How to Choose a Router for Your Business
By Eric Geier, PCWorld

Buying a router for a business isn’t as simple as picking a consumer product with the best ratings from an online merchant or the best price on the shelf at a local electronics superstore. Your company has serious needs, such as supporting scores of users (including guests) on the network, and locking down company data to guard against snoops.

Before shopping for networking gear, you need to understand the types of equipment available, as well as their typical uses and features. Read on for an introduction to router equipment, along with an explanation of the features to watch for.

Types of Routers

If you need to support only a dozen computers and Wi-Fi devices at the most, a simple consumer or small-business wireless router should suffice. These routers typically provide enough Wi-Fi coverage for a 1500- to 2000-square-foot, two-story office space. They’ll provide four ethernet ports for hard-wiring computers into the network or for adding other components, such as network-capable printers, network storage, or additional wireless access points for more Wi-Fi coverage.

If you need to support more than a dozen computers and devices, or if security is crucial to your operations, you need something more than a simple wireless router. You have two main types to consider.

VPN router/firewall: These products, a step up from a basic wireless router, can be wireless or ethernet-only; the latter type requires that you add access points for Wi-Fi coverage. These routers have an integrated virtual private network server, and sometimes offer advanced features (more on those later) such as VLAN support and multiple SSIDs (if wireless).

UTM (unified threat management) gateway or firewall: These routers include advanced features and usually are ethernet-only with four to eight ports, thus requiring separate access points for Wi-Fi connectivity. In addition to serving as your router and Internet gateway, as well as providing a VPN server and firewall, these units typically also include virus and malware protection, content filtering, antispam functions, and intrusion detection and prevention.

The additional security features usually require monthly or yearly subscription fees. You’ll still want virus and malware protection on each user computer due to the limitations of network-based products, though, since they can’t monitor local behavior on PCs or inspect SSL-encrypted traffic.

As you shop, you’ll probably encounter other buzzwords referring to devices that are similar to UTM products, including unified security gateways and Internet security appliances.

Expanding Ethernet Ports or Wi-Fi Coverage

If you require more ethernet ports than what a router, gateway, or firewall provides (regardless of the type), you’ll need to purchase an ethernet switch. This device is basically a smart hub that expands the amount of ethernet ports you have, similar in concept to a USB hub or even an electrical power strip. You’ll find a few different types.

An unmanaged switch is the simplest; it doesn’t require any configuration, but lacks advanced features and is best for small and uncomplicated networks. A smart or web-managed switch allows configuration of the switch ports–supporting popular advanced features such as VLAN, bandwidth control, 802.1X authentication, and SNMP–and is suitable for most small to midsize businesses.

If you need more Wi-Fi coverage than a wireless router can give, or if you choose an ethernet-only router/gateway/firewall, you can add wireless access points to your network. Access points are, in essence, wireless routers that lack the routing capability. You connect an access point by running ethernet cabling from its single ethernet port to a port on your router/gateway/firewall or switch. The most basic access points broadcast a single SSID (network name), whereas most business-class access points support VLANs and allow you to broadcast multiple SSIDs.

Standards and Features for Wi-Fi

When shopping for a wireless router or access points, note that the different wireless standards each have varying maximum speeds. At the least, you’ll want to go with802.11n (which some vendors call Wireless-N). If you have close neighbors, consider a dual-band router or access point that also works in the 5GHz frequency band, which provides more channels and is less congested than the common 2.4GHz band.

Starting in late 2012, keep your eyes open for routers and access points supporting the newer 802.11ac standard, which will offer even higher speeds. However, the earliest 802.11ac products likely will be based on the draft specification, and may not be upgradable to the full, completely finalized standard.

Remember, your Wi-Fi-equipped computers and devices will achieve the highest possible speeds with newer 802.11n and 802.11ac routers or access points only when they too support the same standard. All of the wireless standards are backward-compatible with one another; but computers or devices using an older wireless standard won’t perform as well, and they can even negatively affect the performance of your entire wireless network

If you have laptops, netbooks, or desktops that support a wireless standard that’s older than that of your wireless router or access points, you can upgrade them with a PCI card, PCIe card, PCMCIA card, or USB wireless adapter. Wi-Fi smartphones and tablets, however, aren’t usually upgradable.

Ethernet Considerations

When buying any networking gear that has ethernet ports, consider the following related features and specs.

Ethernet speed: For routers, gateways, firewalls, and switches, focus on those models that support gigabit ethernet (1000 mbps) for higher speeds on your hard-wired computers. Keep in mind the speed that each of your computers supports, which you can upgrade with a PCI or PCIe ethernet card.

Switching capacity: If you do require a network switch, assess competing models’ switching capacity to compare the total maximum simultaneous bandwidth supported.

Dual or backup WAN: If Internet access is crucial to your operations, consider routers, gateways, or firewalls that have a second WAN port or that support a 3G/4G card for failover or load balancing in case your main Internet connection goes down.

PoE support: If you plan on running wireless access points throughout, consider routers, gateways, firewalls, switches, and access points that support Power over Ethernet so that the power can run through the ethernet cabling with the data. This feature can save time and money, in contrast to the effort it might take for you to place access points near electrical outlets or to run new electrical lines.

DMZ port: If you have a server or another device that needs direct access to the Internet, consider a router, gateway, or firewall that has a dedicated DMZ port. Remember, though, that most models allow you to assign certain computers to the DMZ via the settings, without a dedicated port.

VPN Server for Secure Remote Connections

A router, gateway, or firewall with a VPN server supports remote connections so that users out of the office can securely access the network, or so that multiple offices can link together in a site-to-site arrangement. A few different VPN types are available.

PPTP: Nearly all operating systems and mobile devices support Point-to-Point Tunneling Protocol with a built-in VPN client, but it doesn’t have the best security. Connectivity issues can arise when users remotely connect from networks that don’t allow VPN pass-through.

L2TP/IPsec: Also widely supported among operating systems and popular mobile devices, Layer 2 Tunneling Protocol has better security than PPTP. However, it’s usually more complicated to configure, and it too can produce connectivity issues when users remotely connect from networks that don’t allow VPN pass-through.

SSL: The Secure Sockets Layer protocol allows remote users to connect via a Web browser–eliminating the VPN pass-through issue–and doesn’t require full client software. You can install a small plug-in via the browser to facilitate tunneling of a user’s Web browsing and email traffic. Additionally, some SSL VPN methods offer a Web portal in which users can access applications and email without any VPN client; such a setup would be convenient when they need to connect from home or on another noncorporate computer rather than on a work laptop.

OpenVPN: This protocol is usually included only on routers preloaded with the open-source DD-WRT firmware, and most built-in clients on computers or mobile devices don’t support it. As a result, you’ll have to install third-party VPN client software on the computers or devices for remote user connections. But OpenVPN offers greater security and more reliable connections from networks that don’t allow VPN pass-through.

VLAN Support to Separate Traffic

Most business-class networking gear supports virtual LANs, which allow you to create multiple separate virtual networks inside a single network. You can, for example, create one VLAN for your private network (or more to support different departments) and another for public access by visitors; this arrangement prevents the guests from connecting to your computers or snooping on your traffic.

You can create VLANs on your router, gateway, or firewall, and then you can assign each ethernet port to a VLAN (and one to the SSID, if it’s wireless too). If you’re also using a separate switch that supports VLAN, you can assign each of its ports to a VLAN.

Multiple SSIDs to separate Wi-Fi traffic: Business-class wireless access points and wireless routers typically support multiple SSIDs, in what is basically a wireless variant of a VLAN. You can create multiple network names to broadcast from a single access point or wireless router, each with its own wireless and security configuration. Then you can assign each SSID to a VLAN.

Wireless guest access to secure private traffic: Some of the more advanced consumer-level wireless routers have a guest feature, which uses VLANs and multiple SSIDs to create a separate Wi-Fi network for visitors. This is a great way to quickly and easily create a secondary wireless network, but typically it doesn’t allow configuration such as adding custom VLANs or assigning ethernet ports to the guest VLAN.

USB Port to Share Files or Printers

Some premium consumer-level wireless routers have a USB port so that you can plug in a USB flash drive or hard drive to share files on the network. Though you can always share folders to the network in Windows, sharing at the router provides a central storage location and doesn’t require a certain PC to remain powered on. But keep in mind that most routers offering USB port sharing require you to install software on the PCs in order to access the shared drive.

Business-class routers, gateways, and firewalls usually don’t have USB ports. To compensate for that, you can buy or create a separate component called a network-attached storage device. Your NAS can provide many more sharing features, including native sharing, in which no software is required on PCs for you to access the storage, as well as the ability to control who has access to the shares.

Quality of Service Support to Prioritize Traffic

Most routers, gateways, and firewalls provide a Quality of Service feature that lets you prioritize network traffic. You can, for example, give voice and video traffic (from VoIP phones or Skype, for instance) higher priority since they’re much more sensitive to lags than Web browsing and other traffic. Another example is giving a certain computer or device more priority than others, or less priority for guest access.

Even the majority of advanced consumer-level wireless routers have QoS settings, but business-class equipment may allow more customization and more sophisticated functionality.

RADIUS Server to Run Enterprise Wi-Fi Security

If your business has more than a dozen or so wireless computers and devices (including smartphones and tablets), consider using enterprise-class Wi-Fi security (WPA or WPA2 with 802.1X), which lets you create a unique username and password for each user that connects via Wi-Fi.

The personal or pre-shared key (PSK) mode of WPA or WPA2 is easier to set up than the enterprise mode, but it isn’t ideal for business networks. It lets you create only a single password for the Wi-Fi network, which becomes an issue if a laptop, tablet, or smartphone is lost or stolen: If a computer or mobile device were to go missing, you would want to change the Wi-Fi password so that the thief couldn’t come to your location and connect, but that would mean changing the password on all of your other Wi-Fi computers and devices as well.

To use the enterprise mode of WPA or WPA2 security, however, you must have a RADIUS server, which handles the 802.1X authentication. You can set up your own with the open-source FreeRADIUS server if you’re a Linux administrator or if you purchase a Windows program such as Elektron. If you don’t want to run your own server, consider buying an access point with a built-in RADIUS server, such as from ZyXel. Alternatively, use a hosted RADIUS service if you don’t want to run one at all.

Content Filtering to Block Inappropriate Sites

Many consumer-level routers have a built-in feature to block specific sites, while more-advanced models and UTM gateways may have a more comprehensive filter to block adult sites, malware, and other inappropriate material automatically. However, don’t worry too much about this feature when choosing your router: You can always use the freeOpenDNS service to provide filtering for your entire network on any router.

Routers on the Market

Smaller businesses can usually get away with using a consumer-level router. But if you require more functionality or security, consider a VPN router/firewall or a UTM gateway. Here’s what several current router and gateway models offer.

• D-Link Xtreme N Gigabit Router (DIR-655): This advanced consumer-level wireless router supports gigabit ethernet and sports a wireless guest feature, QoS settings, and a USB port for sharing a drive or printer.
• Cisco Wireless Network Security Firewall Router (RV220W): In this business-class wireless router, you’ll find dual-band Wi-Fi and gigabit ethernet. Additionally, it provides several VPN-server options, VLANs, and multiple SSIDs.
• Netgear ProSecure UTM Firewall with Wireless N (UTM9S): A UTM firewall/gateway offering dual-band Wi-Fi and gigabit ethernet, this product provides antimalware and antispam functions, content filtering, and intrusion protection. It supplies dual WAN support, several VPN-server options, VLANs, and multiple SSIDs, too.

Finally, consider buying a consumer-level wireless router and uploading aftermarket open-source firmware such as DD-WRT to give it business-class features and to add customization. Or, purchase preloaded routers at a site such as Flash Routers.

Eric Geier is a freelance tech writer. Become a Twitter follower to keep up with his writings. He’s also the founder of NoWiresSecurity, which helps homes and businesses easily protect their Wi-Fi network with Enterprise (802.1X) security.

What Separates Business Routers From Consumer Routers?

By Michael Brown, PCWorld

If you’re in the market for a new router for your small business, you might be tempted by the flashy features, high speeds, and low cost of consumer-oriented routers. The latest models, based on the IEEE 802.11ac standard, look particularly attractive.

But can a consumer router deliver everything your business needs? Is it sufficiently secure? Is it scalable? Does it provide redundant connections to the Internet? If it’s a wireless model, does it provide enough range to cover your entire office?

Should you instead invest in a router that’s specifically designed for the needs of small- to medium-size businesses? What exactly distinguishes a consumer router from a business-class model, anyway? Glad you asked.

Consumer Router Priorities: Speed, Media Streaming, and Security

Walk into your local electronics retailer or shop online, and you’ll find at least a dozen consumer wireless routers selling for $100 or less, from such well-known brands as Asus, Buffalo, Cisco (Linksys), D-Link, and Netgear.

The prices are certainly appealing. Even better, all the essential features seem to be in place, including compatibility with the IEEE 802.11n wireless networking standard, a four-port ethernet switch,wireless encryption, and a built-in firewall. Most routers in this class have 2×2 antenna arrays (two transmit and two receive antennas), which are capable of handling two 150-megabits-per-second spatial streams (one on each antenna) for a total theoretical throughput of 300 mbps. You’ll never see real-world performance that fast, however; overhead, distance between the client and the router, and environmental factors can whack that number down. The industry refers to this class of router as “N300.”

Many lower-end consumer routers are dual-band models, capable of operating wireless networks on both the 2.4GHz frequency band and the 5GHz band. The 2.4GHz band delivers better range–but since it provides only two nonoverlapping channels, and since so many routers have been deployed, the spectrum has become congested. The 5GHz band boasts 23 nonoverlapping channels, so it’s significantly less crowded, but it provides much less range. Many people use the 2.4GHz band for data and Internet access, and reserve the 5GHz band for streaming audio and video over their network.

The industry refers to this class of router as “N600,” but the term is misleading because it implies that routers in this class can stream data at 600 mbps. They can’t. The N600 claim comes from summing the speeds of the two concurrent but independent 300-mbps networks. You’ll never be able to connect a client to either network and expect it to stream data at 600 mbps, nor can you connect a single client to both networks simultaneously.

Move up the consumer market to the $200 price range, and you’ll see more-advanced dual-band routers from the same manufacturers. These devices come outfitted with 3×3 antenna arrays and promise a theoretical throughput of 450 mbps on each band. Routers in this class are often described as “N900” models; here again, however, it’s not because they can deliver throughput to a single client at 900 mbps. Typically these routers are also outfitted with a four-port ethernet switch, but they support wired connections at gigabit speeds, versus the 100-mbps switches on less-expensive routers.

The IEEE 802.11ac wireless networking standard isn’t likely to be ratified before early 2013, but that hasn’t stopped router manufacturers from introducing routers based on the latest draft definition. We saw a similar pattern of events when the 802.11n standard was being finalized.

Only two such routers are on the market right now: The Buffalo WZR-D1800H arrived first, followed by the Netgear R6300. Both manufacturers are aiming their products squarely at consumers, emphasizing the devices’ ability to stream media. Thanks to a much-improved modulation scheme, 802.11ac routers can pack more data into each spatial stream: 450 mbps, versus 150 mbps for 802.11n. An 802.11ac router with a 3×3 antenna array can deliver a theoretical throughput up to 1300 mbps (1.3 gigabits per second). Buffalo, for one, is marketing its product as an “AC1300” router.

Since there’s an outside chance that these products will be incompatible with equipment based on the final standard, we don’t recommend buying such devices for your business.

Consumer-Router Features

One feature you can expect to find in a high-end consumer router is one or even two USB ports. Through such ports, networked computers can easily share a USB printer and a USB hard drive. Although this might seem like an attractive feature in a router, anything but the tiniest small business will be better served by printers and NAS (network-attached storage) devices that have built-in networking capabilities. A printer with built-in networking features won’t limit you to the length of a USB cable when you deploy it. USB storage devices, meanwhile, are slow and top out at 2TB, whereas a high-end NAS can deliver as much performance and storage capacity as a small server can.

Here are some of the other features you’ll find in the typical consumer router:

• Quality of Service:This term describes a router’s ability to prioritize different types of data traffic. For instance, if data packets drop during a file transfer, the router can repeatedly resend those packets until you’ve received the entire file. It might take a fraction longer, but you’ll eventually receive the entire file intact, and it’s largely irrelevant how many packets were dropped and resent in the process. However, if packets drop while the router is streaming music or video, or while you’re in the middle of a phone conversation, you’ll experience unpleasant dropouts and glitches. Routers with strong QoS capabilities can assign top priority to lag-sensitive media and VoIP traffic by throttling lag-insensitive file-transfer traffic. This is a good feature to have if you use VoIP equipment instead of a landline.
• Parental controls: This feature is designed to limit when client PCs have Internet access, and where those clients can go on the Internet. If you have children, you might configure the router’s parental controls so that they can’t access porn sites, or play online games during hours when they should be doing homework.

• Guest network: This is a virtual network that can allow your guests to access the Internet while barring them from accessing computers, printers, NAS boxes, and other devices on your network. (Some routers allow you to run a guest network without any security, but that isn’t a good idea.) A guest network can be as handy for a small business as it is for a consumer.

• Built-in media server: Consumer routers are increasingly focused on streaming media, so it only makes sense that they’d have integrated servers for this purpose. UPnP (Universal Plug and Play) is the bare minimum. Advanced models add DLNA (Digital Living Network Alliance) and even iTunes servers.

• Lightweight VPN support: A VPN (virtual private network) allows remote users to access your network through a secure Internet pathway (often referred to as a tunnel).

• Integrated firewall: A firewall is a security mechanism designed to prevent intruders from accessing your network from the Internet.

• Wi-Fi Protected Setup (WPS): Operating a wireless network without encryption is asking for trouble. WPS helps consumers set up a wireless network with ease: You simply push a button on the router and a button on the client to establish a secure connection via WPA or WPA2 (see below). A recent discovery, though, has revealed that a brute-force attack can defeat this kind of security within a few hours. If your router supports WPS, you should disable it (if possible), whether you’re running it at home or at the office.

• WEP/WPA/WPA2: These three security schemes involve the router and client exchanging preshared keys. WEP (Wired Equivalent Privacy), and to a lesser degree WPA (Wi-Fi Protected Access), have proven vulnerable to brute-force attacks. WPA2, which uses AES (Advanced Encryption Standard) encryption, remains relatively secure–provided that you establish a complex password.

• RADIUS: A few consumer routers support RADIUS (Remote Authentication Dial-In User Service) security. I’ll discuss RADIUS in more detail later.

Business-Class Router Priorities: Security, Remote Access, and Scalability

 

Now let’s turn our attention to business-oriented routers. Prices for low-end business routers start right about where consumer models top out, around $200, and they share many of the same features, such as a four-port switch, 802.11n wireless support, virtual networks, and QoS support (for VoIP applications).

Business routers, however, lack some of the features available in high-end consumer routers. You won’t find a convenient-but-insecure WPS button, for example, nor will you get USB ports for sharing a printer or storage. And it’s no surprise that you won’t find an onboard media server. Many entry-level business models have only a Fast Ethernet switch (10/100 mbps), and wireless models typically operate only on the 2.4GHz band. In this environment, raw speed is less important than supporting large numbers of users, because those users are typically only accessing the Internet, moving small files around the network, and using server- or Web-hosted applications.

What you will get in business-class routers at all price points is stronger security features, more flexibility in giving you access to your network from remote locations, and the ability to scale as your business grows.

In addition, SMB routers support the aforementioned WPA, WPA2, and RADIUS (also known as WPA-Enterprise) security protocols, but you should use only the latter two to secure your business’s network. RADIUS is the most secure option, but it is complicated to set up because it requires a dedicated server independent of the router. When a user logs on to a wireless network secured via RADIUS, a RADIUS client running on the router sends the user’s login ID and encrypted password to a central authentication server. The authentication server then sends one of several messages back through the router to the user: ‘Accept’ (in which case the user is authorized to access the network), ‘Reject’ (the user is denied access, and asked to reenter their credentials), ‘Challenge’ (the user is asked to provide additional information), or ‘Change password’ (the user is recognized, but asked to create a new password before gaining access).

More Business Router Features

You might be surprised to learn that many business-class routers don’t include integrated wireless networking. If the one you select doesn’t, you can easily add such capability by deploying one or more wireless access points.

Higher-end business routers, meanwhile, deliver scalability, redundancy, and even stronger security features. Scalabilitydefines the router’s ability to expand as your business grows. Expanding a network’s hardwired capabilities is easy: Plug another multiport ethernet switch into one of the router’s ports. Voila! More ports! (If you’re operating a complex network with a RADIUS server, multiple VLANs, and other features, you might need to invest in amanaged switch.)

The only way to increase your Internet bandwidth, though, is to get additional connections to your Internet service provider via your router’s WAN (wide-area network) ports. While consumer and low-end business routers typically have just one WAN port, higher-end business-class routers have multiple WAN ports, so you can establish more than one connection to one or more ISPs. Establish two or more connections to the same ISP, and you can improve your network’s performance through load balancing. Establishing two or more connections to different ISPs provides redundancy for business continuity (since it’s unlikely that two ISPs will suffer an outage at the same time). Cisco’s RV016 Multi WAN VPN Router ($450), for example, is outfitted with 16 Fast Ethernet ports, including two that serve as dedicated WAN ports. But you can configure five of the other ports to function as WAN ports (making a total of seven) for load balancing or redundancy.

Here are some of the other features you can expect to find in a business-class router:

• Robust VPN: Business-class routers provide virtual private networks that can handle many more users (anywhere from 5 to 100), while offering much stronger security than consumer models do. At its best, a VPN will provide an environment in which a remote user’s experience is no different than if they were working in the office and hardwired to the network.

• SSL portal and SSL tunnel VPNs: These types of virtual private networks rely on Secure Sockets Layer encryption, so that users can access the network using their Web browser. Through an SSL portal VPN, users access a gateway to the secure network and present their credentials. Once authenticated, they see a Web page that acts as a portal to other services on the network. An SSL tunnel operates in a similar fashion but adds active content–Java, JavaScript, ActiveX, Flash applications, and the like–that are not accessible with an SSL portal VPN.

• Virtual networks (VLANs): Known as guest networks on consumer routers, VLANs can perform the same function on a business-class router. But you can also set up other VLANs to segregate traffic on your network, so that sensitive data from one department–human resources, for instance–stays contained within that department’s own network. An entry-level business-class router is capable of supporting several virtual networks, while a high-end model can support a dozen or more.

• IPv6 support: IPv6 (Internet Protocol version 6) is replacing IPv4 as the protocol for directing Internet traffic. IPv4 uses 32 bits to define an IP address, which limits the number of addresses that can be created–and that limit has almost been reached. Since IPv6 uses 128 bits to define an IP address, it can create a much larger pool of addresses. Though many new consumer routers support IPv6, it’s a crucial requirement for a business-class router.

• DMZ port: If you have a computer that needs direct access to the Internet–an email or Web server, for instance–look for a router with a dedicated DMZ port. This feature will isolate that computer from the rest of your network on a dedicated subnetwork, so that if the system becomes compromised, the intruder won’t be able to gain access to the computers on your primary network.

• Content filtering: This feature is the equivalent of the parental controls in a consumer router. You can block access to certain Internet content by using keywords or blacklists (prohibited URLs), or by allowing clients to access only permitted sites through a whitelist.

• Wireless Distribution System (WDS): This protocol allows a wireless signal to be repeated by up to four repeaters in order to extend the network’s range. It’s increasingly common on consumer routers, too.

Which Class of Router Suits Your Business’s Needs?

In this overview, I haven’t covered every single feature that distinguishes business-class routers from their consumer cousins, but I have hit the high points. If you’re still wondering which type is right for you, consider these final tips.

If you want the best security features, if you have many employees who require frequent remote access to your network, if you run your own email, Web, or RADIUS server, or if you need to set up advanced VLANs, you should look long and hard at a business-class router. If you need load balancing or failover redundancy, you should be looking at the higher-end business models.

You can probably get by with a consumer router if you have just a few employees (who don’t require VPN access), if you don’t need sophisticated VLANs, if you don’t operate your own Web, email, or other type of server that needs to be hosted in a DMZ, and if you don’t plan to operate a RADIUS server. But when you compare prices, you might be surprised to discover that a consumer model won’t necessarily save you money.