Tips for getting cheap used x86-based firewall with full Gbit NAT (a PC Engines APU) if you are in the US

i'm just trying to know if this device is really able to do full Gbit NAT.
At first I thought no, now I think yes. But it's really borderline. If someone wants to buy one it's better to go for a 540-AC I think. That's it.
Now if you don't want to see my comments anymore, just ignore me.

I managed to build a better testing setup and can report:
a) as expected, it has no problem routing/nat'ing a fully saturated gigabit line at 940 mbit/s with one of the two cores at 20 to 25%
b) SQM tops out at around 780 to 800 mbit/s (piece_of_cake, default settings)

4 Likes

with such a device that has a single lan port, does that mean the whole network is limited to 1000mbit?
let's say you hook up a 5 port switch to the router's lan port, and the fiber internet access to the wan port (1000mbit connection).
if two clients transfer a file at 1000mbit between them (in lan), and a third client starts downloading a file from the fiber internet, will they all share 1000mbit (because it's a single cable to the router) and split it 500mbit to the internal-lan file transfer, and 500mbit for the download?

if you set the first port as WAN, then you have 3 available LAN ports

1 Like

Traffic between lan devices doesn't go through the router.

2 Likes

Hello,
i went thru the whole thread, as I am trying to find out device that can manage 2 WANs (1gbit, as a failover) and also can manage somehow LTE for something as service line (ssh) in case both WANs are dead (issue with internet provider).

Reading posts... there were mentioned so many HWs, also mentioned that some cpus have issues, etc etc.

Is there a chance to somehow sum up that thread? I am still not clear which HW to use, which distro (openwrt, pfsense, opnsense, ipfire) choose...

Maybe its not possible ... just wondering - the best sounded apu but as was mentioned HW has bugs (on CPU level) etc.

Appreciate.

It's been a while, so someone correct me if I'm wrong, but I believe the system requirements do not increase for multiple lines if used in a failover scenario (I'm thinking of the wildly popular MWAN3 package). If your device can route one gigabit line it can also route the other if it switches over. A failover to LTE is also not incredibly difficult (and may even be "free", I personally spent a few weeks in 2020 online through an USB-tethered, otherwise obsolete Android phone.)

But you're right about the thread becoming a bit unwieldy. Maybe a wiki page is in order, listing vendors, manufacturers, rebadges and specs of "firewall" appliances. Because there are many devices being rebadged by various vendors, from the outside it's often not possible to see what hardware is inside and if it's even compatible with OpenWrt (i.e. X86 based).

1 Like

Earlier in the thread were linked some Celeron J4125 boxes with 4x 2.5gbps LAN ports. A bit more expensive than what this thread was initially aimed at, but i had to give one a go.
Doesn't work well on 21.02, the igc driver is terrible. I backported the driver from kernel 5.15 and now it works seamlessly.

Time to open a new discussion based on x86 hardware, more focused on performance, and without price limitation.

1 Like

if there's no price limit, upwards, there's no reason to have a thread, just use some old Cray or SGI box.

The interesting models of these makers are not x86 though... and the x86 ones tend to be "super-computer" class affairs (e.g. later SGI Altix after jettisoning Itanium) that seem ill suited for a router role independent of price...

Really, a new thread for x86-based routers with a more relaxed price limit does not sound like a bad idea, but I agree without any price limit such a thread will not be terribly relevant....

Hmm, maybe it is also time for a "worst abuse of technology for networking" thread, like the time when I configured a DEC AlphaStation XP1000 to act as dumb bridge between 1 Gbps-fiber ethernet and a cheap copper switch to supply copper-based ethernet to a remote room... (in my defense the XP1000 was sitting in storage since nobody had a use for it, and at the time I was oblivious of power-consumption at the time).

Didn't think I would need the sarcasm tags, seems I was wrong :stuck_out_tongue:

1 Like

What will be this "price limit" then ? 200/300/400/500$ ?
will it be for a new or a used device ?

why can't we talk about machines based on Xeons servers and 10Gbps intel cards, copper or fiber, that cost more than 1000$ ?
Openwrt is not limited to mini PCs, so I don't see why we can't talk about everything that is possible to run with openWRT without being limited to a price.

btw, who's going to talk about $1000 devices ? 0.001% of us :sweat_smile:

1 Like

We can, I just don't see the point ?

The "challenge" is to find a device capable to route, say, 1gbit, below $100, using less than 40W,
not $1000/400W, IMHO.

But nothing stops you from starting a "there's no upper limit" thread, but OpenWRT supported/able.

doesn't it already correspond to this topic?

i was thinking about a new topic for this kind of device : https://www.aliexpress.com/item/1005003990581434.html
hard to find as "used device"

pretty much yeah, except people keep posting Xeons :wink:

A distinction might be made between (often) used x86 systems sold for use with another OS/firmware (like the SimpleWAN devices at the start of the thread, or the Sophos devices, or the Velocloud) and those x86 systems that are generally purchased new, OS agnostic, but still compact, low power and relatively low cost (say <$250US, comparable to new higher-end OpenWRT consumer routers).

For my part, I'd rather have a sub $100 device, but because my time is worth something (not much, but something), I'm probably going to end up buying something new. This is largely because I want something with enough single-core performance to do Gigabit with PPPoE and SQM using OpenSense so I have that option (FreeBSD's PPPoE implementation isn't efficient/doesn't scale across multiple cores).

Adding some information regarding Barracuda Firewall devices. The Barracuda F18 mentioned earlier shares hardware with the Barracuda F80 and some versions of the Barracuda X100 and X200. What you should look for is the Model: BNHW025 above the P/N and Input: DC 19V on the label. The X100 model I have came with 4GB RAM vs the 2GB in the Barracuda F18. The F80 version has WiFi.

yep, someone is selling 4 of these for $270 on ebay. that's $67.5 per unit.

I replaced a Barracuda F12 which had a faulty SSD. The device works fine apart from that. Managed to boot OpenWrt x86-64-generic-ext4-combined-efi from a usb pen drive without any issues.

1 Like