iXBT Labs - Computer Hardware in Detail

Platform

Video

Multimedia

Mobile

Other

Nexland Pro800 Turbo Router Review






Home routers are getting more popular nowadays. It's not surprising because at a relatively low price you get a "black box" capable of many interesting things. First of all, it provides an Internet access for a small local network. I called it black because it's unclear what happens inside it at a particular moment. You can just guess or monitor the device via SNMP and then (mostly in expensive models) learn additional information from log files. 

Undoubtedly, each problem has several solutions. And instead of such router we can use a usual computer with two network cards. This computer connects a switch and the Internet. 

It's also possible to realize such router under OSes of the Windows family. But hardly anyone would take the risk of entrusting these operating systems with the Internet access task, especially if the computer has an external IP address (and therefore, will be easily accessible from outside). That is why protection of such router will be in the first place. Can the Windows 98 SE provide any protection? Hardly. Moreover, the system requirements of these OSes for the hardware have never been low. However, this method is easy to realize: there are a lot of experts in the Windows. Moreover, you might not need special skills as there is Internet Sharing. 

It's quite another matter to use OSes of the Unix or Linux families. They have very low system requirements, for example, a computer based on the Pentium 100 MHz with 16 MB RAM, a hard drive of 200-300 MB and a couple of network cards of 10 Mbit will be enough for most cases of connection of a small local network to the Internet. Isn't the price attractive? Note that the above computer is not the cheapest solution; you can use even a 486-based machine. Apart from a cheap platform and free software, there is one more advantage, namely a more flexible configuration system, in particular, network protection and firewall, a convenient way of the Internet access mediation, higher stability (compared to Windows platforms). 

Besides, you can couple the router with such things as a DNS server, transparent (for the local network) traffic proxying, e-mail server, remote control of the computer via SSH (encrypted connection) etc. It's clear that all that stuff shouldn't be put onto the shoulders of a machine which works as a primary firewall and a router into the external network. But it's just an example. All these things will work nicely on a Pentium-level machine for a local network of about 20-30 people. But you should expand the memory up to 32-64MB and the HDD size up to 1-2GB (first of all, it's necessary for a proxy server which eats a lot). You can easily imagine how the Windows would work on such machine even without additional services. 

But this approach also has drawbacks. The most obvious one is that it can't be a problem to find an expert in these OSes. Moreover, a router is based on a separate computer - the hardware such computers are assembled of is less reliable, at least because it has a hard drive which is a mechanical device. Of course, it's possible to replace it with a flash disc but the price will go up markedly. Finally, the unit is not small, consumes more power (compared with home routers) and produces more noise. 

That is why home routers enjoy the growing popularity. You don't need an expert to get the system up and running. Usually a manual provides the detailed instructions for the primary stage. In many cases this stage is sufficient. So, the whole adjustment process can take about half an hour. If it fails (which happens evidently more seldom compared to assembled computers, at least because of fewer components) you have the guarantee. These devices are especially popular in those networks which have no network administrators but an Internet access is needed. 

The principle of operation of most cheap devices is based on the NA[P]T technology (Network Address [and Port] Translation). The latter P is often omitted, though it would be more correct to speak about two technologies NAT and PAT - Network Address Translation and Port Address Translation. The technology works the following way. The device is given an external address on the external network (Internet) and the router translates all requests with addresses from the internal local network outside putting into the requests its external IP. The responses coming from outside will be converted back. 

So, a user working inside a local network doesn't notice a router and works as if it's on the Internet. From the standpoint of the external network (Internet), all requests are coming from the router (with the router's IP address), without any network behind it. Thus, a local network is protected from the outward access. That is why such solution is a good protection for all computers of a local network. 

Now about the shortcomings of the NAT. Not all applications like such a way of realization of the Internet access. For example, you can't connect FTP servers on the Internet in the active mode, transfer files via ICQ to another user etc. Also, you can't open an FTP server or set a client of a P2P network (e.g., eDonkey) for distribution of files. Just because you are not seen behind the router. However, most routers have settings to divert requests received at certain ports (e.g., 80 - WWW and 21 - FTP) to respective hosts inside a local network. That is why it's still possible to provide an outside access to internal servers. 

The NAT doesn't allow the IPSEC protocol which is used for establishing VPN networks or encrypted tunnels to work. You need a special revision of the NAT to support this protocol, which is not available in most router. 

Another downside of a common IP address of the network is that not all servers on the Internet like that different clients enter their sites from the same IP. Some voting systems wouldn't accept several votes from the same IP. Or, some companies limit the number of SMS messages that can be sent from the same IP. 

Now let's have a look at a home router marked ISB PRO800 Turbo from Nexland. It integrates a lot of advanced ideas, including the IPsec protocol support. The device costs $400 at the moment. It's not little, that is why let's see what we can get for this sum of money. 




The router comes with an external power supply unit, a 3m cable of the 5th category, a Null Modem cable 90 cm long (that is why to configure the device in the control panel you must put it close to the computer), a CD with documentation (in English and French) and additional utilities and a printed version of the documentation (70 pages), a copy of the English PDF file. 

A VPN client Symantec RaptorMobile (with 10-user licenses) wasn't found here though it was mentioned on the site. 






The device is packed into a metallic case. It's not big (140mm x 284 mm x 32 mm), that is why it can be put anywhere, even hung onto the wall. Its front panel houses: 

  • 8 10/100Base-TX ports; 




  • LEDs, three for each port (on the right), show the speed of the port, duplex on/off, data transfer and collisions; 

  •  





  • 2 WAN ports (into the external network); 
  • LED of connection to the WAN port; 
  • power supply LED; 
  • error LED (it indicates an error during autodiagnostics); 
  • LAN/WAN data transfer LED (from inside into the external network and back); 
  • "Backup Active" LED (via ISDN or analog modem), when the primary WAN channel fails. 

Back view: 

     



  • RS232 serial port used for console management of the router; you can also connect an analog or ISDN modem in order to use a backup channel when the main channels fail to work; 
  • DIP switches used for disabling an integrated DHCP server, setting default configurations; (for example, when a password is lost), switching on/off console control or preparing the device for firmware update; 

  •  

     




  • power connector and switch; 
  • RESET. 

As you can see, the router is stuffed with loads of various functions. Now take a look at its specs. 

  • 50 MHz RISC processor; 
  • 4 MB RAM; 
  • 512 KB flash memory (for internal OS) supporting firmware update via TFTP; 
  • Eight 10/100BaseT Switched Ethernet LAN ports; 
    • 10/100 Mbit port speed in the halfduplex and fullduplex modes; 
    • auto detection of straight-through and cross cables; 

  • 2 WAN ports (RJ-45); 
    • up to 10 Mbit in the full- and half-duplex modes; 

  • Router performance - up to 8Mbit both ways (WAN - LAN); 
  • unlimited IPSEC and PPTP sessions transferred and one L2TP session; 
  • traffic balancing between two WAN ports; 
  • backup channel mode (if a line on one of the ports fails, the other port takes the whole load); 
  • different types of lines can be used for different WAN interfaces (Cable/T1/DSL); 
  • RS232 serial port for modem or console control; 
    • Port's speed up to 230 Kbit; 
    • ISDN and analog modems support; 

  • Backup channel function in case a line fails on the WAN interfaces; 
  • SNMPv1 monitoring; 
  • Internet access technology - NAT; 
  • Integrated DHCP server; 
  • Dynamic DNS server supported; 
  • Up to 253 hosts in a local network; 
  • DMZ zone for one host; 
  • Port redirect (virtual servers); 
  • Programmable static routing table; 
  • RIP v2 routing protocol support; 
  • Integrated firewall with configurable filters; 
  • Remote control via WEB interface or telnet; 
  • Power supply - 9 V, 1 A. 

Circuit design





Here you can see the Samsung S3C4510B network controller. This is a RISC processor working at 50 MHz. It's often used in such devices. 





The second chip is Broadcom BCM5317; this is an 8-port Fast Ethernet controller. Here are its features: 
  • 8 10/100 Mbit transceivers (IEEE 802.3u compatible); 
  • 9 medium access controllers (IEEE 802.1x compatible); 
  • 256 KB packet buffer; 
  • 4KB buffer of MAC addresses; 
  • nonblocking architecture; 
  • Auto MDI/MDI-X on all ports (automatic detection of straight-through and cross cables). 

The WAN interfaces use popular Ethernet Realtek RTL8019AS controllers: 




Besides, there is a 4 Mbit (512 KB) flash memory chip, a serial port controller and two chips of usual memory. 

The specified performance (data transfer from LAN to WAN or back) is 8 Mbit. That is, when both ports are used (the theoretical speed of each is 10 Mbit), the overall performance doesn't exceed 8 Mbit. Probably, it's on account of the too slow memory interface. The router uses two 16-bit V54C316162VT6 memory chips, each of 16 Mbit. Both have 6ns access time, and the working frequency doesn't exceed 166 MHz. For analyzing a packet and defining its route the processor must read it from memory, analyze and, probably, change and write back. The same interface must be available for other devices as well, for example, a Fast Ethernet controller which translates packets from/into LAN. That is why the overall memory bandwidth is distributed among respective modules. And mostly likely, it's not enough for speedy data streams. 

Configuration menu.

The Nexland PRO800 Turbo can be set up in the console (via the serial port of the terminal) and via the WEB interface. Here is the console: 




This is a root menu, there are no others. This option can be used only for restoring settings to default ones (or assigning an IP address) after an error in the WEB settings.  

The steps of setting up the router via the WEB interface are given in the guide. Besides, the interface is a breeze to use; it has tips on each configuration screen. The number of settings and ease of use are astounding. Let's dive into them.




To connect the WEB interface you must enter http://192.168.0.1 in the browser (default address) and you will get into the configuration menu. 






The main menu makes possible to change parameters of WAN interfaces such as IP addresses of interfaces and DNS servers, a mode of the interface (main or backup), enable PPPoE connection and change a MAC address of the interface (in the current firmware version the latter option didn't work - after changing the MAC address and rebooting the old MAC address was restored). And in the status menu you can look at the current status of WAN ports and main settings of the router. 

Here you can also find out the version of the installed OS (firmware), I used the last available version V1 Rel 5T. 

Modes of the WAN ports

The ISB 800PRO Turbo mode supports operation of both WAN interfaces in two different modes. And both WAN interfaces are connected to different communication lines (and probably, to different providers). 

Now about the load-balanced mode. If just one user works at the moment, the load hasn't to be balanced, as he/she uses one WAN interface. But if they are two or more, the balancing mechanism will distribute the users among the WAN interfaces. Thus, it's possible to reach an almost doubled throughput and use the bands of both communication lines the most optimal way. 

In this mode the overall speed can be higher than in case of a single interface (due to the limit to 8 Mbit). But even if both channels are not used entirely, we can benefit at least because pings of the packets are smaller with such balancing. It's possible to set maximum percentage for usage of the interfaces. By default, it's 50%. 

If necessary, you can bind the host from the LAN to a certain WAN interface, and it will always get into the external network through it. Ordinary users won't need it, but sometimes it can be useful for local servers visible from outside. 

The second mode of the WAN interface is a backup channel mode. In this case only one interface operates (by 100%), while the second is in the standby mode. If the first fails (it can be checked by pinging a certain host indicated in the configuration), the router will move the load onto the second interface. It's also possible to shift the load to the RS232 port with a modem connected (this mode can also be selected with DIP switches on the back). 

Thus, error-free operation of the channel is more secured - should one line fail (if the router is connected to one WAN) or both WAN lines fail (which is unlikely), you will have a low-speed Internet connection via a modem. 

It's clear that all tricks with two WAN interfaces are possible only for those who have two dedicated lines. There are not many such users out there. That is why the others should go with the ISB 800PRO which has only one WAN port. You can save about $100. 

DHCP




The Nexland PRO800 Turbo can receive necessary settings for its WAN interfaces from a provider and has an integrated DHCP server which allows assigning IP addresses to 253 hosts in the network. It's possible to bind IP addresses to MAC. 

Configuration access restriction




By default the router is not password protected. It should be immediately set up or you should restrict access to telnet and WEB interfaces for everyone except the administrator and authorized people, using access restrictions in the tab of expert options. 

SNMP

The router supports the SNMP protocol ver.1. The Simple Network Management Protocol allows checking different parameters of the device and current traffic in the real-time mode. You can also send SNMP messages (SNMP traps) to any host of your network. 

Dynamic DNS




The Internet has a lot of services of the dynamic DNS. The documentation of the router describes operation with dyndns.org. These services are used if an IP address assigned to you is dynamic (i.e. it changes each time you connect the network). But if WWW or FTP servers are loaded you should use a static URL (domain name). Of course, you can forgo a static name, but how will others find your WWW server? It's not a good idea to inform all interested people about your new IP address. That is why an IP address for a static URL (for example, myhome.nexland.net) is changed by the dynamic DNS. 

After you have chosen a domain name and registered at one of the services of the dynamic DNS, you should configure the router so that information on your new IP address will be updated at the dynamic DNS service. After that your domain name will always indicate at the current IP address the router received during the last connection to the provider. 

Routing table.




Nexland PRO800 Turbo lets you add routes manually in the routing table. Besides, it supports the RIP2 routing protocol. It builds routing tables on all network's routers automatically, provided that all routers support this protocol. That is why the ISB PRO800 Turbo can be used in larger networks divided into subnetworks by the routers. 

Hosts and groups.




Here you can bind an IP address to MAC (which strengthens network security), provide a certain IP address only for a definite MAC address or bind a certain IP address to one of the WAN interfaces. Thus you can use a dedicated interface for an FTP server and leave the other for Internet-users so that the FTP server won't bother users. In the same section you can combine IP addresses of a group. Groups are used to arrange filtering. But they are 4 in all (plus "everyone"). It's not enough for a large network. Moreover, you can't put a range of IP addresses or a whole subnetwork into a group. You will have to list addresses one by one. Do you realize how much time it can take to enter 128 addresses into the second group? 

Access filters.




Using filters you can limit some groups of IP addresses to certain protocols or forbid the Internet access at all for them. For example, you can let workers of the first department use only e-mail and WEB. Apart from the specified protocols you can add 10 your own ones (5 for TCP and 5 for UDP) by setting a port address or their range. Unfortunately, the interface of handling the filters is far not convenient. All filtering rules can be set for groups. But we have only 4+1 groups. Besides, it's impossible to "forbid everything except...". Such model can be realized through user protocols, but it's not always possible either. Moreover, you can't fix time intervals for the filters, for example, forbid WWW and FTP only in the working hours. 

Virtual servers.






The mechanism of virtual ports can make a server located behind the router (in LAN) visible from the Internet. Usually, none of the LAN machines can be seen from the Internet. But in the virtual ports' menu you can assign a port (for example, 80 - WEB) on the router and an address/port inside the LAN to divert the request. Thus, an Internet user, when addressing an external address, sees a WEB server located on the 80th port of the router. In reality, the server is located on the LAN, behind the router. The WEB server on the LAN defines a request from the Internet and processes it a standard way. For virtual servers you can assign both predefined and your own ports. In the latter case you can set a range of ports. 

DMZ zone.




This option has both pros and cons. One of computers inside a local network can be exposed so that all its ports can be seen from the Internet. It can affect security but sometimes it must be done, for example, in case this computer has the IDS (Intrusion-Detection System). But in most cases you can do with features of virtual servers. 

Nonstandard applications.




The router allows working with programs which use bidirectonal data exchange protocols. For this purpose you must set in the configuration ranges of the ports used in these protocols. The device provides operation only with low-speed protocols of this type. 

Expert options.




Here you can make settings for traffic balancing between WAN ports and assign SMTP (email) traffic to a certain WAN interface (it's useful if a provider which keeps your e-mail box permits an access to its SMTP server only from certain routes (for example, from a line connected to the WAN1)), change an MTU size for WAN interfaces and other options we mentioned above. Besides, by disabling the NAT function you can turn the Nexland PRO800 Turbo into a bridge. 

VPN support.

The ISB PRO800 Turbo supports virtual private networks. Formally, the router can pump an unlimited number of IPsec/PPTP (IP Security/Point-to-Point Tunneling Protocol) tunnels, as well as one more L2TP session. But actually, their number is limited by the memory onboard. The above protocols are needed to build encrypted connections between end hosts or networks via the Internet. But they can't work with the NAT due to their specific character. However, Nexland modified the NAT mechanism. Note that the router can only support VPN sessions; it is not a server of IPsec or other protocols. Most routers of this class can work with just one protected session. On the other hand, a local network doesn't send often more than one VPN tunnel. Well, just remember that a VPN is not a cure-all. If set up incorrectly, the due security won't be provided. For example, using this tunnel you can get into a protected network using holes in security of a network located on the other end of the encrypted tunnel. In the router's configuration you can set different types of the IPsec protocol, including the "other" type which is used when the protocol doesn't work with the NAT. In this case the IPsec server is taken into the DMZ zone. I checked operability of the FreeS/WAN (IPSEC and IKE under Linux) with the router and everything proved to work flawlessly. 

Testing technique

Testbeds (2 computers): 

  • Platform - Asus Terminator 
  • Processor - VIA C3 866MHz 
  • Network adapter - Intel Pro/100+ Management Adapter 
  • Memory - 128MB SDRAM 
  • Hard drive - Maxtor 20GB 
  • OS - Linux 2.4.19 

One of the computers was connected to the local network (i.e. to the router's local port), and the other to the external network (to the WAN port). The tested device was put between them. Then we started up the traffic generators and took the measurements. This way we estimated throughput of the router. The integrated switch (for 8 ports) wasn't tested as its speed is higher than the routing rate. 

For traffic generation and readout we used the Iperf 1.62. Each test was carried out 15 times and then the best result (in speed) was selected. The second utility we used was netPIPE 2.4. The program generates traffic with a gradually increasing data packet (a packet of size N is transferred several times, the number is inversely proportional to the size but not less then 7). This scheme can show you percentage of the channel utilization relative to the size of data transferred. 

Startup parameters for Iperf:
Client: iperf -c 10.0.2.1 -w 64K -l 24K
Sever: iperf -s -m -w 64K -l 24K 

Startup parameters for netPIPE:
Receiver: NTtcp -b 65535 -o logfile -P -r
Transmitter: NTtcp -b 65535 -o logfile -P -t 

Test results

Iperf results.
The programs generates a unidirectional TCP that is why all three possible situations are modeled. 
 

Transfer type Transfer direction Rate, Mbit/s
Unidirectional traffic From external to internal network 3.5
Unidirectional traffic From internal to external network 7.7
Bidirectional traffic Both ways 2.7(from outside) and
3.2 (from inside out)

To some reason, the traffic rate from the external network into the LAN is twice as low as into the WAN. The total speed doesn't catch up with the specified one, probably because of the improper traffic generation program. 

NetPIPE results.
The program generates traffic using the Ping Pong approach. That is why the data rate will be the same irrespective of where is the netPIPE client and where the server. The maximum peak data rate is 4.66 Mbit/s.




Again the transfer speed is lower than the indicated in the specs, but it's still enough for most dedicated lines. 

Security test

In this test we used a freeware network security scanner Nessus 1.2.6. We scanned the external WAN port with all available plugins from the list. No problems were noticed. However, it doesn't mean they will never crop up. On the other hand, problems can arise mainly because of flaws in realization of the TCP/IP stack. But the developers at Nexland have given this realization a very thorough thought. 

Conclusion

The Nexland ISB Pro800 Turbo will please many. It's crammed with various features. The only weak point (though many would hardly even give it a thought) is an inconvenient and scant integrated firewall which controls access of local clients. For many the filtering means the router provides will be sufficient. 

Highs

  • Two normal WAN interfaces. 
  • Support of IPsec and other encrypted VPN tunnels. 
  • Support of a great number of IPsec tunnels. 
  • Rich means for backup of communication channels. 
  • Traffic balancing between channels. 
  • Possibility to bind IP addresses to MAC. 
  • Dynamic DNS service supported. 

Lows 

  • Inconvenient system of groups (few groups and its impossible to enter a range of IP addresses into a group). 
  • Awkward and scarce system of filters. 
  • It's impossible to bind filtering parameters to time. 
  • It's impossible to change a MAC address on the WAN interface, though it was specified (probably it will be corrected in the new firmware version). 
  • And it's impossible to configure the device from a command line (via the console). 


 

Evgeniy Zaycev (eightn@ixbt.com)
 

Write a comment below. No registration needed!


Article navigation:



blog comments powered by Disqus

  Most Popular Reviews More    RSS  

AMD Phenom II X4 955, Phenom II X4 960T, Phenom II X6 1075T, and Intel Pentium G2120, Core i3-3220, Core i5-3330 Processors

Comparing old, cheap solutions from AMD with new, budget offerings from Intel.
February 1, 2013 · Processor Roundups

Inno3D GeForce GTX 670 iChill, Inno3D GeForce GTX 660 Ti Graphics Cards

A couple of mid-range adapters with original cooling systems.
January 30, 2013 · Video cards: NVIDIA GPUs

Creative Sound Blaster X-Fi Surround 5.1

An external X-Fi solution in tests.
September 9, 2008 · Sound Cards

AMD FX-8350 Processor

The first worthwhile Piledriver CPU.
September 11, 2012 · Processors: AMD

Consumed Power, Energy Consumption: Ivy Bridge vs. Sandy Bridge

Trying out the new method.
September 18, 2012 · Processors: Intel
  Latest Reviews More    RSS  

i3DSpeed, September 2013

Retested all graphics cards with the new drivers.
Oct 18, 2013 · 3Digests

i3DSpeed, August 2013

Added new benchmarks: BioShock Infinite and Metro: Last Light.
Sep 06, 2013 · 3Digests

i3DSpeed, July 2013

Added the test results of NVIDIA GeForce GTX 760 and AMD Radeon HD 7730.
Aug 05, 2013 · 3Digests

Gainward GeForce GTX 650 Ti BOOST 2GB Golden Sample Graphics Card

An excellent hybrid of GeForce GTX 650 Ti and GeForce GTX 660.
Jun 24, 2013 · Video cards: NVIDIA GPUs

i3DSpeed, May 2013

Added the test results of NVIDIA GeForce GTX 770/780.
Jun 03, 2013 · 3Digests
  Latest News More    RSS  

Platform  ·  Video  ·  Multimedia  ·  Mobile  ·  Other  ||  About us & Privacy policy  ·  Twitter  ·  Facebook


Copyright © Byrds Research & Publishing, Ltd., 1997–2011. All rights reserved.