Bridging VDSL modem recommendations?

Forums › New Zealand Broadband › Bridging VDSL modem recommendations?

jasnz

41 posts

Geek

#146534 21-May-2014 05:49

Hi All,

I am looking to try and setup a small network with subnets etc over VDSL. At our house I will have 4 U1 servers in 2 working pairs. I would like to have our own firewall box running endian or ipcop or pfsense or similar (I am going to use a simple core 2 duo level machine with a gigabit quad port networking card.) From the firewall box I will have various subnets, etc.

I want the VDSL modem to be able to bridge the network connection through to our firewall box and let the firewall box do all the configuration. Currently I am with snap and using a fritzbox 7390 (I think... sorry I am not physically at home at the moment to check...) The Fritzbox does not do bridging easily from what I can read.

I have seen various recommendations for draytek, zyxel, etc which allow full bridging in VDSL. But none of them were very definitive...

(In fact I would actually like to get multiple IP's (a /29) into the VDSL line and bridge those through to the endian firewall box. But from calling up snap and some other providers they are all recommending I switch to a CISCO product or a Juniper product. Both of these are quite complex to configure. Now I have flashed DD-WRT on routers before etc but the configuration of these cisco level products look to be extremely complex in comparison.)

Thus, does anyone have any recommendations for a VDSL modem I can buy that will do bridging in a reasonably stable and easily configurable way.

If snap doesn't offer this service, then are there other recommendations for other ISP's in NZ which will do this. I have contacted, snap, voyager, iconz, and earthlight. (Earthlight have been quite helpful but... I am checking to see if there are other options, etc.)

Thanks!
Jason

plambrechtsen

1948 posts

Uber Geek
Inactive user

#1050211 21-May-2014 06:23

Vigor 130 in bridging mode will let you use any device as your cpe.
http://www.ascent.co.nz/productspecification.aspx?ItemID=417343

Then you could run any firewall even ipcop or pfsense.

If you want to run a /29 then you will need either a ipoe with multiple ip addresses or the same in pppoe. Which not many isps support. The other option is for them to give you a different range and a static ip for the pppoe session and then route via the link level ip. That's where your complexity is coming from.

Do you really need more than 1 ip? Since you can multi home web pages on one. And if you need more then it sounds like a business so purchasing the router will be cheap in comparison to the cost of the business grade internet connection.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1050229 21-May-2014 07:49

Zyxel P870H or Draytek DV130.

I doubt any ISP is going to offer multiple IPs over a residential connection - if you want a business solution you'll ultimately have to pay business pricing for a solution.

Inphinity

2780 posts

Uber Geek

#1050230 21-May-2014 07:57

Yep, Draytek DV130.

jasnz

41 posts

Geek

#1050307 21-May-2014 10:27

Thank you plambrechtsen, sbiddle, and inphinity!

So the recommendation for the Vigor130 or ZyXEL then. I did some digging then at these threads:

Battle of the VDSL2 modems: ZyXEL P870H-51a vs. DrayTek Vigor 130
Draytek Vigor 130 - Configuration and performance

From reading these threads it looks like there is possibly some hassling around with various factory resets and firmware updates to get the V130 to go nicely in bridging, whereas it sounds like the ZyXEL is easier to configure?

Or really the V130 is fairly straightforward to configure?

@plambrechtsen (Disclaimer: I am not a networking guru.) It appears that snap uses PPPoE. (Breaking away from snap is going to cost me a $499 breakage fee which is pretty steep...). Still does anyone know of any ISP's which can actually do this? ICONZ and voyager both offer /29's as did earthlight, and even snap (but it was a bit hard to get ahold of a business rep at snap... and nail this down...)

As for needing another IP, well we can survive for our testing purposes by just launching a digital ocean droplet for US$5 per month and then using shorewall or something on the droplet to forward and highport the ports from the droplet through to our firewall, and then our firewall routes these higher ports back down to the normal ports in the subnets...

Still it would be really handy for testing and other things to have, multiple IPs. (It would be nice to try and keep things simple and clear...)

If we did go commercial what would peoples recommendations be? It was looking like around NZ$250 per month at voyager (where they managed the cisco 887) and something similar at snap and earhtlight... This would still be a lot cheaper than collocating 4 1U servers (which I think would cost us somewhere between NZ$400 to NZ$600 per month...)

Thanks!
Jas

DonGould

3892 posts

Uber Geek

#1050377 21-May-2014 11:43

Jas the Vigor is not hard to upgrade and works well.

I am currently doing exactly what you're wanting to do.

Give DTS a call. It won't be as cheap as a res connection but they can provide the IP space and will do all the other things you would expect.

Ping me if you get stuck.

D

Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

jasnz

41 posts

Geek

#1050402 21-May-2014 11:59

Hi Don,

Thanks for the reply! So I sent off an email to DTS. But just to clarify you are using a /29 with the Vigor on DTS? Did you have some ball park figure for the price of something like 100G national traffic and unmetered national traffic plus the /29? (I am not sure if we are allowed to talk prices on Geekzone... If not please excuse the question...)

Thanks,
Jas

DonGould

3892 posts

Uber Geek

#1050407 21-May-2014 12:16

plambrechtsen: Vigor 130 in bridging mode will let you use any device as your cpe.
http://www.ascent.co.nz/productspecification.aspx?ItemID=417343

Then you could run any firewall even ipcop or pfsense.

If you want to run a /29 then you will need either a ipoe with multiple ip addresses or the same in pppoe. Which not many isps support. The other option is for them to give you a different range and a static ip for the pppoe session and then route via the link level ip. That's where your complexity is coming from.

Do you really need more than 1 ip? Since you can multi home web pages on one. And if you need more then it sounds like a business so purchasing the router will be cheap in comparison to the cost of the business grade internet connection.

http://www.gowifi.co.nz/coming-soon-new-products/mikrotik-rb951g-2hnd-high-power-802.11n-gigabit-wireless-router.html?keyword=951

Jas a dedicated machine seems a bit OTT. One of these uses a lot less power and will better let you do want you're trying to do and you can use it for either IPoE (which is what DTS use) or PPPoE (per Peter's comment above).

D

Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

DonGould

3892 posts

Uber Geek

#1050410 21-May-2014 12:20

jasnz: Hi Don,

Thanks for the reply! So I sent off an email to DTS. But just to clarify you are using a /29 with the Vigor on DTS? Did you have some ball park figure for the price of something like 100G national traffic and unmetered national traffic plus the /29? (I am not sure if we are allowed to talk prices on Geekzone... If not please excuse the question...)

Thanks,
Jas

You can talk prices on GZ, but I'll leave Owen or one of the other guys to sort out a price for you.

DTS don't meter national traffic on their plans, so you'd be just up for the circuit cost.

I actually have a number of /29 and /30 on one service with them.

They simply provide a tail with a header IP and then route what ever IP space to you that you want.

It's very useful as they an also then reroute the space to other places on their network if you need them to.

D

Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

Inphinity

2780 posts

Uber Geek

#1050417 21-May-2014 12:38

jasnz:ation for the Vigor130 or ZyXEL then. I did some digging then at these threads:

Battle of the VDSL2 modems: ZyXEL P870H-51a vs. DrayTek Vigor 130
Draytek Vigor 130 - Configuration and performance

From reading these threads it looks like there is possibly some hassling around with various factory resets and firmware updates to get the V130 to go nicely in bridging, whereas it sounds like the ZyXEL is easier to configure?

Or really the V130 is fairly straightforward to configure?

The DV130s available now should all have the working firmware. The original release firmware did not work in cases where VLAN10 was required on the VDSL connection. Snappernet promptly made available to us a beta firmware that fixed it, followed shortly by the release version. After the firmware update was released, the DV130 is fine. I haven't compared it with a P870H on the same line to get an idea of their comparative sync performance.

jasnz

41 posts

Geek

#1050431 21-May-2014 13:07

@Don Thanks for the further information. So was it hard to set up your /29 on the Vigor130 with the DTS? Can you send me some link or further information about "provide a tail with a header IP and then route what ever IP space to you that you want." I have not heard of doing this and to be honest I don't even understand the terminology. I googled around for a bit but didn't readily come up with a lot.

@Inphinity. Thanks for the clarification. It sounds like the Vigor 130 is the way to go then...

Thanks!
Jason

DonGould

3892 posts

Uber Geek

#1050450 21-May-2014 13:45

jasnz: @Don Thanks for the further information. So was it hard to set up your /29 on the Vigor130 with the DTS? Can you send me some link or further information about "provide a tail with a header IP and then route what ever IP space to you that you want." I have not heard of doing this and to be honest I don't even understand the terminology. I googled around for a bit but didn't readily come up with a lot.

@Inphinity. Thanks for the clarification. It sounds like the Vigor 130 is the way to go then...

Thanks!
Jason

I just use the Vigor to bridge into the Mikrotik.

Then I set up the Mtk with the header IP number.

So let's consider an example...

202.68.80.100/29

You'll get given an ip in a /24 on the tail...

so...

202.68.85.56/24
gw: 202.68.85.1
broadcast: 202.68.85.255

Any traffic for 202.68.80.100/29 will just get routed to 202.68.85.56/24 and you'll route traffic back to 202.68.85.1 (iirc)

202.68.80.100 will be the network address with 202.68.80.101 being the default gateway for your /29 and then usable address space after that.

On the Mtk you can also put the vlan 10 interface on that so you don't need to worry about it being set in your modem.

D

Promote New Zealand - Get yourself a .kiwi.nz domain name!!!

Check out mine - i.am.a.can.do.kiwi.nz - don@i.am.a.can.do.kiwi.nz

jasnz

41 posts

Geek

#1052044 24-May-2014 08:21

@Don Thanks for the further notes. Unfortunately I still didn't understand all of the details... Still in the meantime, what we have decided to do is just launch a digital ocean droplet and install shorewall on that, then redirect traffic on the normal ports of the droplet to high ports on our single fixed IP, then we use the firewall to redirect those highports down to the correct ports of the machine on the relevant subnet on the other side.

This allows us to have public ports for testing / experiments etc. And for each IP this will cost us something like US$5 per month. Many people have already quoted a /29 as an extra NZ$40 per month so this is still even cheaper than that. There is of course the latency from the droplet to us but even so this is an acceptable thing to do.

Long term we would still like to get multiple IP's. I am surprised though that this has proved so difficult so far. I would have thought many small businesses around the country would want exactly this. One IP a website, one for maybe another client / app, one maybe for some internal VPN things, and maybe one for testing or something...

In any case I think if we do this we will go with the Draytek Vigor 130.

(Note DTS got back to me but there prices are considerably higher than eg Voyager... Still they might give great service so they might be fantastic...)

Thanks All!