If I wasn't already aware of pfSense and into that, this would probably be my go to for small deployments. The feature set is massive as it is literally just a network centric linux box with a pretty face. It does lack in some of the functionality of pfSense out of the box - That being said you could probably set some/much of that up via the terminal or by installing additional packages - just not sure how well it would work or be supported.
It wins out in price by a pretty good margin - 50 bucks - you can put together a good pfSense box around 150-200 bucks if you have no extra hardware laying around. That being said - pfSense is more versatile in general. With the ER-X you can do most things in some manner, with pfSense you can do most anything in a ton of ways.
In my first setup of one of these I used the following as reference
VLAN aware switching - creating and assigning 4 isolated networks with dot1q vlans per switch port for both native and tagged instances - This works well and i had no problems so far with the implementation
QoS - Smart queue - simple codel queue I believe - works as it should. Did not go out side of the simple "smart queue" setup for this, many options for this that I left untouched.
DHCP - good enough for most use cases. Did not see an option for passing specific DHCP options, but as this is a linux distro I would assume it is in the stack somewhere, might not be supported to use that being said.
DNS - Looks like a very simple forwarder to me - no real options besides what interfaces to listen to and dyndns. Not sure if anything additional for this is on the back end or if you could install bind and do your own.
Traffic analysis. At a glance - a trivial layer7 graphing system will tell you what is using traffic. Not that I used it for it, but from what I understand this might be used for layer7 inspection and firewall rules which could be useful in certain usage scenarios.
VPN - This was a nice bonus to have for a box this cheap, especially with how many options they give you. However - PPTP as a default option? Shame on you ubiquiti. PPTP was cracked years ago. L2TP - I was able to kill the egress back to the VPN clients from devices on the network, however I have not found a way to firewall traffic from being able to reach every management interface on the device. If someone connects to this they can then get to every service hosted on the Edgerouter on every interface (aside from my own intuition - I tried every suggestion I could find in every forum - L2TP creates a sub interface to use that then passes the traffic, I have not found a way to attach rules that to interface - This is not to say there is not a way, I just was not able to find it). Thankfully there is an OVPN server hidden on the device, so I was able to use that for my needs.
Firewall rules - If you are familiar with iptables - this is right up your alley - painful to configure from the GUI as it commits on every change. You can probably do this much faster from the configuration tree. You can certainly do this faster from the CLI.
CLI - Ok, I have to hand them this one - very nice. It's a 50 dollar device with a diagnostically functional CLI. MTR being left into the compile made me all warm and fuzzy. Then the configuration portion - Ok, I might be looking at this from a pretty narrow perspective, but I liked the way they did this. Set commands to setup options, unset to removed them. Command completion with descriptions. A system of commit and save which makes "oh crap, pull the power to roll back" viable, or from what I saw rollback functionality.
And the part (off the top of my head) that bugged me
PoE - 24v passive. It is pretty much useless for most things, ubiquiti seems to love 24v passive so if you have an all ubiquiti system that provides 24v - this will probably be fine, just keep in mind for that passthrough port to work you need to power the unit with 24v PoE or be running a 12 watt adapter (this unit only comes with a 6).
There were others, but this is the gist - If you need a low cost firewall that can push up to 950mbit (with hwnat) and can support multiple networks, QoS, and VPN for a small office (5-15 people) this is a good grab. There is a lot of documentation on configuration and such, and the documentation tends to be to the point.
| Wireless Type | DECT |
|---|
