I like WatchGuard. They have a small router/firewall that is easy to set up and low maintenance. When I was a consultant I set those up at a bunch of small businesses and had very few issues. For switches, cant go wrong with an unmanaged Dell or HP for a simple setup.
Ubiquiti Edgerouter. 3 port model costs $100, 5 port with poe costs $200.
You get commercial grade router, full function firewall, with built-in vpn in a box the size of two cigarette packs.
Vpn is your choice of IPSec, ppptp, or my personal favourite OpenVPN.
Good web interface for monitoring and basic config, with CLI for more advanced configs.
As for real world use, I use a 5 port poe model for business lan, 30 clients, with 10 simultaneous vpn connections using RDP and voip all day long. I also have a second one at my home set up with a site-to-site vpn to the office.
We use a HP Proliant 380 G3 running PFSense, It works for everything we need. (we have tons of HP garbage around, any old pc would work fine, at home I use a SuperMicro 1U) It is rock solid stable and has every feature you could want, and it is free.
on our router (lancom 1781ef+) we entered the pi as dns server. this works fine but now the log does not show the individual clients with their requests but only the router.
-systems.com/knowledge/pages/viewpage.action?pageId=36450596
If your router doesn't allow to configure a local DNS server via DHCP (commonly a LAN or DHCP setting), and you are not willing or able to disable your router's DHCP server, than you are stuck with having only your router as Pi-hole's client.
as in the link above described we setup the router to forward dns-requests to the pi-hole. with the dhcp thing i am sure all more advanced or professional networks won't/can't rely on pi-hole as the dhcp-server.
The meaning is not entirely clear, but I assume "forwarding" would at least mean your router is accepting DNS queries (by distributing its own IP address as local DNS server via DHCP) and then forwards them to your chosen upstream (and that's completely in line with you observing it as Pi-hole's only client, apart from Pi-hole itself).
However, "forwarding" could also mean that your router additionally is catching and redirecting all outbound DNS traffic and forwards it to the configured DNS servers. Depending on how that's done, it may be a good or a bad thing with regards to Pi-hole.
And depending on your configuration decision (see below), it then may or may not be advisable to revert that "forwarding" option to its defaults.
a) live with the status quo: your router is forwarding DNS requests to Pi-hole, effectively making it your only client.
b) try to locate a router menu option that would allow you to distribute Pi-hole as local DNS server via DHCP (replacing your router) - this option is commonly found in the LAN or DHCP section of your router's configuration UI.
c) try to disable your router's DHCP server and use Pi-hole's DHCP server instead.
Contrary to your assumption, Pi-hole's embedded dnsmasq is quite capable of serving DHCP. There are even routers out there that use dnsmasq under the hood as well.
d) manually configure Pi-hole as DNS server on each single device.
It may also help to disclose your exact router model, preferably also in this topic's title, in order to better attract users with the same or a similar router. They might be able to share their experience and to provide more specific advice on its configuration.
thank you very much for the detailed explanations! finally i understand the problem. i now asked the question in the lancom forum and there the really competent developer of the firmware is always very helpful. let's see if there is a possibility in lancom routers to pass the dns requests of the clients to the pi-hole so that he has the possibility to distinguish the clients and not only to see the router.
dhcp we still have to have the router done because of various vpn incoming connections. the exact router model is not too important for the lancom models because all halfway current models share the same core functionality in the firmware.
Distribute Pi-hole as local DNS server via DHCP.
All your DHCP clients will talk to your Pi-hole for DNS, and Pi-hole will forward unfiltered requests to one of its configured upstream servers. If a router supports it, this would be the preferred way, as it doesn't come with the restrictions of option 2.).
Your DNS resolution path looks like:
client -> Pi-hole -> upstream DNS
Use Pi-hole as your router's sole upstream DNS server.
All your DHCP clients talk to your router for DNS, and your router will forward all DNS requests to Pi-hole.
Hence your Pi-hole sees all DNS requests as originating from your router. You won't be able to attribute DNS traffic to individual client IPs, and you cannot use client-based filtering (i.e. group management) in any meaningful way, and no, Conditonal Forwarding won't do anything for you in that case.
Your DNS resolution path looks like:
client -> router -> Pi-hole -> upstream DNS
we use the nets 192.168.144.0 and 192.168.144.0 since about 20 years and never had to deal with this cidr thing. but instead of helping me and simply giving me the address that i need you are loughing at me.
I can tell you exactly what numbers to type in, but you won't know why you are doing it. When it breaks you won't be able to fix it and you'll blame us for giving you the wrong information. You need to learn it. You're operating a DNS server, that's an extremely vital service for your network.
So, we cant use the export file for the LANCOM VPN Client. (The LANCOM VPN Client dont know the filetype of the export) So he has to add all manuel. But there is some special to configure all perfect, that the lancom vpn client is working with the sophos needed data.
The product contains separate components which, as so-called open source software, are subject to their own licenses, in particular the General Public License (GPL). If required by the respective license, source files for the affected software components are made available on request. To do this, please send an e-mail to g...@lancom.de.LANCOM Systems GmbH
Adenauerstr. 20/B2
52146 Wuerselen, Germany
www.lancom-systems.com
Wuerselen, 11/2022
The LANCOM Advanced VPN Client is a universal VPN software client for secure company access while traveling. It provides mobile employees with encrypted access to the company network, whether they are at their home office, on the road, or even abroad. The application is extremely easy to use; once VPN access (virtual private network) has been configured, a click of the mouse is all it takes to establish a secure VPN connection over the best available connection medium, including cellular networks. Further data protection comes with the integrated stateful inspection firewall, support of all IPSec protocol extensions, and numerous other security features.
The following Installation Guide covers all of the necessary steps for the configuration of a VPN-secured RAS connection via a LANCOM VPN gateway for a remote computer equipped with the LANCOM Advanced VPN Client:
You can test the LANCOM Advanced VPN Client for 30 days. The product must be activated by means of a license in order to make use of the complete set of features after the trial period has expired. The following variants are available:
If you are using an older version of the LANCOM Advanced VPN Client, you can find out which license you require from the License models table on www.lancom-systems.com/avc/.New installation
In the case of a new installation, you must first download the client. Follow this link www.lancom-systems.com/downloads/ and then go to the Download area. In the Software area, download either the 32-bit (x86) or the 64-bit version (x64) of the Advanced VPN Client for Windows.To install, start the program you downloaded and follow the instructions on the screen.
You need to perform a system reboot to complete the installation. After your system has restarted, the LANCOM Advanced VPN Client is ready to use. Once the client has been started, the main window appears.
You can perform the product activation now with your serial number and your license key (page 06). Or you can test the client for 30 days and perform the product activation after you have finished testing.License upgradeThe license upgrade for the LANCOM Advanced VPN Client permits an upgrade of a maximum of two major versions of the client. Details are available from the License models table at www.lancom-systems.com/avc/. If you meet the requirements for a license upgrade and you have purchased an upgrade key, you can order a new license key by going to www.lancom-systems.com/avc/ and clicking License upgrade.
You perform the online activation from within the client, which connects directly to the activation server. In the case of the offline activation, you create a file in the client and upload this to the activation server. You subsequently receive an activation code, which you enter manually into the client.
Online activationIf you choose the online activation, this is performed from within the Client, which connects directly to the activation server. Proceed as follows:
If you choose the offline activation, you create a file in the client and upload this to the activation server. You subsequently receive an activation code, which you enter manually into the client. Proceed as follows: