SOHO stands for Small Offices and Home Offices, and usually refers to situations where there exists just one computer at home to a few computers in a small office.
There is a very large offer of SOHO routers on the market nowadays from various manufacturers, but from what I've tested, most of them do the same basic things (NAT, DHCP, and some port filtering). They are less expensive than any computer, but if you have an old computer that you are about to throw away, you can easily install Linux on it and make it your own SOHO router having the advantage of higher flexibility at zero cost.
Usually, a SOHO router has a WAN port that is an Ethernet port where the provider connection must be plugged in. The Provider's CPE (Customer Premises Equipment) can be of any type (xDSL modem, wireless bridge, cable modem, fiber optic media converter) that can provide an Ethernet connection. SOHO routers usually have four to eight Ethernet ports for the LAN. This is basically a small four-to-eight-port switch that's built in the SOHO router. Some SOHO routers also have a wireless access point chipset that is bridged to the built-in switch.
Our computer that will run Linux and act as SOHO router must have two Ethernet cards, one for the WAN function of a SOHO router into which the provider's CPE is plugged, and one for the LAN. If you want the LAN to be wired and wireless, the Ethernet interface for the local network will be plugged into an access point with a built-in switch. However it is, everything is basically a LAN (wired, wireless, bridged, or switched); so, from the firewall point of view, it doesn't really matter what we use at the first and second layers of the OSI model (access points, hubs, switches).
The provider usually assigns us a public IP address that can be either statically assigned or dynamically assigned using DHCP or PPPoE. Linux has support for PPPoE; this can be downloaded from http://www.roaringpenguin.com/pppoe/.

Setting Up the Network

When setting up the local network, we must use a range of private IP addresses. In this example, we will use the private class C network 192.168.1.0/24; so, the best thing to do would be to assign the IP address 192.168.1.1 on the Ethernet interface eth1 on our Linux router.

In order to create a proper firewall for all devices behind NAT, we should assign them static IP addresses. However, we might want to use DHCP for the gaming device and for the laptop. To do that, first, we need to install the DHCP server. This is a distribution-specific task. For example, on Debian we run the following commands:

Next, we need to set up the DHCP server. We want to let the laptop acquire IP addresses from 192.168.1.2 to 192.168.1.10, for example. We set up a range just in case we have some friends visiting with their laptops. In the /etc/dhcpd.conf file, we need to enter the following text:

For the printer, desktop computer, and the children's computer, we want to assign them the same IP addresses every time. We find out the MAC addresses for each one, and, based on their MAC address, we assign them IP addresses by writing in the /etc/dhcpd.conf the following lines:

Now, we need to edit the /etc/init.d/dhcp script and set the interface to eth1:

and start the DHCP server by running the /etc/init.d/dhcp script with the start argument.

At this point, we have:

• The Linux router has a public IP address on eth0, the private IP address on eth1 192.168.1.1, and DHCP running.
• The laptop acquires a private IP address from the range 192.168.1.2-192.168.1.10.
• The desktop computer always acquires the private IP address 192.168.1.11.
• The children's computer always acquires the private IP address 192.168.1.55.
• The network printer always acquires the private IP address 192.168.1.100.
• The gaming device always acquires the private IP address 192.168.1.200.

Defining the Security Policy

Before building up any firewalls, we have to decide what the firewall must do by creating a security policy that can be from a document (recommended) to a piece of paper, or some thoughts in our heads.
For the simple and very common network just discussed, we can decide the following simple rules:

• The gaming device can access anything on the Internet. Also, we want to host games on it using GameSpy Arcade.
• The network printer must be accessed only from inside our network.
• The children must use the computer to browse the Internet and use Yahoo! Messenger. We don't want them to be able to access porn content or download viruses. We also don't want to let them use P2P software; so basically we limit their access to the Web and Yahoo! messenger.
• The laptop and guests laptops can access anything on the Internet (we don't want to be rude and deny them access to xxx sites, for example).
• The desktop can access anything. Also, we want to be able to log in on the desktop computer from outside using VNC (Virtual Network Computing).
• The Linux router must run SSH so that we can log in to it from the internal network and from the office.

The most difficult thing from our list is to perform all those restrictions for the children's computer. To be able to block porn sites and viruses, we must use a proxy server and make it transparent.