Firewall that doesn't increase latency

Discussion in 'Networking and Security' started by mastertrader456, Jun 8, 2012.

  1. For desktop applications, how about the Mikrotick RouterBoard RB/450 that is 10/100 for $99 or the 5-port 10/100/1000 RB/450G for $125?

    Or the new RB2011L with 10 port 10/100/1000 with 600MHz Atheros 74KMIPS CPU, 64mb RAM for $99.00?

    http://www.roc-noc.com/Mikrotik-Desktop-Routers/
     
    #11     Jun 9, 2012
  2. The box that I recommended has two slots - one PCI and one PCI-e. The Intel Pro 1000 GT card isn't bad however it is lower quality than the server grade MT and PT models. The GT is a "desktop" model while the MT and PT are "Server grade" models.

    I usually have better luck with the intel server grade parts. They can usually sustain long term bandwidth and longer term operation. For example I have a smart-ass guy who has been running a program on historical tick data and it has been pulling 350-500 megabits per second non-stop for three days. Over an Intel MT or PT NIC (he is pulling from an MT and pushing out through a PT) I won't bat an eye. Instead my comments are "If your code was better you would be saturating the gig pipe". On a GT card I'd be nervous.

    Also, the Cisco card I like:

    http://www.cisco.com/en/US/prod/col...s5819/product_data_sheet09186a00801ebc33.html

    Is PCI so it works well with that motherboard... Get the good Server-Grade NICs and get the robust PCI wireless access point card and then have an extra (on-board motherboard) for either failover/dual-wan or for whatever else you want.

    It isn't a knock on the GT cards. I'd use them on a desktop all day long just not a router or anything with higher sustained bandwith.
     
    #12     Jun 9, 2012
  3. After this much talk I placed an order tonight to buy one of these things. I'm curious.


    Sorry OP that we semi hijacked your thread.
     
    #13     Jun 9, 2012
  4. Winston, what would you suggest as a recommendation for a WIRED Router for my desktop application?
    I have a trusty old AirLink Router that has served me well over the years, but I think it might be time to upgrade.
    Am running a Dell Precision T3400 along with a new XPS-8300 as my backup.
    Am a remote trader using basic broadband.
    Am tempted by the Mikrotick RB450G
    or the new RB2011L for $99.

    Thanks!
     
    #14     Jun 9, 2012
  5. If you are close to the exchange you could rent your own private cable straight to the exchange.
     
    #15     Jun 9, 2012
  6. bawr

    bawr

    Cisco ASA 5515-X.
     
    #16     Jun 9, 2012
  7. I would not use the RB 450 gut go for the 450G always - remember that is also a nice switch and you want POSSIBLY gigabit there. Depending on your bandwidth the 750 may be enough, though ;) And then we talk of 60 USD only.... but if you do not mind, I would likely go with the 2011 these days ;)

    The 2011 yes ;) Advisable ;) 5 x 100mbit, 5 x 1000mbit. The RAM is toooo small for a full GBP feed, btut you never have those anyway outside a data center. It is a NICE Looking thing that also does all your needs. You can use the 5x100mbit as uplink (theoretically up to 5 internet providers with 100mbit max each) and the 1gbit ports us as downside link for servers, laptops etc. Consider http://www.roc-noc.com/mikrotik/routerboard/RBWMK.html - a nice wallmount ;)

    A word of warning - the Mikrotik is not a toy. It is a high end flesible thing. It can run in a data center scenario (full bgp, suppoot MPLS and VPLS) but it is not trivial to set up, unless you know what to do (i.e. know your way around network protocols). We do not talk "nice UI for simple things". It has a remote iwindows based UI ("Winbox") but even there we talk of long tables for all the features.
     
    #17     Jun 9, 2012
  8. I recommend that people look at the Linksys RV042 and RV082 routers. They are small business grade and they can be had on eBay for less than $100. (For a point of reference they go for $200-$400 new these days.) They are 10/100 routers - not full gigabit - that is why they are so cheap but also 99% of america has less than 100 megabit internet at their home or office.

    I also tell people another word of advice: Allow each device to do it's intended job well rather than ask it to do the job of three different things poorly. If you have a router use it for routing, let the switch do the switching and let a wireless access point handle your wifi traffic. If you try to buy one of those "all in one" combo devices you will sacrifice and compromise on each category and end up losing overall.

    Most people own a decent wireless router in their home. Keep it and keep using it exactly as you are. Buy a solid wired-only router to connect to your ISP with (like the Cisco/Linksys RV042 or RV082) and let that be your main firewall/router between you and the outside world. Those routers are plenty fast enough to handle sustained downloads from Netflix or iTunes all day long. Keep in mind that the most bandwidth I have ever seen a trader use (he was running 8 strategies, each pulling market data and sending orders all at once) was during the flash crash and it was only 17mb/second sustained with a spike up to 28mb/sec. Your kids (or wife) aren't going to be pulling down movies from Netflix during the day so you are good on that front.

    Keeping in line with letting each device do it's own job well (and this is industry best practices in the networking world) buy a decent switch and don't connect any individual machines to your router. The router/Firewall sits between you and the outside world and the "stuff" all connects to the switch.

    It should be:

    Internet/ISP >> Your router >>> Your Switch and Your Wifi

    You can connect your wireless router (your new wireless access point) directly to your router or you can connect it to your switch. Either are fine. Plug your computers, storage devices, printers, TV's, refrigerators, thermostats, lights & security systems, etc. (yes all that stuff now connects to the internet) plug all that stuff into the switch.

    I like the Dell PowerConnect 2708 and 2716 switches (the 2724 is awesome too but has a fan so it is loud). Since I started recommending them so much I have a feeling that I've been bidding against many of you on eBay for these things - the prices have gone up a bit and they are a little harder to find but they can still be had for under $100. The switch is gigabit so that keeps your computer-to-computer or device-to-device traffic up to modern speeds and you are throttled by your internet provider anyway so as long as 100mb/sec is higher than what you are paying for the 10/100 router will not be a bottle neck.

    With that setup above you have the same exact setup that is powering a few NYSE market making firms, a couple HFT shops and a few remote prop groups. For $200 you can have that at your house. If that becomes too little then I jump up to a PfSense box for them - which is similar to how you use the Mikrotick devices - there is no "setup wizard" you need to build every rule and start building your firewall from scratch.

    Most prop firms are already doing that and paying thousands of dollars a month (like $25k-$75k). Why not leverage someone else vs. pay to rent a wave of light on someone's fiber?

    That's a $3000 used device and upwards of $5000 new. That's stupid money to be spending IMO. I can build you a firewall & router combo that will blow the doors off of that for much less money. Even still, that Cisco device is a decent appliance.


    Mikrotick:
    I've been looking at the documentation for the Mikrotick hardware and I see what they are like. It is essentially more robust hardware but much less restricting on the GUI/user interface - which is good, you can do anything you want (rules, VPN's allow/disallow, etc.) but it comes at a price - command line interface (or the GUI is not much better) and very logical/straight forward entry.

    I think that this would be very impossible for most end users to handle. Saying that you need to know what you are doing to set this up is an understatement. It is essentially the same setup as PfSense except that the Mikrotick guys have a very basic web GUI.

    I don't mean to knock readers or users but this is one of those things when they say "if you have to ask you probably can't afford it". If you have to ask what it means to build firewall rules from the ground up or what NAT means, etc. then you are probably better off buying something else.
     
    #18     Jun 10, 2012
  9. Ys or no - if you have to ask waht firewall rules are etc., then the UI is your smallest problem ;) Knowing what to do is the main one.

    Btw., Mikrotik - I am not aware of anyone using the WEB UI. They have a windows frontend that is a LOT more convenient (Winbox), download and it works. It also works without IP via ethernet packets directly for initial configuration ;)

    But yes, it requires planning - but then, unless you do JUST TOTALLY SIMPLE (and then there is a very easy fast setup in Mikrotik, too) the langauge to set up the rules is really the smallest problem. Knowing WHAT to do is the main problem, regardless what you use as technology (as long as the technology can do it, obviously). 95% of the users do not need more firewall than "NAT it out" (which is easy to set up also in Mikrotik) Anything more and - well - the planning etc. is the main problem ;)

    What I miss is full support for virtualization as well as a PPTP server that can multilink, both are elements I have a need to use at the moment ;)
     
    #19     Jun 10, 2012
  10. Thank you so much for your knowledge base.
    Much appreciated!
    :cool:
     
    #20     Jun 10, 2012