Watchguard Firebox M400 is going out of support in June 2023, so there might be an influx of these devices into the secondary market. In my opinion, this is a very good device to run OpenWrt on...
The M400 is a very straightforward x64 device (I believe it is actually made by Lanner; maybe @RaylynnKnight knows the exact model number?). The specs are as follows:
- Processor: Intel Celeron G1820
- RAM: 4 GB
- Storage: 4 GB CF card
- Networking: 8 x Intel i210 (6 x RJ-45 + 2 x SFP)
There's some skullduggery going on around BIOS, so I wasn't able to get into it (but I didn't try all that hard, and I know that some people have had it unlocked entirely). In my case, it wasn't strictly necessary, so I just downloaded the latest OpenWrt (SquashFS / BIOS, although ext4 / BIOS would probably have worked just as well), flashed it onto a CF card, swapped that card into the M400, replacing the card with stock firmware, and everything JustWorked™:
Obviously, the screenshot above was taken after a few add-ons were installed...
OpenWrt recognized all eight ports without a problem and, per tradition, made eth0
LAN and eth1
WAN. By editing /etc/config/network
, I swapped those designations (so eth0
became WAN and eth1
, LAN) and added all yet-unassigned ports (eth2
through eth7
) into the LAN bridge, just to be able to test them. After reboot, all ports appeared to function normally (obviously, your mileage may vary with SFP ports depending on what SFP cartridges you use).
All in all, an absolutely uneventful journey. Highly recommended to anyone who wants a rack-mountable OpenWrt device. Please note that this device has a bigger sibling, the M500, which, I surmise, should be about as easy to wrangle as the M400 has been. Note also that junior siblings, M200 and M300, despite the similarity of looks, are not x86, but rather Freescale, so a totally different can of worms. Come to think of it, the Wiki has an entry on the M300; very different indeed...
In the department of it's never perfect, the Arm LED remains red. I have not tried to fight it yet, but I know it's manageable under pfSense / OPNsense. On Netgate forums, there's stephenw10
, a Netgate developer, who wrote a FreeBSD utility called WGXepc
, which is used to manage miscellaneous hardware, including the said LED, on Watchguard devices running "the senses". I have used WGXepc
on an M400 running OPNsense nano, and it worked as advertised. I was able to set the Arm LED to switch green at the end of the boot sequence and adjust the default fan speed, also at the end of the boot sequence. So in the worst case scenario, someone will have to see if WGXepc
can be ported to Linux...