#206515 - 2013-01-02 01:27 PM
Re: Connecting small business to Fibre Optic Broadband
[Re: Arend_]
|
Robdutoit
Hey THIS is FUN
Registered: 2012-03-27
Posts: 363
Loc: London, England
|
I don't know how broadband works elsewhere in the world, but the fact is that BT's fibre optic offers the best value for money for my particular clients. My understanding is that broadband speeds in England are significantly slower than what you guys get on the mainland.
Remember everything here in privatised for efficiency of course! In reality we just pay more and get less!
a: Dsl is not cost effective - the last time that I looked.
b: Yes you connect into a phone socket because its FTTC not FTTP in other words, its fibre optic from exchange to the cabinet in your street and then plain telephone cable from the box in your street to your house. This makes a huge difference because ADSL which is the predominant type of Internet in this country suffers from speed issues because of the distance from the exchange to your house. This has made ADSL useless for business use unless your business is right on top of the exchange. I presume that DSL suffers from the same problem. So yes, its not 100% fibre optic, but the distance from the box in your street to your house is neglible compared to the distance from your house to the exchange which is the real problem with ADSL.
C: PPPOE is actually quite alright. The biggest problem with it has always been line attenuation. But that again is an ADSL issue. And the second issue is the quality of the broadband router as many of them are rubbish.
I appreciate that DSL may work for you Lonkero and Glenn, but not in England. The telephone infrastructure in this country is ridiculous. Anyway putting aside the issue of what broadband each country uses, the question was more to do with how people connect to the Internet and where their firewalls sits with regards to the lan and actual Internet.
You misunderstood me Lonkero, I don't want to use the Draytek for firewalling, I was merely considering it from the point of view of getting the PPPOE connection setup as you can't just plug the modem into the firewall and expect it to work. I may look at the PPPOE nic card solution.
My clients can expect to get between 50-76Mb download speeds which is more than 3 times faster than what they are currently getting and they will be paying significantly less, therefore fibre optic is the way to go for my clients.
Interesting that your companies use Draytek as well Arend. I don't want to use the Draytek for a firewall because I do feel that my slackware box is far better, oarticularly as the slackware box is what will drive the content filtering. So essentially speaking I think I will go with my slackware box setup for PPPoe configuration as the Draytek is just duplication.
I also use Cisco Switches as well lol. anyway thanks for all the feedback.
|
|
Top
|
|
|
|
|
#206521 - 2013-01-04 02:25 PM
Re: Connecting small business to Fibre Optic Broadband
[Re: Lonkero]
|
Robdutoit
Hey THIS is FUN
Registered: 2012-03-27
Posts: 363
Loc: London, England
|
I think that I understand what you are saying Lonk. It may not be true fibre optic in technical terms. I believe it uses vdsl. The point is, my clients currently pay almost twice the price for a broadband of less than 20Mb and we have no control over the firewall as my clients connect through the council. The clients that I am referring to are primary schools. I am offering them broadband speeds that are nearly 3 times faster and half the price. I have used BT's speed test which is supposed to be very accurate to determine exactly what speed the clients will end up getting. In addition, the primary schools will have me controlling their firewall and not the council. This is very important as all too often the schools cannot get certain things to work because the council refuse to allow the program access. Security is all and well, but now when a client cannot use the network properly because there is a one size fits all solution for all schools by the council.
I am happy with my slackware solution which uses iptables and is in my opinion very secure and in addition, I have the dansguardian filtering working very well. I just don't have any experience of connecting firewall boxes to fibre optic or if you prefer to call it vdsl hence the question.
Perhaps for the type of companies and countries that you work in, this solution is not much good to you, but in England, I honestly cannot see any comparable solution that offers that speed and that price.
I have looked into matter further, and I will go with the PPPoe Network card setup in the slackware box connecting to the BT Modem as the router is the prime problem. I will get back to you in two months time with feedback on how it works out.
Eventually we will get true fibre optic as in fibre to the premises, but for now we will settle for FTTC.
|
|
Top
|
|
|
|
|
#206524 - 2013-01-05 04:01 PM
Re: Connecting small business to Fibre Optic Broadband
[Re: Robdutoit]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
|
Why would you double-NAT?
If the Draytek does NAT, it should have a private IP (ie - 192.168.0.1) on the inside. Configure your inside firewall to route, with 192.168.0.2 on the outside and another private network address on the inside. This effectively creates a DMZ whether you want it or not, but prevents the double-NAT situation. I have used ISA or TMG firewalls in such a configuration in the past when business Internet service was not available. Have the Draytek forward all ports/protocols to the inside firewall and let that device forward to or publish inside servers as appropriate.
My earlier comment was more to using a home-brew firewall in a business environment and the potential exposure to you. With commercial equipment available used/refurbished at $200 US, why build a PC (even an old desktop), take time to install the O/S and iptables module, and subject you and your company to the potential risk that everything you've used and configured is 100%? If you choose a well-known and respected commercial product, the customer cannot bring into question the integrity of the design. Your liability exposure is limited to the configuration of the device, and even then your exposure is minimal unless you grossly misconfigure it.
We use refurbished equipment at many smaller businesses to provide enterprise quality at bargain prices. We buy an extra device or module and pay for it through maintenance contracts to insure same-day recovery for clients, even though in 5 years we've not had a single failure. We also maintain copies of any config files in-house to pre-load the spares to minimize on-site time. It might take 30 minutes to set up and load it at the office, but when we walk in and swap the box and things work, the client "sees a duck" - moving gracefully on the water but doesn't see how hard we're paddling below. It's an appearance that breeds confidence.. other vendors arrive and take an hour or more to install and configure a replacement, we do it in 10-15 minutes because of the back-office preparation and standards across clients.
Another perspective is control - the more you have, the less risk you take on. Control comes through standards across clients, recognized equipment, and learning how to "say no - but..." when appropriate. Also, if a new client has technology that we don't consider appropriate, we'll suggest a replacement. If they choose not to, they must sign a "hold-harmless" document stating that we don't recommend that device or configuration and cannot be held responsible for any effect that may result from its continued use.
Glenn
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
|
#206526 - 2013-01-05 07:53 PM
Re: Connecting small business to Fibre Optic Broadband
[Re: Lonkero]
|
Robdutoit
Hey THIS is FUN
Registered: 2012-03-27
Posts: 363
Loc: London, England
|
Glenn, it may not look like it, but we are actually more in agreement than not. I could not agree with you more with regards to control and standardisation. This is what I have been busy doing with my clients over the last couple of years. The first step was getting similar client desktops e.g. Fujitsu Esprimo, and the same type of servers, e.g. Fujitsu Primergy. I also use as much as possible the same switches from Cisco taking the size of the network into account and whether the client requires power of ethernet etc. So yes, I agree with you 100%. Standardisation is absolutely critical. I want the same Servers, laptops, desktops, switches, routers etc etc etc. And this is actually why I want the Slackware box as this box is the most important one to standardise. Even with the broadband supplied by the council, the schools broadband connectivity equipment differs from school to school precisely because as equipment died out/phased out over the years, the council replaced them with the result that for most schools, the connection is broadly similar but not identical as some schools have a router setup through a very old switch and other schools use a white box for the router. The problem is if I buy 10 cisco whatever firewalls now, what happens in three years time, when I have new clients on board and I can't get these particular Cisco firewalls anymore. I have two choices. I can either replace all existing firewalls with something different so that everything matches and works identically or I can have slightly different equipment in each client as I get new clients on board. I intend to replace the firewall equipment every x number of years, but I cannot buy hundreds of Cisco firewalls for new clients that I have not yet got on board. My slackware box gives me complete control as the Slackware software is easy to image onto the machine. The difference in motherboards etc would not really affect anything as Linux is largely driver independent. but the same version of the OS is very important.
To your first question, the way I intend to address the confidence issue in my box, is to
a: submit it to testing using port scanners and firewall testing software to look for any weaknesses
b: By default, only certain incoming ports will be accepted. All the other ports will be set to drop all incoming connections. So I will only have potential weaknesses on an extremely small number of ports.
c: By default only certain outgoing ports will be accepted. All the other ports will be set to drop all outgoing connections. So I will only have potential weaknesses on an extremely small number of ports.
d: Slackware is a very rarely used (in comparison) OS compared to Cisco Firewalls etc. You look upon that as a weakness in terms of credentials, but I actually look upon it as a strength, as Cisco will have known weaknesses, but Slackware will be far more hack proof as most hackers have never even heard of the distro. I understand your case about not re-inventing the wheel, but it is a bit unfair to compare Slackware to a homebrew. It has been built purposely for business use. It is the most stable Linux distro out there and is absolutely brilliant with regards to control of what is installed with the OS. It is in my opinion more than fit for purpose. In addition, using the firewall on the Slackware box along with Dansguardian filtering, it means that I have one box which I can fine tune the customisation to such a level that it is a far better product than any other product at that price. While the firewall is very important, for my clients, the content filtering is actually a higher priority to them because schools are required by law to ensure that children are protected. This is the prime reason for the Slackware box.
With regards to your second point, this is another thing that is brilliant about Slackware. It primarily uses scripts. So all I have to do is copy about a dozen files that will be slightly different for each client. It will take me all of two minutes to copy the files, which means that like yourself I can setup the box in my office, in less than 30 minutes as all I will be doing is imaging the OS onto a new box, and then copy the client specific files. This is one of my biggest reasons like yourself for standardisation. This is why I have selected Slackware as it allows me to standardise the firewalling, content filtering, proxy boxes for all clients as the only real changes I have to make are to about a dozen different files. So man, we are definitely in agreement there.
But thank you for your advice in the first paragraph. I think it makes sense to use a device like the Draytek for Nat and get the Slackware box to act as a simple router, rather than doing Nat itself. I like your suggestion for setting it up. However I am not convinced that using the Draytek is a good idea because I can accomplish the same thing with the Slackare box in that I can setup Nat on the box by seting up a second network card to act as the PPPoe device. But I am still keeping it in mind. Once I get the first client setup by the end of January, I will have time to play with my options and see what gives. Essentially I need to ensure that I can get remote access to the Server, so whatever solution I come up with has to have my remote access working.
Lonkero, its not the PPPoe itself that dictates Nat per se - well at least how I understand it. But the device that supports PPPoe must support NAT otherwise the Internet would not work. Therefore the PPPoe modem/router has to support NAT, otherwise there is no way for the return traffic to get back as it cannot find the internal IP address obviously.
I have also heard good things of Billion. Draytek and Billion seem to be highly recommended in the home market. I looked at the Zyxel, and it looks like a router, not a modem and as it comes with its own firewall, it is in essence no different from the Draytek.
I better stop writing now. I am getting RSI lol.
|
|
Top
|
|
|
|
|
#206530 - 2013-01-07 10:45 AM
Re: Connecting small business to Fibre Optic Broadband
[Re: Lonkero]
|
Robdutoit
Hey THIS is FUN
Registered: 2012-03-27
Posts: 363
Loc: London, England
|
This is one area where I find Internet forums frustrating. We are very often agreeing, but not realising that because the conversation is not two way in real time. Yes you are absolutely right. You can disable the Nat and firewall on most of these devices. But my whole beef with the thing, is why they don't make a device that does not include the NAT and firewall as standard. Anyway, not to worry.
I understand that routing and Nat are not the same thing. I did study networking. What I meant was that the device that provides PPPoe ability is usually the one that handles the NAT.
You misunderstood me with regards to why I am making a brand choice for desktops and servers. The reason that I am doing that is because of which companies I have found to offer good after sales service in my country as well as the fact that the drivers for a certain brand are broadly similar which means that I only have to have a small limited number of drivers for my clients instead of having hundreds of drivers for different manufacturers etc. It is not the most important criteria, but sticking with certain manufacturers for example Netgear wireless access points to use a silly example means that I am familiar with their interface, so it saves time. They tend to use the same internal IP address etc. So documenting clients networks is simpler if they mostly have similar switches. I realise that everyone has preferences, I personally hate HP as the support in England is really bad. Won't touch an HP !
I am glad that my slackware box meets with your approval ! Yes, you do understand the point I am making with the slackware box, the software is the important part. Agreed.
I am very pleased that this discussion has generated so much interest. I was not expecting so much feedback, but thats whats so great about KORG. I realise that my ideas don't necessarily meet with the approval of a number of users here. I seem to be very much in the minority especially when it comes to avoidance of using active directory group policy, but I prefer my scripts over group policy any day!
but as Doc or somebody said. All roads lead to Rome as in we all do things differently.
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|
