Tips for getting cheap used x86-based firewall with full Gbit NAT (a PC Engines APU) if you are in the US

Hello,
i went thru the whole thread, as I am trying to find out device that can manage 2 WANs (1gbit, as a failover) and also can manage somehow LTE for something as service line (ssh) in case both WANs are dead (issue with internet provider).

Reading posts... there were mentioned so many HWs, also mentioned that some cpus have issues, etc etc.

Is there a chance to somehow sum up that thread? I am still not clear which HW to use, which distro (openwrt, pfsense, opnsense, ipfire) choose...

Maybe its not possible ... just wondering - the best sounded apu but as was mentioned HW has bugs (on CPU level) etc.

Appreciate.

It's been a while, so someone correct me if I'm wrong, but I believe the system requirements do not increase for multiple lines if used in a failover scenario (I'm thinking of the wildly popular MWAN3 package). If your device can route one gigabit line it can also route the other if it switches over. A failover to LTE is also not incredibly difficult (and may even be "free", I personally spent a few weeks in 2020 online through an USB-tethered, otherwise obsolete Android phone.)

But you're right about the thread becoming a bit unwieldy. Maybe a wiki page is in order, listing vendors, manufacturers, rebadges and specs of "firewall" appliances. Because there are many devices being rebadged by various vendors, from the outside it's often not possible to see what hardware is inside and if it's even compatible with OpenWrt (i.e. X86 based).

1 Like

Earlier in the thread were linked some Celeron J4125 boxes with 4x 2.5gbps LAN ports. A bit more expensive than what this thread was initially aimed at, but i had to give one a go.
Doesn't work well on 21.02, the igc driver is terrible. I backported the driver from kernel 5.15 and now it works seamlessly.

Time to open a new discussion based on x86 hardware, more focused on performance, and without price limitation.

1 Like

if there's no price limit, upwards, there's no reason to have a thread, just use some old Cray or SGI box.

The interesting models of these makers are not x86 though... and the x86 ones tend to be "super-computer" class affairs (e.g. later SGI Altix after jettisoning Itanium) that seem ill suited for a router role independent of price...

Really, a new thread for x86-based routers with a more relaxed price limit does not sound like a bad idea, but I agree without any price limit such a thread will not be terribly relevant....

Hmm, maybe it is also time for a "worst abuse of technology for networking" thread, like the time when I configured a DEC AlphaStation XP1000 to act as dumb bridge between 1 Gbps-fiber ethernet and a cheap copper switch to supply copper-based ethernet to a remote room... (in my defense the XP1000 was sitting in storage since nobody had a use for it, and at the time I was oblivious of power-consumption at the time).

Didn't think I would need the sarcasm tags, seems I was wrong :stuck_out_tongue:

1 Like

What will be this "price limit" then ? 200/300/400/500$ ?
will it be for a new or a used device ?

why can't we talk about machines based on Xeons servers and 10Gbps intel cards, copper or fiber, that cost more than 1000$ ?
Openwrt is not limited to mini PCs, so I don't see why we can't talk about everything that is possible to run with openWRT without being limited to a price.

btw, who's going to talk about $1000 devices ? 0.001% of us :sweat_smile:

1 Like

We can, I just don't see the point ?

The "challenge" is to find a device capable to route, say, 1gbit, below $100, using less than 40W,
not $1000/400W, IMHO.

But nothing stops you from starting a "there's no upper limit" thread, but OpenWRT supported/able.

doesn't it already correspond to this topic?

i was thinking about a new topic for this kind of device : https://www.aliexpress.com/item/1005003990581434.html
hard to find as "used device"

pretty much yeah, except people keep posting Xeons :wink:

A distinction might be made between (often) used x86 systems sold for use with another OS/firmware (like the SimpleWAN devices at the start of the thread, or the Sophos devices, or the Velocloud) and those x86 systems that are generally purchased new, OS agnostic, but still compact, low power and relatively low cost (say <$250US, comparable to new higher-end OpenWRT consumer routers).

For my part, I'd rather have a sub $100 device, but because my time is worth something (not much, but something), I'm probably going to end up buying something new. This is largely because I want something with enough single-core performance to do Gigabit with PPPoE and SQM using OpenSense so I have that option (FreeBSD's PPPoE implementation isn't efficient/doesn't scale across multiple cores).

Adding some information regarding Barracuda Firewall devices. The Barracuda F18 mentioned earlier shares hardware with the Barracuda F80 and some versions of the Barracuda X100 and X200. What you should look for is the Model: BNHW025 above the P/N and Input: DC 19V on the label. The X100 model I have came with 4GB RAM vs the 2GB in the Barracuda F18. The F80 version has WiFi.

yep, someone is selling 4 of these for $270 on ebay. that's $67.5 per unit.

I replaced a Barracuda F12 which had a faulty SSD. The device works fine apart from that. Managed to boot OpenWrt x86-64-generic-ext4-combined-efi from a usb pen drive without any issues.

1 Like

Found a pfsense SG-2220 today, it's using an Atom C2338, and comes with 2gb RAM.

M.2 sata SSD seems replaceable, according to Google.

Expensive, but might drop. Def not worth the $135 asked by the seller.

https://docs.netgate.com/pfsense/en/latest/hardware/tune.html#pppoe-with-multi-queue-nics and https://forum.opnsense.org/index.php?PHPSESSID=ioodcejfj4a6ttdgtgu1j60ums&topic=27049.msg131161#msg131161 might be of interest in that regard
You might also want to look into mpd(5), http://mpd.sourceforge.net/ , https://www.freshports.org/net/mpd5/

HEllo,
i was thinking to run ESXi on my server - so isn't it better to just virtualize openwrt (as a router) as buying another hw ...

server running ESXi will run virtualized TrueNAS and bunch of other VMs.

thanks

the velocloud has 2 boot partitions, and I would like to try to see if I can install a clean openwrt on one of them. To see what works and what doesn't
Which image should I install from this list?

Ext4 combined should work just fine, but it'll overwrite the partition table.

If you want to keep it, you manually have to write the root FS and kernel, but then there's still the issue of the boot loader.