4 ms·

> OPNsense 19.7 supports WireGuard yep, can confirm :) currently running on this passively-cooled thing: https://www.amazon.com/Firewall-Micro-Appliance-Giga

> OPNsense 19.7 supports WireGuard yep, can confirm :) currently running on this passively-cooled thing: https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-NI/dp/B0742Q3NT6 https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-...

oneplane 7y ago
That's pretty expensive for what is essentially a rebranded Qotom. On the other hand, if you are in the USA, it's probably a good choice. OPNSense 20+ also support WireGuard just in case someone gets confused about that specific version reference.
- leeoniya 7y ago
  i think still in the ballpark for an Atom, 8GB RAM, 128GB mSATA config. could not find exactly that model, but this one's close: https://www.aliexpress.com/item/32740319382.html https://www.aliexpress.com/item/32740319382.html anyways, the price difference is not terribly relevant at this pricepoint for a qty of 1 upgraded every 5-10 years.
  - oneplane 7y ago
    I was thinking more in line with the actual ODM: https://aliexpress.com/item/32955679364.html https://aliexpress.com/item/32955679364.html But it does indeed not matter, paying 50 or 100 more over 5 years is a rather small amount.
- mech422 7y ago
  I really like the Odroid H2's... https://ameridroid.com/products/odroid-h2 https://ameridroid.com/products/odroid-h2 On backorder atm - but I have 3 currently tricked out with 16G RAM and 2x200G SATA SSD. Total cost was less then $250/unit.
- jms703 7y ago
  The ProtectLi boxes might cost a little bit more, but they seem to be really well made and of good quality. I moved from a PCEngines APU to a ProtectLi because I needed faster packet forwarding performance when I upgraded my home internet connection to 1 Gbps.
  - bdd 7y ago
    I run an apu2c4 at home, with 1 Gbps internet connectivity. It’s a two legged setup, one leg to the ONT, and one leg to the switch carrying dot1q tagged VLAN traffic. It never fails to saturate that internal interface and does that with ~20-30% cpu idle time. I also run few small processes like DNS, NTP, syslog receiver in their own containers, serving the home. The only time this machine struggles is when my wife is out in a library, coffee shop with good connectivity and her VPN traffic (wireguard) to home is above 200 Mbps and at the same time I’m downloading from somewhere that can feed me at least 800Mbps. In this case it cannot saturate the gigabit interface because CPU is too busy. Linux 4.19 kernel. IPtables for packet filtering and IPv4 NAT. ~30% of my traffic is v6 without NAT overhead.
leeoniya 7y ago
i should mention, it also acts as a pi-hole via dnsmasq configured with these hosts: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
lonelappde 7y ago
Why are you dedicating a full power desktop computer as a firewall?
- ac29 7y ago
  Most of us here wouldn't want to use an Atom processor from 2013 for our "full power desktops"... More seriously though, there are lots of tasks that can go on a home router that take it past a simple firewall. IPS/IDS systems, Advanced QoS, OpenVPN -- all these things can require fairly significant hardware resources to run anywhere close to the 100-1000Mbps speeds on internet connections that are reasonably widespread and affordable in many countries now.
  - jaytaylor 7y ago
    All true. It's also worth noting that with the recent arrival of Gigabit FTTH throughout the Bay Area (Peninsula and even down to Sunnyvale), typical consumer-grade routers can be the new bottleneck when attached to a real 1Gbps fiber line (for example, even though for the previous cable modem connection it worked great).
- leeoniya 7y ago
  OPNSense requires AES-NI, which is an intel feature so you're stuck with an Intel CPU. Atoms are one of the more efficient intel options if you want passive cooling. as a sibling comment mentions, another option is an odroid-h2. either way, i'd rather over-provision for an extra $150 than discover i need all new hardware when my requirements change.

oneplane 7y ago

That's pretty expensive for what is essentially a rebranded Qotom. On the other hand, if you are in the USA, it's probably a good choice. OPNSense 20+ also support WireGuard just in case someone gets confused about that specific version reference.

leeoniya 7y ago
i think still in the ballpark for an Atom, 8GB RAM, 128GB mSATA config. could not find exactly that model, but this one's close: https://www.aliexpress.com/item/32740319382.html https://www.aliexpress.com/item/32740319382.html anyways, the price difference is not terribly relevant at this pricepoint for a qty of 1 upgraded every 5-10 years.
- oneplane 7y ago
  I was thinking more in line with the actual ODM: https://aliexpress.com/item/32955679364.html https://aliexpress.com/item/32955679364.html But it does indeed not matter, paying 50 or 100 more over 5 years is a rather small amount.
mech422 7y ago
I really like the Odroid H2's... https://ameridroid.com/products/odroid-h2 https://ameridroid.com/products/odroid-h2 On backorder atm - but I have 3 currently tricked out with 16G RAM and 2x200G SATA SSD. Total cost was less then $250/unit.
jms703 7y ago
The ProtectLi boxes might cost a little bit more, but they seem to be really well made and of good quality. I moved from a PCEngines APU to a ProtectLi because I needed faster packet forwarding performance when I upgraded my home internet connection to 1 Gbps.
- bdd 7y ago
  I run an apu2c4 at home, with 1 Gbps internet connectivity. It’s a two legged setup, one leg to the ONT, and one leg to the switch carrying dot1q tagged VLAN traffic. It never fails to saturate that internal interface and does that with ~20-30% cpu idle time. I also run few small processes like DNS, NTP, syslog receiver in their own containers, serving the home. The only time this machine struggles is when my wife is out in a library, coffee shop with good connectivity and her VPN traffic (wireguard) to home is above 200 Mbps and at the same time I’m downloading from somewhere that can feed me at least 800Mbps. In this case it cannot saturate the gigabit interface because CPU is too busy. Linux 4.19 kernel. IPtables for packet filtering and IPv4 NAT. ~30% of my traffic is v6 without NAT overhead.

leeoniya 7y ago

i should mention, it also acts as a pi-hole via dnsmasq configured with these hosts: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts

lonelappde 7y ago

Why are you dedicating a full power desktop computer as a firewall?

ac29 7y ago
Most of us here wouldn't want to use an Atom processor from 2013 for our "full power desktops"... More seriously though, there are lots of tasks that can go on a home router that take it past a simple firewall. IPS/IDS systems, Advanced QoS, OpenVPN -- all these things can require fairly significant hardware resources to run anywhere close to the 100-1000Mbps speeds on internet connections that are reasonably widespread and affordable in many countries now.
- jaytaylor 7y ago
  All true. It's also worth noting that with the recent arrival of Gigabit FTTH throughout the Bay Area (Peninsula and even down to Sunnyvale), typical consumer-grade routers can be the new bottleneck when attached to a real 1Gbps fiber line (for example, even though for the previous cable modem connection it worked great).
leeoniya 7y ago
OPNSense requires AES-NI, which is an intel feature so you're stuck with an Intel CPU. Atoms are one of the more efficient intel options if you want passive cooling. as a sibling comment mentions, another option is an odroid-h2. either way, i'd rather over-provision for an extra $150 than discover i need all new hardware when my requirements change.