I've got an opportunity now to replace my Linksys BEFW11S4 AP/router (i.e. I'm thinking of palming it off on someone). I could just get the current Linksys similar thing, but there's one thing it does that I wish it did better, and that's filtering.

I leave my home network open, as I don't mind if the neighbours use it for a bit of casual web browsing or Messenger or whatnot, but recently people have taken to running P2P over it and soaking up all my bandwidth. So I set up filtering: BEFW11S4 can drop UDP or TCP traffic by port number. I filter out all non-privileged ports except the ones Messenger uses, and no P2P traffic gets through. The problem is, it filters out both incoming and outgoing connections indiscriminately, so when the filter is on, I can't SSH in from work, because although the remote (home end) SSH port is privileged and allowed, the local (work end) port is random, so the traffic gets dropped.

So does anyone have a recommendation for an AP/router with smarter filtering, or another way to solve the problem? Separate filter settings for incoming and outgoing connections would solve the problem (all incoming connections other than SSH are already dropped, as only the SSH port gets forwarded anywhere), as would separate filter setings for different local IPs (as the drive-bys all DHCP and end up in a different range than the statically-addressed PC I'm trying to SSH to).

What would be best of all, I suppose, would be traffic shaping per IP range, so I wouldn't need to filter anything, and could just restrict the drive-by IPs to 10% of the connection or whatever. But I bet only expensive enterprise-grade AP/routers do stuff like that. How simple are these replace-the-stock-Linux-firmware APs to set up? I really want this stuff to just work and have no appetite for tinkering with it...

Peter

It's a little more expensive, but a SonicWall TZ170 can do all of that. Has a DDNS client built in as well as Static DHCP, Firewall, and Bandwidth management (by ip address range or port). If you'd like to log in and take a look at one of mine, PM me. (note: linked one is not a WAP, just a firewall/router. They make one with wireless also for a few bucks more.)

I'd imagine that a WRT54GS can do all of that with upgraded firmware, but I've had mixed results. Of the three that I've upgraded, one of them bricked on me for no apparent reason. I was not able to recover it even using the hardware reset methods on the net. One of the others was never quite stable. The third one worked great.

An easier solution might be a two access point setup. Set the first router up how you want and throw it WPA encryption on the wireless. Set up the second router behind the first router with the restrictive firewall in place to stop P2P and keep the wireless on it open.

The double NAT on the open side will also kill off some things, but web and basic IM still work fine over such a setup.

I would say to just set up a separate router/firewall and AP. You could then get a firewall that has some actual features, as opposed to the consumer-grade crap that the Linksyses and NetGears give you. But that may well fail your "have no appetite for tinkering with it" criterion.

I believe that all (?) of the features on your wish list are available on the Linksys AP/Routers when used with SveaSoft firmware. And possibly with other firmwares, like perhaps OpenWRT.

Cheers

I will second that, though the web-based config will only get you so far, and you'll need to futz with storing iptables and (name of the command-line util to set QoS stuff that I can't remember) commands in the rc_firewall setting in nvram. This violates my interpretation of peter's lack of tinkerphilia.