Tips for getting cheap used x86-based firewall with full Gbit NAT (a PC Engines APU) if you are in the US

Looks like some of the Velocloud stuff was posted online but abruptly ends development in early 2018. I'm guessing that's when they got bought and/or had to find a buyer.

https://bitbucket.org/velocloud/openwrt/src/master/trunk/target/linux/x64/patches-3.14/

i'll try. i think the reset button will do a factory reset :sweat_smile:

OK so i renamed the /opt folder to /opt2 and rebooted.
now HTOP doesn't show anymore all these python scripts runing.
But, i can't access internet anymore. /etc/init.d/network restart doesn't bring up the WAN.
If i rename the folder back to /opt and do a network restart, this time the WAN is up and i can access internet.
So i made a new speed test :


as you can see the cpu are overloaded, and 936Mbps is the best i can get
From my point of view with a 2x 1.7Ghz with 2Ghz boost CPU, there is a big problem of hardware optimization somewhere here, compared to my MT7622 @ 2x 1.35Ghz which is sleeping during speedtests

Offtopic, but just switch off (both software and hardware) flow-offload, also disable packet steering and see MT7622 burn! It will behave exactly the same:


1 Like

yep, but at least i can boost the performance of my MT7622. Something that i can't do with the velocloud actually. it's like having a ferrari towing a 38 ton trailer

hooo by reading your link, i came across this :
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e5bc5337843b23926557dc07659c8dead6b0f26d

1 Like

The C2358 Atom CPU really should be able to do better, there's something going on there (maybe some more emphasis on packet inspection) in the proprietary bits and pieces.

Thats a good link though, most of the patches to solve openwrt integration are there as patch files should be easy to make a working build out of that.

1 Like

Have you got Irqbalance installed?

1 core @95% the other one @75%
what irqbalance would change ? both cores were heavily loaded during the speed test.
i didn't check if irqbalance was installed. I would have to take it out of its box to check.

It'd be interesting to open up the Velocloud device and see if you can replace the storage, so you can run a clean OpenWRT x86 image. Or find a serial header and install pfSense.

If not replace, then at least add.

@RaylynnKnight posted pics of the Velocloud internals on wikidevi, scroll upwards in this thread.

https://wikidevi.wi-cat.ru/Special:Search?search=velocloud&go=Try+exact+match.

I've got two 500-n, let me know if you have any questions.
Just got them, so I haven't had an opportunity spend any time with them though.

1 Like

I've bought a Dell Vmware Edge 610 in an impulse :sweat_smile: It's a rebranded Velocloud device with either a Atom C3308, Atom C3508 or Atom C3538. Will post updates once it arrives.

A potentially good value are AppNeta m35 microAppliances (which are actually Lanner Electronics FW-7525C-AP1) which can sometimes be found on ebay for $100-$150. This has 6 GigE ports, 8 GB RAM, Quad-Core Intel Atom C2518 @ 1.7GHz and boots from a 16GB CompactFlash. Includes an Intel Dual Band Wireless-AC 7260 and has a SATA 3.0 port available. However it does use a 60W power supply.

1 Like

nice find !
More specs details here :

FW-7525D is using an Atom C2558 4x 2.4Ghz

About my VeloCloud 520-AC
if i kill all python Scripts runing, with the command : pkill -f python
and if i disable the rules in /etc/firewall.user :

#!/bin/sh
#iptables -t mangle -N LOGGING
#iptables -t mangle -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320

i can now go upto the max of my 1Gbit Fiber line : 942Mbps, with a little less CPU usage than before.

I don't think the python scripts were a problem, rather the rule in the firewall.

EDIT:
even better when killing/disabling also SNMPD

2 Likes

It is valuable in the sense of doing a quick assessment if the hardware (beyond just the CPU) would be fast enough to cope with 1 GBit/s wirespeed, as getting OpenWrt and igb working will be a long road ahead (does it make sense to go through that pain and effort or would it be better to cut the losses early).

(that doesn't mean configuring/ stripping the OEM firmware would be a worthwile topic in the thread, but the performance evaluation with a more normal firewall configuration is).

1 Like

i'm just trying to know if this device is really able to do full Gbit NAT.
At first I thought no, now I think yes. But it's really borderline. If someone wants to buy one it's better to go for a 540-AC I think. That's it.
Now if you don't want to see my comments anymore, just ignore me.

I managed to build a better testing setup and can report:
a) as expected, it has no problem routing/nat'ing a fully saturated gigabit line at 940 mbit/s with one of the two cores at 20 to 25%
b) SQM tops out at around 780 to 800 mbit/s (piece_of_cake, default settings)

4 Likes

with such a device that has a single lan port, does that mean the whole network is limited to 1000mbit?
let's say you hook up a 5 port switch to the router's lan port, and the fiber internet access to the wan port (1000mbit connection).
if two clients transfer a file at 1000mbit between them (in lan), and a third client starts downloading a file from the fiber internet, will they all share 1000mbit (because it's a single cable to the router) and split it 500mbit to the internal-lan file transfer, and 500mbit for the download?

if you set the first port as WAN, then you have 3 available LAN ports

1 Like

Traffic between lan devices doesn't go through the router.

2 Likes