the ground.

This time it is me they need permission from so Permission to Dig form signed and returned. Hopefully not too much longer now.

In reply to a post by F00tS0re:

Having spent £12,500 on the FTTPoD and £3,000 ish on WiFi system scrimping on the router seems silly.

I use Mikrotik routers at home and in data centres, and like them a lot.

For your fairly complex FTTP use case, the 9-core CCR1009-7G-1C-1S+ would be way more than powerful enough, at about £350+VAT. There are desktop and rackmount variants, and it has a 10G port for a degree of future-proofing. Rackmount version is dual PSU; desktop version is fanless. I'd go for rackmount unless the router sits in an occupied area.

The ones I use in data centres are CCR1036-8G-2S+ with 36 cores. This doesn't even hit 2% CPU utilisation on a gigabit of traffic - although in that application I don't do any PPPoE or NAT - and I'm not using the two 10G ports yet. They are about £850+VAT, a bit more if you want 16G RAM. The slightly cheaper CCR1036-12G-4S drops the two 10G SFP+ ports in favour of four 1G SFP ports. Definitely overkill for your needs, but at least I can give a baseline on performance.

My home one is HeX PoE. This is much less powerful and I don't know yet if it's up to FTTP speeds. But it's great that the software platform is consistent from the smallest to the largest, and I like the integrated PoE. And it's incredibly cheap (around £60+VAT).

Mikrotik pluses: used by many service providers around the world; all features enabled with no extra licences to buy; frequent software updates, free updates for life; internally based on Linux; can manage using CLI or web or Windows client ("WinBox"); customer support actually answers E-mails.

Mikrotik minuses: some history of security flaws, mainly in the WinBox part - but these are quickly fixed. I'd keep WinBox turned off, firewall off the management ports, and remember to apply updates when they're available. There are so many features you might have difficulty finding your way around. The build quality is pretty lightweight - just a metal box with a PCB. The low-end models share CPU port bandwidth via a switch - see the block diagrams under "support and downloads" (e.g. HeX PoE)

The pfSense appliance should be fine too. I note that the XG7100 is only a 4-core Atom, but it does have 10G ports so presumably they believe it will work at that speed Or you could just use any old spare PC with two 1G NICs, and install the free version of pfSense, to get started and see if it does what you need.

Edited by candlerb (Wed 27-Feb-19 11:54:58)

In reply to a post by Jabes:

In reply to a post by F00tS0re:

The Unify Pro 4/ Edgerouter-4 (basically the same kit with differently coloured case and firmware) should easily handle any FTTP connection from Openreach with the proviso you don't want QoS.

I run my 330/30 link at full speed with a USG3...

Do you run QoS or IPS? I think those two features slow it down lot from what I have gathered. Without either then USG will go close to gigabit speeds from what I have seen.

Plus we have 80 guest devices on the holiday cottages and circa 80 devices of our own (phones, tablets, sonos, IoT stuff)

In reply to a post by candlerb:

There are so many features you might have difficulty finding your way around.

Thanks for the comprehensive post.

Just had a play with the MicroTik emulator. Blimey! I will have another play later but seems to have every feature I have heard of and 200 other pages of features I have never heard of. Getting it set-up right would be a challenge, with a significant learning curve. I guess with some time invested it will become logical and many tweaks may not be needed. But I am wary of leaving defaults without understanding what they are. The Dryatek came with Firewall off as standard. It's a router, surely firewall on, and turning it off is the advanced feature.

But as you say processor vs price they seem to be very competitive.

Hi

I'd recommend pfSense, either a self built box or their own products. The UI is clear and modern and lots of help available in their forums or from resources online.

As a router I've had it running 24/7 for a couple of years now and it never needs any attention, been rock solid and is only rebooted for updates. The diagnostic options are really good and easy to use, and those have helped me investigate and solve several issues with outside services.

Regards

Phil

In reply to a post by F00tS0re:

The Dryatek came with Firewall off as standard. It's a router, surely firewall on, and turning it off is the advanced feature.

A router just forwards packets. The Mikrotik ships as a router with no access rules by default, so defaults to 'permit everything', subject to NAT of course.

pfSense also ships with a default "allow everything from LAN", "NAT everything outbound on WAN" policy.

Hi

I think most routers with Firewalls allow outbound for anything by default, that is pretty standard as it would be an onerous task to set up rules for all the sorts of connections likely from inside the network wanting to go outside to the Internet, unless a company is just allowing a few ports 80/443 for the web for example.

However the Firewall is still operating even with an outbound allowed rule for everything as it allows the traffic out to anywhere but will make a note of what has gone out (state table), so that the only data allowed to flow back in is the reply to an outbound request, and not something unsolicited.

The Draytek firewall off as standard might simply be that it's operating as above and allowing outbound traffic but blocking unsolicited incoming traffic, I'm not sure, been a while since I've used a Draytek.

If a Firewall is really completely off, then any unsolicited traffic is routed to the internal network, however NAT generally means that nothing on the local network has a routeable IP address so can't be reached, and so NAT has always behaved a bit like a Firewall, this all changes with IPv6 where no NAT is required and all devices will be exposed on the Internet without any Firewall in place.

So the typical setup for a Firewall is simply to allow all outbound, and drop all inbound traffic. Inbound traffic though is unsolicited traffic hitting the router. Any traffic in response to an outbound request, i.e. to retrieve a web page is allowed back in.

Regards

Phil

Edited by deleted (Wed 27-Feb-19 11:47:42)

In reply to a post by PhilipD:

So the typical setup for a Firewall is simply to allow all outbound, and drop all inbound traffic. Inbound traffic though is unsolicited traffic hitting the router. Any traffic in response to an outbound request, i.e. to retrieve a web page is allowed back in.

Plus: there is this common misconception that if you enable a button called "firewall", suddenly you are secure. This could not be further from the truth.

These days, there are two main ways you get infected over the network: by clicking on malicious links in web pages, and by opening malicious attachments in E-mails.

In both cases, your client has made an *outbound* connection to fetch the item. And usually that connection is encrypted - HTTPS for web pages, IMAPS for E-mail. So even a firewall with an IDS won't be able to scan the content.

Some enterprise firewalls act as "man-in-the-middle", decrypting HTTPS traffic and generating fake certificates with their own key. That breaks the whole end-to-end security model of TLS.

The moral is: don't believe anyone (especially firewall vendors!) who say that a firewall makes you secure.

A firewall is just a policy tool: I want to allow X to connect to Y but not Z. It's still useful - e.g. you might not want people in holiday cottage 1 to attempt to connect to devices in holiday cottage 2. But in terms of security: you need to ensure your endpoint security is up-to-date (e.g. local antivirus), and ideally you'd have some way to *detect* when a device has been compromised, because this is going to happen sooner or later.

This is where an IDS can come in useful - it may be able to detect traffic patterns generated by known worms and viruses, after the infection has taken place. You can install snort in pfSense, but beware that you'll get a bunch of false alarms and will have to spend some energy tuning it for your environment.

In reply to a post by candlerb:

In reply to a post by PhilipD:

So the typical setup for a Firewall is simply to allow all outbound, and drop all inbound traffic. Inbound traffic though is unsolicited traffic hitting the router. Any traffic in response to an outbound request, i.e. to retrieve a web page is allowed back in.

Plus: there is this common misconception that if you enable a button called "firewall", suddenly you are secure. This could not be further from the truth.

These days, there are two main ways you get infected over the network: by clicking on malicious links in web pages, and by opening malicious attachments in E-mails.

In both cases, your client has made an *outbound* connection to fetch the item. And usually that connection is encrypted - HTTPS for web pages, IMAPS for E-mail. So even a firewall with an IDS won't be able to scan the content.

Some enterprise firewalls act as "man-in-the-middle", decrypting HTTPS traffic and generating fake certificates with their own key. That breaks the whole end-to-end security model of TLS.

The moral is: don't believe anyone (especially firewall vendors!) who say that a firewall makes you secure.

A firewall is just a policy tool: I want to allow X to connect to Y but not Z. It's still useful - e.g. you might not want people in holiday cottage 1 to attempt to connect to devices in holiday cottage 2. But in terms of security: you need to ensure your endpoint security is up-to-date (e.g. local antivirus), and ideally you'd have some way to *detect* when a device has been compromised, because this is going to happen sooner or later.

This is where an IDS can come in useful - it may be able to detect traffic patterns generated by known worms and viruses, after the infection has taken place. You can install snort in pfSense, but beware that you'll get a bunch of false alarms and will have to spend some energy tuning it for your environment.

Agreed, I have never known an infection through a firewall but have know infections from email, web links, and attacks through internal hardware (CCTV). None caused by me, but one was caused by the MD at the time, but agree it is statistically likely to happen at some point.
I use VLANs to split off Network Equipment, Guests (with device isolation), IoT devices (with device isolation), and our personal devices+Sonos, I am tempted to isolate the kids on their own network but Sonos created a bit of a barrier. All of my kit is patched to latest versions, and anti-virus running on phones & laptops.

And I have to understand all this just to provide a free Wi-Fi service!
Cheers
Dave