Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone recommend a small, highly reliable VPN-client-capable router/switch?

Should have 4-8 Ethernet LAN ports, although could be combined with a small switch to reach this.

The WAN port will be connected to a Linux router/firewall via a long-distance wireless bridge.

It should tunnel LAN traffic to a VPN server running on the Linux router. Bonus points if that VPN connection is smart enough to retry dropped packets on the wireless link locally. Willing to install and configure whatever Linux software is needed for the server side of the VPN, so essentially any VPN technology is allowed.

Should either bridge traffic to an virtual interface in the Linux firewall (representing termination of the VPN) or be a proxy/agent-forwarder for DHCP. LAN-side devices should be seen as individual nodes by the Linux VPN server (i.e. no NAT, preserving MAC addresses is best but routing with IP-address per node is ok too). Bonus points if each LAN port tunnels to a separate interface on the Linux firewall and the device does not bridge traffic between local ports (e.g. VLAN-style isolation of LAN ports). VPN must connect automatically at boot and re-connect periodically if lost.

Bonus points for bandwidth control / rate-limiting of attached devices, but not essential.

Throughput should be at least 20Mbps, prefer 50Mbps.

Intended deployment environment is in a rooftop outdoor electrical enclosure, so small size is important as is robustness to temperature variation. Thus physical access to replace/reboot is very inconvenient, reliability is crucial.

Target price: < $800 (but don't consider that a hard limit if it does exceptionally well in terms of desirements)

The VPN serves two purposes: retry packets locally instead of waiting for the end-to-end connection (with high RTT) to detect losses, and insulate the wireless bridge equipment against unusual packets. Strong encryption not required.

share|improve this question
up vote 1 down vote accepted

try pfsense - it's free (1.2.3 is stable and 2.0 is bleeding edge, but more/new features)

You can use either your own hardware, like a pc with one or two extra pci ethernet cards, or purchase hardware from: Hacom Applianceshop Logic Supply look here

The php based webgui is great, and it supports all of your requirements including bandwidth control/limiting. I just finished a project with 8 interfaces, and multi-wan outbound balancing

share|improve this answer
Thanks. This was really meant to be focused on the hardware. Did you build your own system or use one of the Hacom ones? Any experience with the "Brik" or "Twister" models? A PC form factor really wouldn't cut it here, both because of size and also heat. – Ben Voigt Nov 16 '10 at 1:32
We purchased the Hacom Mercury II 1U unit,, 4U intel built-in with an additional 4U Realtek PCI card. We were also looking at the "Lex Twister VIA C7 Gigabit Ethernet with PCMCIA and PCI" – iamzam Nov 16 '10 at 2:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .