Routers & Firewall Platforms
A hands-on comparison of router/firewall platforms through the lens of routing, NAT, DHCP, DNS, policy enforcement, logging, and recovery. The emphasis is on predictable network behavior and verification after every change.
LAB TOPOLOGY
The lab separates WAN, LAN, and an optional management network. Private address ranges are used for examples. The firewall is the policy boundary; routing decides where traffic can go, while NAT controls how selected traffic is translated.
CONFIGURATION METHOD
Changes are applied incrementally: establish management access, configure interfaces, add DHCP/DNS, define outbound policy, then add specific port-forward or inter-zone rules only when required. A rollback path is prepared before risky changes.
VERIFICATION COMMANDS
The strongest evidence is a combination of configuration state and observed traffic. Route tables, interface counters, listening sockets, DNS resolution, and firewall logs help distinguish a routing problem from a policy problem.
$ ip addr show br-lan inet 192.168.50.1/24 $ ip route 192.168.50.0/24 dev br-lan 0.0.0.0/0 via 192.0.2.1 $ ss -lntup | head LISTEN ... :53 ... LISTEN ... :67 ...
$ ping -c 2 1.1.1.1 64 bytes ... time=18 ms $ getent hosts example.com 93.184.216.34 example.com $ nft list ruleset | grep -E 'masquerade|drop' | head <representative rule output>
FAULT SCENARIO
A realistic lab incident is 'LAN clients have IP addresses but no internet'. Troubleshooting proceeds from link → address → gateway → DNS → NAT → firewall rule. This avoids randomly changing settings until something works.
LESSONS LEARNED
The platform matters less than disciplined verification. Documenting rule purpose, source/destination zones, logging expectations, and rollback steps makes the firewall maintainable.