...

+ According to MTBF calculations, should be more reliable.

... it died after nine months of 24/7 service. Until then, it was the perfect fire-and-forget appliance. It Plainly Worked.

9 months * 30 days/month * 24 hrs/day = 6480 hrs. I don't know what MTBFs appliance vendors usually claim, but 9 months isn't really a lot in my book. I expect routers, switches, etc. to be up a lot longer without exhibiting a failure. You could probably increase the MTBF of a Linux setup considerably by using a CPU and video card with low power consumption (requires less cooling -- fans like to fail, use good ones) and replacing the hard drive with plenty of RAM. Boot from CD, use a RAM-drive for the RW portions of the file system, store the configuration files, which change rather frequently, on floppy disk. This will be rather difficult to do with a stock SuSE system, though it might well be possible. If what you say about your level of networking expertise transfers to your Linux abilities, I wouldn't recommend it to you. No offence. ;-)

...

- Security generally good but updates can rely on luck in discovering a new code release.

This is something that does worry me to some extent. Looking at how quickly security updates for Linux defects are published is impressive. A hardware router implies

* unknown OS

I suppose most of them have a DOS or free Unix history. I don't know about the lower end, but most of the enterprise-grade appliances use modified versions of Linux or Open/Free/Net-BSD. I think the development of an own OS is way too expensive for the SOHO market.

* unknown quality of filter implementation (the functionality offered by Zyxel seems to be fine)

I wouldn't expect too much from them. It's closed source, low price. I don't put much faith into that combination, but that's just my personal opinion.

I do not expect to get any seizable attacks (barring yet another CodeRed storm) as I am on a dynamic IP, but just looking at how some Cisco SOHO product happened to lock up on the CodeRed attack due to a firmware bug, thus constituting a somewhat accidental DoS attack, does worry me.

...

+ Rapid response to new threats.

Major selling point. I tend to be paranoid in this respect - and since I am telecommuting, forced downtime due to (exploitable) threats is not something that I would like to see.

From my observations (which aren't many), the SOHO router market seems to rely on vulnerabilities not being found, i.e. security by obscurity. Alcatel, e.g., made a fundamental mistake in the default setup of their DSL

Goes to show that a brand name doesn't do it all. Lots of the industry giants have acquired all sorts of small companies lately and now sell their products, which means that the giants' product lines are very heterogenous and that experiences with some of a vendor's products don't necessarily carry over to others. thingies a while back. These types of errors are especially problematic with appliances meant for more or less clueless folks (no implication!), as those certainly won't be able to find and remove them.

The only thing - which might be quite out of the ordinary - that I really do want to do is getting onto a (specific) VPN. The old Linux setup

Then what are the specifics of that VPN?

* dynamic IP * Linux NAT router * W2K and Linux 2.2 / 2.4 clients

was something that was not acceptable to the IS department. On the other hand,

* static IPs * Linux NAT router * W2K or Linux 2.2 / 2.4 clients

or

* dynamic IP * W2K

would have worked for them. I have no idea what they are running (though I just asked).

The reasons behind the above would be very interesting.

The above-mentioned ZyWALL 10 will support IPsec endpoint features. Instead of running a client on PC your router will act as a client and this will enable AH support as well. It will be a IPsec Client/Server and it will support both IPsec protocols ESP (IP protocol 50) and AH (IP protocol 51) for both modes "transport" and "tunnel". Is this something a Linux solution could do as well, even when set up by an incompetent network administrator (aka me)?

A Linux gateway with FreeS/WAN will work as an IPSec gateway as well, i.e. you can use tunnel mode and ESP (AH, too, if you want, though it adds nothing substantial in terms of security -- in fact, Bruce Schneier and a less famous co-author recommend that IPSec drop AH for reasons of removing redundancy) to connect the gateway and machines behind it to a similar IPSec gateway. Note that the terms 'client' and 'server' don't apply well to IPSec, as that is always a peer-to-peer thing. What the industry likes to call clients are Road Warriors in FreeS/WAN-speak, while the term 'VPN server' usually means IPSec tunnel mode gateways. FreeS/WAN setup is anywhere between dead simple and impossible, depending entirely on the specific situation. Interoperation with other products can be challenging, but I am sure this is no different with any other product. We've just tried to set up W2K Professional (Road Warrior) to FreeS/WAN (tunnel gateway) connectivity, e.g., and it simply won't work, because W2Kprof doesn't support tunnel mode, *but* allows you to specify a tunnel end point. That effectively silences the NIC (or dial-up adapter) completely... Cool, huh? The point is that IPSec interoperability isn't as good as would be desirable, and FreeS/WAN is no exception. Don't let Zyxel blind you, though, I'd be skeptical of their interoperability. Cheers Tobias