Looking for an easy way to extend that broadband connection to more of your organisation's PCs? One of these broadband routers could be the solution.

The increase in availability of broadband connections, combined with the greater amount of data that can be moved through this larger connection has seen an explosion in the use of broadband routers as people find they can connect multiple computers at a site and use the one connection to the rest of the world (be it the Internet or their internal network).

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

Sharing a broadband (or even a modem) connection between multiple computers can be achieved in many ways:

1. Using an existing computer. Using a PC that is already connected to broadband connection, you can add “connection sharing” software to make it become a router. The advantages of this approach are that it´s the cheapest and is not too difficult to set up. The main disadvantage is that the computer that is acting as the router must remain switched on in order for the other computers to access the Internet.
2. Adding a low-cost PC as a router. You can take an old 486 or Pentium, install software to turn it into a router, hide it in a corner somewhere and forget about it. You can install Windows, Linux, whatever you like on this “router”. This is basically the same as the first option, but costs slightly more (for the old computer, and for the extra electricity). Its advantage over the first option is that each of the workstations can connect to the Internet without needing any of the other equipment to be switched on. This avoids problems such as when the connection sharing router needs to be rebooted (or crashes) while a workstation is in the middle of a long download. There is also the additional benefit that you can use this machine as a file server as well, and your files can be centrally located.
3. Buying a hardware router. This is a special piece of hardware that can connect to the broadband modem and then share that connection (route) with other computers at the location. It comes with a built-in switch, so all you need to buy in addition to the hardware router are some cables. The advantages here are that it´s easy to set up, each computer can connect independently of one another and it uses less power than having a computer running all the time. The main disadvantage compared to the other two options is the cost. Even though hardware routers have come way down in price, they still cost more than a $50 486.

The best option depends on your situation and priorities. Prices increase with each option, but so does reliability. Ease of setup is probably greatest in the third option. Many home users and even some small businesses select option 1 or 2 but recently hardware routers have significantly increased in functionality and dropped in price so many people are heading in this direction.

Some of these devices are designed for the home users, where there might be two to three computers in the house, and for home offices that often have multiple computers and a need for more bandwidth. However, they are also seeing use in larger businesses, where they are used to connect up a small branch office with a better connection and a smaller price tag than installing an ISDN service.

There is more to being a good broadband router than just passing the packets backward and forward to the workstations. It is very useful if the interface you use to configure the router is friendly, helpful and easy to use. The manual may be very important, especially if the person setting up the unit is not a technical expert. Even small things like the type of power connector is important. Bulky plug packs are annoying, as they do not fit with anything else in a powerboard, and if you need to plug them into a UPS, you often need to buy a special cable to connect it.

There are a number of other benefits that routers provide:
• They provide a variety of security-related features that are available on many of the routers.
• In a business, it is often preferable to be able to manage a variety of devices centrally, so that each branch does not require a specialist. The remote management functionality of many of these units would allow one IT department to manage all the remote connections.
• If you have a printer server you can plug a printer directly into the router and share it amongst the local users.
• Some routers have manual failover to a modem so that if the Cable/DSL connection is broken, the link can stay up.
All the units tested include a DHCP server that will allow the user to plug the unit in, set their workstation for DHCP, and then boot and connect to the router via a Web browser to configure it.

Belkin 4 Port Cable/DSL Gateway Router

All the ports on the Belkin are on the rear of the device, with all the LEDs on the front. There is no power switch, but the unit does have a reset button on the rear. Setup of the unit is quite simple, with a five-step setup process that covers all the basics. The interface is somewhat difficult to manage, with just about everything in the Initial Setup menu, but the Status page in particular is very clear and concise. There is support for a

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

single DMZ, up to 10 virtual servers (port forwarding) and remote management from either one IP or all IPs. There is an option to block access to the Internet at various times, and through various ports.

The help page is fairly minimal, though it does include quite an effective glossary of terms. The manual is considerably more helpful, as are the two quick setup guides—one generic one, and one specifically for the Mac.

Product:	Belkin 4 Port Cable/DSL Gateway Router
Interoperability:
Futureproofing:
ROI:	½
Service:
Rating:	½

Linksys Etherfast Cable/DSL Router Family

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

All the devices follow the Linksys standard of a two-tone black and purple design, and even have a standard footprint across most of the product range. This means you can very easily stack a series of products in a totally stable manner. All the ports are located on the rear of the devices, with the LEDs on the front panel. The wireless router has a pair of antennae that project from the rear of the unit and will swivel and point in just about any direction.
The configuration pages are very easy to use and provide a single-page setup, as well as several other pages for more detailed configuration. All the Linksys routers come with the option to log all incoming and outgoing connectiosn and send it to another system, which is useful to keep track of users/staff. The help system built in to the unit is excellent with good explanation of all the functions and how to use them. The manuals are also excellent, with some of them running up to 80+ pages and including useful incidental information like how to make up a straight-through or crossover Ethernet cable and an extensive glossary.

All systems include access control and filters, port forwarding with a list of common ports, log management, DMZ, remote management, remote upgrade, and support for DDNS. The VPN Router supports up to 70 IPSec tunnels, which support DES and 3DES, and MHA and SHA IKE authentication. The wireless router is the same as the standard version except that it supports 802.11b 11Mb/sec wireless with 64- and 128-bit WEP. The firewall router provides full SPI to block DoS attacks as well as URL filtering and blocking Java, ActiveX, and cookies.

Product:	Linksys Etherfast Cable/DSL Router BEFSR41
Interoperability:
Futureproofing:
ROI:
Service:
Rating:

Product:	Linksys Etherfast Cable/DSL VPN Router BEFVP41
Interoperability:
Futureproofing:
ROI:
Service:
Rating:

Product:	Linksys Etherfast Wireless Access Point & Cable/DSL Router BEFW11S4 v2
Interoperability:
Futureproofing:
ROI:	½
Service:
Rating:

Product:	Linksys Etherfast Cable/DSL Firewall Router BEFSX41
Interoperability:
Futureproofing:
ROI:
Service:
Rating:	½

Micronica HiP400

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

There is a simple one-page quick start guide, which is all that was needed to get the unit up and running, and a full manual is included on the enclosed CD. The configuration pages are clear and easy to use and provide access control, port forwarding, DMZ, and remote administration. One particularly useful feature is the power adaptor, which is a standard three-pin Australian lead that plugs into a transformer. This makes it very easy to replace the cable and plug the router into a UPS so that communications can continue uninterrupted when power is lost.

Other options include the Micronica SOHOmate WiP-400 with a 802.11b Wireless Access Point which is available for AU$602, and the Micronica VPN Router with support for multiple IPSEC and L2TP VPN tunnels for AU$487.

Product:	Micronica HiP400
Interoperability:
Futureproofing:
ROI:
Service:
Rating:

Netcomm Cable/DSL Router Family

All these devices look exactly the same from the front, all sporting the same physical design of a squarish beige box with a blue top piece to make the shape a little more organic. Unfortunately the

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

raised bump on top makes it impossible to stack the units. All systems offer a simple one-page setup with more advanced features configured separately. Other features include: access control, port forwarding (with a list of common ports), Syslog server, direct DDNS support, and support for single or multiple DMZ machines (multiple WAN IP addresses required for Multi-DMZ). All models include remote administration from any machine.

The NB 3000 Wireless Router supports 802.11b 11Mb Ethernet with 64- and 128-bit WEP. The firmware on the test system had no help menus, and flash upgrades are only available via TFTP.
The NB3100 Cable/DSL Firewall Router provides full advanced firewall protection and packet filtering. It also has the ability to filter Java, ActiveX, and cookies, as well as URL blocking and time-based filters. It also supports up to five IPSec tunnels, which support DES and 3DES, MHA and SHA IKE authentication, and SNMP.

The NB3200 VPN Router supports up to 70 IPSec tunnels, which support DES and 3DES, and MHA and SHA IKE authentication. In fact, the VPN setup is exactly the same as the one on the Linksys VPN Router. In the configuration pages, there is an extra dot after Special Apps menu that takes you to another page with options including the ability to backup and restore configurations, upgrade firmware, view statistics, and manage the logs. This may just be a glitch in the firmware installed on this version. Another feature of the VPN is that it supports SNMP, with the option to supply up to four community strings.

The power adaptor on the VPN router is the same as that for the Firewall Router (12V), but different to the Wireless and ADSL Modem Routers (5V).

The NB3300 ADSL Modem Router is a basic version of the above, without the wireless or security features, but it does provide the huge bonus of having the actual ADSL modem built in. This saves an extra box and another power point, though there is the concern that once the “Next Big Thing” replaces ADSL, it will become redundant. Like the wireless router, the firmware on the test system had no help menus, and flash upgrades are only available via TFTP.

Product:	Netcomm NB3000 Cable/DSL Wireless Router
Interoperability:
Futureproofing:
ROI:	½
Service:
Rating:	½

Product:	Netcomm NB3100 Cable/DSL Firewall Router
Interoperability:
Futureproofing:
ROI:
Service:
Rating:

Product:	Netcomm NB3200 Cable/DSL VPN Router
Interoperability:
Futureproofing:
ROI:	½
Service:
Rating:	½

Product:	Netcomm NB3300 ADSL Modem Router
Interoperability:
Futureproofing:
ROI:	½
Service:
Rating:

Netgear FVS318 ProSafe VPN Firewall

The firewall and intrusion detection functions of this system include full remote management from any IP address, an IP range, or a specific IP address.

There is the ability to block Web sites based on keyword as well as time-based blocking. There is a system where you can be e-mailed system logs as well as immediate notification for “significant security events”.

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

There is an option to backup and restore all systems settings to a file on your hard drive, which makes it a simple task to configure a

series of systems for distribution to a range of sites.

Dynamic DNS and DMZ support are also available if required.

The manual included with the system is rather small, but very concise and informative. A full reference manual is also included on the CD for those who prefer their information online. The Web-based configuration pages are very easy to navigate and use. Detailed, context-sensitive help is provided along the right-hand side of every page.

A setup wizard helps you through the initial setup procedure, auto detecting your WAN type and connecting you up.

Product:	Netgear FVS318 ProSafe VPN Firewall
Interoperability:
Futureproofing:
ROI:
Service:
Rating:	½

Netgear RP614 Web Safe Router Gateway

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

The router detects the modem type, requests the information it needs, and automatically sets the system up. When the setup is finished, it initiates a test, which initially came up as failed, but after three to four seconds changed to OK. n

Product:	Netgear RP614 Web Safe Router Gateway
Interoperability:
Futureproofing:
ROI:
Service:
Rating:	½

DIY routers

If you have an old PC lying around, you can turn it into a powerful Internet gateway/firewall/router using the free software Smoothwall. It runs on Linux, but is designed to be extremely easy to administer (using a Web interface).

Because it uses Linux, you do not need a license of Microsoft Windows (or worry about the security vulnerabilities that Windows has).

Installation is remarkably simple: download the CD image, burn it and use it to boot up the computer. Protocol support includes PPPoE, which is used by most all ADSL providers. You can get Smoothwall here: www.smoothwall.org.

Setting up Smoothwall to work with BigPond Broadband Cable is a bit trickier than ADSL; fortunately, Lucien Wells has written a comprehensive setup guide which details the process clearly. You can find it on the Whirlpool Web site at this URL: www.wpool.com/smoothwall/.

Broadband routers: security

There are two main types of security features that are available in broadband routers, NAT and SPI.

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

Network Address Translation (NAT) substitutes the “private” IP address of devices located on the LAN side of the router with a “public” IP address that is visible on the “Internet side” of the router. Using this simple implementation, up to 253 devices located on the LAN will be hidden behind the router, diverting crackers trying to get to a specific PC. Only the router´s IP address is visible on the Internet. The router uses various ports to keep track of the different streams and their destination workstations. This technology provides crude protection against crackers and is used widely in broadband routers. Although the term firewall is often used generically when describing a router´s ability to hide the workstaion´s IP address, a true firewall employs a technology called Stateful Packet Inspection (SPI).

SPI is a technology used in firewalls that, instead of simply hiding an IP address from the Internet, will look at each individual packet for information such as its source and destination addresses and the protocol that is being used, in order to take certain actions based upon a set of pre-established criteria. SPI can be used to prevent Denial of Service (DoS) attacks, since the contents within the packet are known.

SPI in firewalls provide a greater level of security, and as a result, is generally more expensive than a NAT router. Firewalls give the administrator the ability to set up specific IP addresses or domain names that are accessible while refusing the rest (filtering). Firewalls may also allow remote access to the private network through the use of secure login procedures and authentication certificates (Virtual Private Networks, or VPNs). Firewalls are used to prevent DoS attacks and can use software to provide content filtering to deny access to unwanted Web sites. There are also extensive reporting capabilities, known as an Intrusion Detection System.

DMZ and Port Forwarding
Many routers allow a single computer (usually a server) to be placed in a Demilitarised Zone or DMZ. A DMZ allows you to assign one (of many) devices to be attached to the router, but not protected by it. This allows the use of a few servers that are available publicly from the Internet, as well as a local network of machines that are protected by the router. It´s not a feature that sees a lot of use in the home environment, but more so in the business area.

Port forwarding is not really a security feature, but rather a way to get around some of the limitations imposed by the security provided by NAT. When another computer attempts to talk to yours, it connects via a certain port. Various ports have been defined for particular uses, and others are for general use; for instance if you run a Web server, to make Web pages available to the internet from your computer, other computers will typically attempt to connect to yours on port 80. However if the machine with the modem is running a firewall, port 80 will generally be blocked. Port forwarding refers to a firewall´s ability to forward requests that arrive on a given port to a different computer on the local network that is running a server.

What will work, and what won't?
The quick answer is that almost everything you currently use on the Internet should work, with little or no reconfiguration. A few applications have been known to cause problems, the most difficult being video chat applications like Microsoft´s Netmeeting and Yahoo Instant Messenger´s video chat that use the h.323 protocol. It´s possible to make them work in a limited sense using port forwarding, with this generally allowing you to send but not receive video calls. Another problematic application is DCC chat and file transfer within IRC, but that´s usually remedied by changing a few settings in your IRC client. Another possible area of problems is online gaming, however it´s becoming very common for support areas for these games to offer port forwarding settings for firewalls to allow their games to operate normally. Firewall support is becoming better and better, as firewalls and gateways become increasingly popular.

How we tested

We tested and evaluated each of the desktop systems based on the following criteria:

Interoperability: For our Interoperability scores, each unit started with a score of 2, and we added another point for each of the following:
• Browser-based administration

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

• Wireless ready
• Modem backup

Futureproofing: For Futureproofing, each unit started with a score of 2, and we added an additional point for the following features:
• Ethernet WAN port
• More than four switch ports
• Uplink capabilities

ROI: Return on Investment was calculated based on the price and the features available in the unit. All scores were rated out of 5 with the best given a score of 5.

Service: The scores for Service were based on the warranty that came with each unit. The scores are as follows:
• 1 year = 1 point
• 2 years = 2 points
• 3 years = 3 points
• 5 years = 4 points
• Lifetime = 5 points

Sample Scenario

Company: Wyman Discount Stores

This retail chain wants to connect each branch through a broadband connection (ADSL, cable, or satellite, depending on availability). The connection will need to be shared between 3-6 computers at each office

Approximate budget: $500 per router.

Introduction Belkin Gateway Router Linksys Router Family Micronica HiP400 Netcomm Router Family Netgear VPN Firewall Netgear Router Gateway DIY routers Broadband security How we tested Sample Scenario Specifications About RMIT Test Labs

Requires: 26 broadband routers.

Concerns: The IT staff need the ability to remotely configure the router from head office. They would also prefer the ability to automatically failover to a modem connection if the broadband connection goes down. They also want to run the inter-office traffic over a VPN, so would prefer a device that handles the VPN.

Best Solution: The company would be happily served by pretty much any of the routers tested. All of the vendors have a range of products that will suit the needs of even the most discerning of buyers. A special mention has to go to both the Linksys and Netgear range of products for being the easiest to use and set up

Specifications

About RMIT Test Labs