6 ms·
Just ordered a Chinese box with 8th gen U-series i5, 8 GB of RAM and 120 GB of SSD. Has six ethernet connections, HDMI and COM. Planning to install OpenWRT to i
by pimeys 6y ago
Just ordered a Chinese box with 8th gen U-series i5, 8 GB of RAM and 120 GB of SSD. Has six ethernet connections, HDMI and COM. Planning to install OpenWRT to it, and with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard.
I've had whatever routers before, but mostly when using some VPN to hide the traffic from your home network, and if having fast enough internet, a good CPU is a must.
- unethical_ban 6y agoLink to the box you got? That sounds interesting.
- AndrewDavis 6y agoAlso curious, and wondering how much that cost.
- xvf22 6y ago$350-$400ish search AliExpress for "i5 7200U firewall"
- pimeys 6y agoOh, sorry! These are available from Europe, but I've heard good things from US about similar boxes, when I searched with "best pfsense computer". Not the same brand, but similar hardware. https://www.amazon.de/gp/product/B08JHKZMTN/ref=ppx_yo_dt_b_asin_title_o03_s00?ie=UTF8&psc=1 https://www.amazon.de/gp/product/B08JHKZMTN/ref=ppx_yo_dt_b_... Let's see how it works, but I expect it to be much faster than my current ARMv7 box. Of course if you have space for a rack, go with something actively cooled. In our apartment, we expect the router to not make any noise.
- pilsetnieks 6y agoDespite the name in the Amazon listing, it has nothing to do with Mikrotik; also a 1Gbit ARM Mikrotik router/firewall can be had for considerably less.
- pimeys 6y agoHow fast are the ARM CPU they have in their routers, do they support AES-NI and how much data you can push with VPN encryption through their boxes? The current ARMv7 I have goes to about 100 degrees Celsius and loads in the level of 4 to 6 when downloading a bunch of data full speed.
- pilsetnieks 6y agoI'm not sure if they support AES-NI on ARM. I found some changelogs indicating that they do support it on x86 and x64, and most ARM routers list "hardware IPsec" encryption, so maybe?
- OJFord 6y agoI can't read German, but maybe it's a bare Mikrotik router board in a custom enclosure? That said, it also says 'Pfsense', so I suppose more likely it's a typical 'Chinesium' listing.
- dpzmick 6y agosimilar boxes are on amazon, with worse(ish) specs under the brand "Protectli "
- searchableguy 6y agoRaspberry pi 4 compute module might be good for building your own router too. You can attach a pcie network extension or usb to Ethernet for local usage. All of that would cost under $70. https://www.raspberrypi.org/products/compute-module-4/?variant=raspberry-pi-cm4001000 https://www.raspberrypi.org/products/compute-module-4/?varia... https://www.zahradnik.io/raspberry-pi-as-a-home-router https://www.zahradnik.io/raspberry-pi-as-a-home-router Edit: You would be better served by other boards from this benchmark repo for vpn usage: https://github.com/ThomasKaiser/sbc-bench/blob/master/Results.md https://github.com/ThomasKaiser/sbc-bench/blob/master/Result...
- tjohns 6y agoIt's worth noting that the Unifi gateways have hardware offload for traffic routing. While a Raspberry Pi might work for some folks, it's worth noting that these are two very different performance classes.
- aborsy 6y agoHow is it great with one NIC? Ethernet adapter and USB speeds seem less than ideal.
- searchableguy 6y agoI don't need many ethernet ports so it works for me. My home network speed is less than a gigabit. It's definitely not for people like OP but may work for other people who don't want to pay much and still have something decent that they can hack themselves. I have tried to flash open firmware on my router before but it didn't work out. I had a raspberry pi already so I decided to convert it into a router and use it.
- jsight 6y agoA Pi 4 can handle about 1 Gb without issue. It is a great option for consumer workloads at consumer prices. I've certainly seen far worse consumer gear.
- geerlingguy 6y agoThe CM4 can hit up to ~3.4 Gbps for one interface over PCI-E, and 4.15 Gbps if you also use the onboard Gigabit interface. Use a 1, 2, or 4-port network card and you can do some interesting things at 1+ Gbps: https://pipci.jeffgeerling.com/#network-cards-nics https://pipci.jeffgeerling.com/#network-cards-nics
- centimeter 6y agoFWIW, I tried using OpenWRT on a box with similar specs to yours and it was a nightmare. Ended up using FreeBSD instead and it was a vastly better experience. I think OpenWRT might only be worth it on very low-spec hardware.
- pimeys 6y agoHey! Could you please share what you think didn't work so well with OpenWRT? I'm currently running a Turris Omnia with their custom OpenWRT that I know how to use and it's been working quite well. What's missing is a better CPU to run Wireguard encryption full speed through our fast internet connection. I'm seriously thinking about pfSense or Opnsense, but FreeBSD still misses native Wireguard support, leaving the encryption to the go implementation, which is subpar for our use cases. But, I'd be happy to run Opnsense, with jails and all those goodies from FreeBSD.
- floatboth 6y agoWireguard has been merged into upstream FreeBSD almost a couple months ago.
- pimeys 6y agoFreeBSD 13 is out in March 2021 and opnSense with that system much later. Might be a bit complex to go that route right now, but it might be a great choice one year from now...
- gonzo 6y agoSince Netgate (the company behind pfSense) paid for the Wireguard work, you can make a good bet that same will appear in a near-future release of pfSense.
- comboy 6y agoI still put the important part of my network behind my own router similar to yours (and in terms of security I think ubuntu server + whatever you need has likely much smaller attack surface than OpenWRT which is a piece of software just too tasty not to be exploited). Outside that, wifi part is hard to get right and smart switches are nice to have, but they are PITA if the firmware is never updated and there's no single place to nicely manage it all.
- pimeys 6y agoI'm having already Unifi's AP's, the controller running in my NAS and a good switch for the current setup. Do you have some better suggestions for the router software? I'd love to run Opnsense, but a native Wireguard client is a must, and so is a good web interface for the setup.
- aborsy 6y agoCan you expand on the security of an Ubuntu server (acting as firewall, router and vpn), versus a dedicated router hardware and software (eg pfsense or OpenWRT)?
- gcblkjaidfj 6y agoopenwrt contributor's focus is consumer hardware support. I don't think the distro was ever security audited.
- waynesonfire 6y agoi've got this on my todo list of projects. looks super interesting. there seem to be a lot of flavors of these boxes and i'm having a difficult time figuring which one will work best. i don't know anything about the manufacturers.
- nicolas314 6y ago"with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard" You were probably thinking of OpenVPN? Wireguard is not based on AES and thus has no use for AES-NI.