3 ms·

I have one of the upper models (DEC850) I bought last year, and been meaning to write about it. Overall, it's been great, although I haven't gone through and do

I have one of the upper models (DEC850) I bought last year, and been meaning to write about it. Overall, it's been great, although I haven't gone through and done as much analysis as the linked post. I should've moved to a dedicated home firewall sooner, but wasn't super high on my priorities. But with all the problems home modems/routers seem to be having, along with an upgrade to fiber internet that included a modem with hard coded default credentials that could not be changed I made the switch. Only glitch I've noticed is a few problems with unbound dns, that I need to spend some more time on. DNS over TLS doesn't seem to be working for me, and I've had a couple glitches now when there are power fluctuations that I have to restart DNS after boot. But that could easily be something wonky in my setup and need to do more work to isolate the issue. Overall, I would recommend for anyone who wants something a bit better than just the consumer grade stuff provided by an ISP, and for small business, remote sites, etc.

xvector 4y ago
Unbound was also glitchy for me. I had to switch to Dnsmasq on the firewall. Optionally you can forward to AdGuard Home for DoH/DoT and ad/tracker blocking.
KennyBlanken 4y ago
Paying $700+ for something like this is just silly. OPNsense and pfSense are both charging massive markups on this hardware. pfSense doubles the price over the exact same box you can get from AliExpress or ebay. Buy a standard Ryzen mobo, a low-end recent Ryzen CPU, undervolt it, toss some ram in, an old SATA SSD, and a dual or quad port PCIe adapter off ebay. Or just buy an old Dell SFF PC; you can get your choice of how powerful a processor you want. If you want the embedded/fanless setup, then buy one of the aliexpress/ebay boxes. Qotom is one such seller, I believe. As someone with a ton of experience with opnsense: their release style is extremely irritating. The only way to get security updates is to conduct a full upgrade of the system. The UI is clunky, outdated, full of useless "help text", and almost seems to be purposefully designed to use confusing field names and terminology. Debugging problems is difficult at best with inconsistent logging infrastructure. I've also never once had a config restore go properly, something I've tried to do several times because I generally get about 2-3 years out of an opnsense install before enough stuff has broken that I need to reinstall from scratch. Last but not least: they now routinely ignore their support forum except for the most simple, common problems. Every time I've had a problem, I've found a corresponding post in their forum which has gone gnored by their employees.
- walterbell 4y ago
  > OPNsense and pfSense are both charging massive markups on this hardware. Hardware remains one of the few viable business models for open-source software. The combination of features on this particular device have literally not been sold before, so in this particular case, the price may be somewhat justified IF they are also providing regular UEFI firmware security fixes. With such high margins, it's surprising there are no hardware clones for AMD firewalls. Is that due to CPU shortages? Protectli is a success story for Intel firewalls, where the open (coreboot) product earns a price premium and opaque clones expand the market.
- Sebb767 4y ago
  15W idle is not bad. The 20€ eBay-Cards will eat this alone. You can get better numbers with Intel cards, but those are 70€ and up. Also, Ryzen embedded is quite a bit more efficient. Now, depending on where you live, this might not matter, but a Wattyear costs me ~3.4€. So if the thing uses 35W instead of 15W, I pay 68€ extra per year just for power. Additionally, you need to find a small formfactor passive case that supports a PCIe card and a small enough mainboard to fit it. This alone will set you back quite some money. If space or power efficiency don't matter to you, that's totally fine, then you can easily & cheaply match those specs. If you need something small and efficient, the markup isn't that large.
  - glowingly 4y ago
    The cost can still favor DIY, even using new parts. I did this twice about a year ago, when the USD prices were far worse for DIY. Nowadays, one can get a cheap Alder Lake Pentium + ITX/mATX with a cheap case, okay PSU, RAM, and SSD. That's no more than $350. Now new Intel dual SFP+ NICs are hard to find cheap, with Nvidia cards being easier to find cheap. So a dual port CX4 or CX5 from fs.com will run from $260 to $340. This still comes out ahead of the official HW. It all gets cheaper with older Intel HW.[1] IMO, buying the official HW is officially supporting the OPNSense developers. As you noted, the DEC700 series is also quite small in terms of footprint. Those are definitely strong factors in favor of the DEC700. [1] I mostly went with Intel HW, moving away from using a R5 3600 in that role. It seems that AMD's Zen2 is a bit less efficient vs contemporary and current Intel desktop platforms in idle to low-mid loads. Current setup with an older used Pentium and an used dual port X520 takes ~<20W on average. Though I doubt the DEC740 takes 15W at idle, probably less. W.r.t. older Intel HW, I am thinking of 10th/11th gen parts, which can be had on good deals new.
xoa 4y ago
We have the fairly high end DEC3850, and I don't recommend it (or their other stuff). Not because I don't love OPNsense, because I do and I've switched all my firewall/gateway/routing tasks over to it at a range of sites from UniFi gateways (which are crap). OPNsense is awesome. I have Deciso's Business Edition as well in a bunch of places. And the thing does work. But the value is crap. Essentially it's a SuperMicro 5019D-FTN4 with a worse performing chip, a built-in AMD SFP+ solution (which isn't as well supported as a cheap Chelsio card one can find on Ebay), and with no IPMI or normal VGA console. Which sucks. For something as critical as a gateway, it's really nice to just be able to plug it into normal rack console/screen/IPMI management for recovery and install. And originally barebones the 5019D sold for around $1k. While sadly amongst the supply shortages now they're more like $1400 despite being old, that's still ~$300 less than the DEC3850, and will end up about even with RAM and an M.2. But you still then get a faster CPU, and much better management. They throw in a single year of BE as a small sweetener but overall their offerings are straight downgrades in my opinion from just getting normal decent PC hardware. And that's part of the advantage of going to OPNsense in the first place. So I kind of regret going for that vs just getting a normal SM system (various flavors of which I've deployed everywhere else, I got a bunch of 5018Ds for ~$600 for example). Not that setting up a special dedicated serial thing is a huge deal, but it's definitely an annoyance at that price level. Looking over the rest of their offerings it all looks similar: debatable quality for the money vs bog standard quality hardware. And I want to be clear this isn't just a complaint about markup. I don't in principle actually mind paying more for the same thing if it comes with better support and someone standing behind it. The problem here is that the features are actively worse, and support is too! I was very surprised for example that something like Sunny Valley's Zenarmor actually has issues with the DEC3850's SFP+ that it wouldn't have with an old Chelsio card. So it's not like it runs OPNsense better. Still, despite warts I'm very happy overall with the OPNsense, and with Deciso beyond their kit. It's also let me squeeze more life out of stuff I was feeling more iffy about (like UniFi and UISP for example, now I can just route their management VLANs via WireGuard for L3 management with zero internet exposure, and without UI's shitty ass routing/security I'm no longer feeling as pressured to leave ASAP).
MrFoof 4y ago
I actually mentioned the DEC750 the other day in another thread: https://news.ycombinator.com/item?id=31451142 https://news.ycombinator.com/item?id=31451142 I forgot to mention the linked review that this post is around. Though it was probably the most detailed one I found at the time prior to purchasing my DEC750 from Deciso's OPNSense shop (https://shop.opnsense.com https://shop.opnsense.com) I picked one up a few months ago as part of my attempt to overhaul my home network so I don't have to care again for a decade. Currently complemented by a "L3" 24-port Ubiquiti PoE+ switch (twelve 1GbE, twelve 2.5GbE, two SFP+) and an "L3" 32-port Ubiquiti SFP+/SFP28 switch. The hope is as DOCSIS 4.0 rolls out I'll get more value out of using SFP+ for a WAN port. Grabbed a Micron MTA18ADF2G72AZ (16GB DDR4-2666 ECC VLP U-DIMM) to never have to care about memory. Ever. All the Suricata and CrowdSec rules in the world. Also grabbed an Edimax N150 WiFi 4 USB adapter. This uses a RealTek RTL8188EUS chipset, which is extremely well supported by FreeBSD's urtwn(4) driver. So I use that to automatically do WAN failover to my iPhone 11 Pro as a hotspot if the cable itself went down. Rock. Solid. And per my PDU, really just sits at 8-9W. If my experience with this is anything like my experience with FreeBSD (limited) over the past 25 years, I expect the only downtime will be when I move house.

xvector 4y ago

Unbound was also glitchy for me. I had to switch to Dnsmasq on the firewall. Optionally you can forward to AdGuard Home for DoH/DoT and ad/tracker blocking.

KennyBlanken 4y ago

Paying $700+ for something like this is just silly. OPNsense and pfSense are both charging massive markups on this hardware. pfSense doubles the price over the exact same box you can get from AliExpress or ebay. Buy a standard Ryzen mobo, a low-end recent Ryzen CPU, undervolt it, toss some ram in, an old SATA SSD, and a dual or quad port PCIe adapter off ebay. Or just buy an old Dell SFF PC; you can get your choice of how powerful a processor you want. If you want the embedded/fanless setup, then buy one of the aliexpress/ebay boxes. Qotom is one such seller, I believe. As someone with a ton of experience with opnsense: their release style is extremely irritating. The only way to get security updates is to conduct a full upgrade of the system. The UI is clunky, outdated, full of useless "help text", and almost seems to be purposefully designed to use confusing field names and terminology. Debugging problems is difficult at best with inconsistent logging infrastructure. I've also never once had a config restore go properly, something I've tried to do several times because I generally get about 2-3 years out of an opnsense install before enough stuff has broken that I need to reinstall from scratch. Last but not least: they now routinely ignore their support forum except for the most simple, common problems. Every time I've had a problem, I've found a corresponding post in their forum which has gone gnored by their employees.

walterbell 4y ago
> OPNsense and pfSense are both charging massive markups on this hardware. Hardware remains one of the few viable business models for open-source software. The combination of features on this particular device have literally not been sold before, so in this particular case, the price may be somewhat justified IF they are also providing regular UEFI firmware security fixes. With such high margins, it's surprising there are no hardware clones for AMD firewalls. Is that due to CPU shortages? Protectli is a success story for Intel firewalls, where the open (coreboot) product earns a price premium and opaque clones expand the market.
Sebb767 4y ago
15W idle is not bad. The 20€ eBay-Cards will eat this alone. You can get better numbers with Intel cards, but those are 70€ and up. Also, Ryzen embedded is quite a bit more efficient. Now, depending on where you live, this might not matter, but a Wattyear costs me ~3.4€. So if the thing uses 35W instead of 15W, I pay 68€ extra per year just for power. Additionally, you need to find a small formfactor passive case that supports a PCIe card and a small enough mainboard to fit it. This alone will set you back quite some money. If space or power efficiency don't matter to you, that's totally fine, then you can easily & cheaply match those specs. If you need something small and efficient, the markup isn't that large.
- glowingly 4y ago
  The cost can still favor DIY, even using new parts. I did this twice about a year ago, when the USD prices were far worse for DIY. Nowadays, one can get a cheap Alder Lake Pentium + ITX/mATX with a cheap case, okay PSU, RAM, and SSD. That's no more than $350. Now new Intel dual SFP+ NICs are hard to find cheap, with Nvidia cards being easier to find cheap. So a dual port CX4 or CX5 from fs.com will run from $260 to $340. This still comes out ahead of the official HW. It all gets cheaper with older Intel HW.[1] IMO, buying the official HW is officially supporting the OPNSense developers. As you noted, the DEC700 series is also quite small in terms of footprint. Those are definitely strong factors in favor of the DEC700. [1] I mostly went with Intel HW, moving away from using a R5 3600 in that role. It seems that AMD's Zen2 is a bit less efficient vs contemporary and current Intel desktop platforms in idle to low-mid loads. Current setup with an older used Pentium and an used dual port X520 takes ~<20W on average. Though I doubt the DEC740 takes 15W at idle, probably less. W.r.t. older Intel HW, I am thinking of 10th/11th gen parts, which can be had on good deals new.

xoa 4y ago

We have the fairly high end DEC3850, and I don't recommend it (or their other stuff). Not because I don't love OPNsense, because I do and I've switched all my firewall/gateway/routing tasks over to it at a range of sites from UniFi gateways (which are crap). OPNsense is awesome. I have Deciso's Business Edition as well in a bunch of places. And the thing does work. But the value is crap. Essentially it's a SuperMicro 5019D-FTN4 with a worse performing chip, a built-in AMD SFP+ solution (which isn't as well supported as a cheap Chelsio card one can find on Ebay), and with no IPMI or normal VGA console. Which sucks. For something as critical as a gateway, it's really nice to just be able to plug it into normal rack console/screen/IPMI management for recovery and install. And originally barebones the 5019D sold for around $1k. While sadly amongst the supply shortages now they're more like $1400 despite being old, that's still ~$300 less than the DEC3850, and will end up about even with RAM and an M.2. But you still then get a faster CPU, and much better management. They throw in a single year of BE as a small sweetener but overall their offerings are straight downgrades in my opinion from just getting normal decent PC hardware. And that's part of the advantage of going to OPNsense in the first place. So I kind of regret going for that vs just getting a normal SM system (various flavors of which I've deployed everywhere else, I got a bunch of 5018Ds for ~$600 for example). Not that setting up a special dedicated serial thing is a huge deal, but it's definitely an annoyance at that price level. Looking over the rest of their offerings it all looks similar: debatable quality for the money vs bog standard quality hardware. And I want to be clear this isn't just a complaint about markup. I don't in principle actually mind paying more for the same thing if it comes with better support and someone standing behind it. The problem here is that the features are actively worse, and support is too! I was very surprised for example that something like Sunny Valley's Zenarmor actually has issues with the DEC3850's SFP+ that it wouldn't have with an old Chelsio card. So it's not like it runs OPNsense better. Still, despite warts I'm very happy overall with the OPNsense, and with Deciso beyond their kit. It's also let me squeeze more life out of stuff I was feeling more iffy about (like UniFi and UISP for example, now I can just route their management VLANs via WireGuard for L3 management with zero internet exposure, and without UI's shitty ass routing/security I'm no longer feeling as pressured to leave ASAP).

MrFoof 4y ago

I actually mentioned the DEC750 the other day in another thread: https://news.ycombinator.com/item?id=31451142 https://news.ycombinator.com/item?id=31451142 I forgot to mention the linked review that this post is around. Though it was probably the most detailed one I found at the time prior to purchasing my DEC750 from Deciso's OPNSense shop (https://shop.opnsense.com https://shop.opnsense.com) I picked one up a few months ago as part of my attempt to overhaul my home network so I don't have to care again for a decade. Currently complemented by a "L3" 24-port Ubiquiti PoE+ switch (twelve 1GbE, twelve 2.5GbE, two SFP+) and an "L3" 32-port Ubiquiti SFP+/SFP28 switch. The hope is as DOCSIS 4.0 rolls out I'll get more value out of using SFP+ for a WAN port. Grabbed a Micron MTA18ADF2G72AZ (16GB DDR4-2666 ECC VLP U-DIMM) to never have to care about memory. Ever. All the Suricata and CrowdSec rules in the world. Also grabbed an Edimax N150 WiFi 4 USB adapter. This uses a RealTek RTL8188EUS chipset, which is extremely well supported by FreeBSD's urtwn(4) driver. So I use that to automatically do WAN failover to my iPhone 11 Pro as a hotspot if the cable itself went down. Rock. Solid. And per my PDU, really just sits at 8-9W. If my experience with this is anything like my experience with FreeBSD (limited) over the past 25 years, I expect the only downtime will be when I move house.