Tips for getting cheap used x86-based firewall with full Gbit NAT (a PC Engines APU) if you are in the US

i though its supported as metioned here on forum... hm so at the beginning ... no clue what hw to go for ...

Within the scope of this thread and considering a roughly 100 EUR/ USD budget (e.g. that of a r5s with shipping; if you're lucky you may get one for half of that, but that may require persistence), maybe a used Sophos SG115/ rev. 2 or XG115/ rev. 2 would be an easy answer (it'll be bored with mere routing, I can't really put a number on its SQM capability at full speed though).

I have a few spare Sophos devices that I'll offer here before listing on ebay. PM me if interested.

PM me if interested. Shipping would be from Zip Code 30101 in USA.

1 Like

In France, you can get used OverTheBox appliance for 50/80€ max

Germany here (but the base line works in every country):

I‘ve improvised some consumer x86 PC parts together:

  • used parts: intel 2019 8gen Pentium Gold 5600 (2+2HT, 4GHZ 64bit), 1 bar of 8GB DDR4 RAM 2400, mini mATX case, SD card USB adapter, AC/DC 120W Laptop PSU.
  • new parts: Asrock B365 mATX mainboard with 2x PCIx16, PICO PSU DC/DC 150W, bequiet pur rock slim2.
  • used IBM 5899 Broadcom 4-Port PCIe card 74Y4064. This was a nice lucky punch: 28€ including shipping, no heat sink needed, low power, runs right OOTB with v22.
  • 250GB SSD from my loose parts box for later ksmbd.

I was not really frugal while spending, primarily wanted 8gen intel and non-smoker parts, as the system might also end up as a Win11 office system. I also own another 8gen intel and like to be able to switch around parts when needed. Put some time into picking low power consumption parts: intel+asrock/fujitsu mainboard+Pico or a modern Corsair RMxxx PSU likely result near 10W idle operation.

parts roughly worth 220€. You can easily get lower than this even with 8gen intel, as I made a few non-ideal purchasing decisions :slight_smile:

  • CPU is nicely overpowered for 1GBit routing :wink:
  • boots from SD card
  • 9.5 Watt power consumption idle with disconnected keyboard/screen
  • ~ 11 Watt while NATing 0,5GBit
  • 50-60Watt if CPU really would get full action.
  • Noise: none, fan set to constant bare minimum due to the huge sink. CPU is not even undervolted yet, and currently intel power state c7 (maybe i can figure c8-c10 out).

minor drawback: A mini mATX case is still a bit bulkier than a wall-hangable appliance (but on the other hand easier to replace parts).
My lession for the next one: will go for a Corsair PSU, had some setup issues with the Pico.

1 Like

CR35ING / SCB-6979

similar hw to the CR25ing / CR25Wing, but with two additional ethernet ports, and upgradable RAM.
Same power usage 12V/1.7A.


Ran across one of these today, looks pretty competent, at the right price (currently $70 new, on US eBay).



Model: VT-M2M-BTA-DE

Part Number: CGX-402-E482-7

Processor/CPU: Intel Atom E3845

Processor/CPU Speed: 1.91GHz

Number of Cores: 4

L2/L3 Cache: 2x 1 MB 16-way set associative shared caches

Memory Capacity: 2GB

Memory Type: DDR3 SDRAM

Storage Capacity: 16GB

Storage Interface: SATA 3 6.0Gb/s

Wireless Lan Support: 802.11b/g/n Intel N62205

Network/Communications: 2x Intel 82574

Audio: Realtek ALC269

Input/Output Ports: 2x RJ45; 1x WLAN or Bluetooth antenna connector; 1x GPS antenna connector; 1x 3G/GPRS antenna connector; 1x ZigBee/Lora antenna connector; 2x USB 2.0 (Type-A); 1x VGA; 1x MIC in 3.5mm; 1x Line Out 3.5mm; 1x RS232/485; 1x SD Card Slot

Power Input: 100-240V 50/60Hz 1.5A

Power Output: 9-36V

Color: Black

Height: 2.04 in (52 mm)

Width: 3.97 in (101 mm)

Depth: 3.85 in (198 mm)

Weight: 2.64 lbs (1.2 kg)

Type: IoT Automation and Remote Access Management

Operating System: Linux Ubuntu

Supported Operating System: Windows

Features: 2x 3G/GPRS 1dBi Antenna; 1x WLAN/ZigBee 3.2dBi Antenna 2.4G; 1x GPS 1.5G Antenna; 1x Power Adapter P/N: GPE652-120500D


I tore mine down in anticipation of providing an entry to WikiDevi and found 16GB Innodisk SATA Slim 3ME SATA SSD, Intel Centrino Advanced-N 6205 PCIe WIFi (FCC ID: PD962205ANH), Telit DE910-Dual PCIe LTE Modem (FCC ID: RI7DE910-DUAL), ublox NEO-6M UART based GPS module, and a XBee S2C Zigbee RF Module.


Do you still own any XG devices? I didn't have any XG on hand when submitting PR to have Sophos SG/XG line supported by OpenWrt (defining the device and assigning ports to LAN/WAN properly), so would be nice if you could confirm wherever 22.03 works on them.

I still have an XG 85W, XG 105, XG 115, and XG 125W. Will try to find time this weekend to load 22.03 on them.

1 Like

I've had no information about 85 to add it, but 100-series should work.

If you check the Git logs you'll see I added additional patches in December and March that improved on your original work. Supported Sophos Devices should show an incomplete list of supported devices. Both XG and SG devices with and without wireless should now be supported. Some of the newer version devices are not supported (i.e. the XG 105 Rev 3 I have needs work as they added SFP).


I have 22.03.0 working flawlessly on an XG 86w. Of course I had to install the necessary drivers/packages for the wireless card (qca988x/ath10k, I went for the ct variant) and wpad-basic-wolfssl (in lieu of the full-blown hostapd).

AFAIR (and someone CMIIW) it's not vitally necessary to have patches specific to the SG/XG devices, the only thing they do is include eth2 and eth3 into the lan bridge, which can of course also be done manually.


They also set up the model name correctly. :wink:

Which is of no technical consequence on X86 targets (I believe it matters on one or two other targets, for sysupgrade model name check), and sometimes not even really pretty to look at. With the support patch, my product name ends up as "XG-86wr1".

I help myself with a line in /etc/rc.local:

echo "Sophos XG 86w" > /tmp/sysinfo/model

(Which is also helpful if your X86 machine is not recognized at all.)

1 Like

Did you ever figure it out .?

I hooked up the RC10 to a monitor, and connected an old wired apple keyboard to it, and
could see the keyboard being disconnected and reconnected every 10 seconds or so.

Do you have an error log? Try a usb hub.
It seems that the USB port is really problematic.

Can certainly recreate the issue, will post back later.

USB hub, powered or passive?
Don't actually own a powered one :confused:

When I tested the ssd drive before, it worked fine with the passive hub as well.
So I thought it was a compatibility issue rather than a power issue.

Mine's keyboard connection is stable even without a usb hub.