5 ms·

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

fellowmartian 3y ago
There’s this class of devices: https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-5gbe-fanless-firewall-and-router-review/ https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-... I have one of them, they’re great. I haven’t checked hardware support on FreeBSD as I run Linux so please do your own research.
nick0garvey 3y ago
You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.
- hotpotamus 3y ago
  The main issue I see with that option is space and power, the micro-form factor (NUC-sized) clone systems that people are discussing in here are quite nice for that. Functionally an old Dell tower should be fine.
  - vladvasiliu 3y ago
    Sure, but those tend to be much more expensive, so depending on the actual cost of electricity in your area, it may take a long time for you to break even. However, if you want to have a really small appliance-like pc, then yeah, the NUC-sized ones are much better.
    - KennyBlanken 3y ago
      The low-power AMD based systems everyone recommended a couple years ago were indeed great, until the ebay resellers realized what was going on and started slapping "opnsense pfsense AES-NI" etc on their listings and doubled their prices. The systems went from selling at $40-50 to over $100. Also, the AMD processor in those systems is getting extremely long in the tooth.
- alias_neo 3y ago
  This really isn't viable in somewhere like the UK. At our current electricity prices, if that machine ran at 100W, you'd be spending the equivalent of what you paid for it EVERY month in electricity. I've always seen Americans, who typically have more space and cheaper energy and fuel suggest people grab 1U servers for $40 etc, and respond just like you did when people ask them _not_ to. My car also does 50mpg, and I still pay more pay mile for fuel. In Europe, we need to spend more to buy efficient tech because the running costs require it.
  - stonogo 3y ago
    It's perfectly viable in the UK. The Optiplex 7050 is available for under a hundred pounds and the PSU tops out at 65W. It idles under eight watts. This is comparable with any other router capable of handling gigabit traffic. I think the misunderstanding is the assumption about form factor. The 7050 series is available in a case the size of a paperback book.
    - alias_neo 3y ago
      I'm willing to accept your point if you or they, can confirm that they are in fact talking about an optiplex that idles at 8W, which I doubt, for 43 dollars. Despite DELLs willingness to slap the same series number on everything from an ATX tower to a "paperback book", they are far from the same thing. I'm willing to accept I may be wrong, so let's see.
      - abwizz 3y ago
        power consumption is a strong point. there are a lot of old desktops that idle >10W but there also are some (not as old typically) that go below. if you want to be sure, use an old (skylake and above) laptop and give it a usb3-eth plug. my latitude e7470 idles at around 3W (powertop)
      - stonogo 3y ago
        Here you go. https://i.dell.com/sites/csdocuments/Shared-Content_data-Sheets_Documents/en/OptiPlex-7050-Towers-Technical-Specifications.pdf https://i.dell.com/sites/csdocuments/Shared-Content_data-She... First page, the one on the right. I don't see why you'd doubt an 8-watt idle, since it's basically a laptop processor and chipset. Please note that these models are available with both 35W and 65W TDP processors; I'm talking about the (generally cheaper) 35W models, of course.
Hasz 3y ago
I run mine on HP’s version of an optiplex with a 2nd hand pcie 1Gb quad nic, but if you wanted nicer “real” hardware with a proven track record, an HP microserver gen10 or gen10+ can be had on eBay for very little. A gen10+ should even come with iLo, which is nice.
- KennyBlanken 3y ago
  Yeah, parent commenter is being a crank. If you want "real" hardware, but (insert 1U hardware from Lenovo, HP, Dell, or Supermicro here.) I've had it running on a dell SFF desktop for years.
pigbearpig 3y ago
I just got a Protectli Vault FW4B to run it on. I wanted something small and fanless. Didn't even realize Celeron's were still made. Been running it 2 years now with no problems. Even that hardware (8GB RAM / 32GB msata) is overkill for home network. Protectli was nice to buy from, but I do think there's a lot of similar options. https://protectli.com/product/fw4b/ https://protectli.com/product/fw4b/
- aborsy 3y ago
  OPNSense runs very well on their boxes. You can even have it with Core boot. I think they should upgrade their NICs to 2.5G and 10G though. 1G is no longer future proof.
  - squarefoot 3y ago
    Most of the boxes sold here support 2.5G. No mention of Coreboot, unfortunately, but could be worth asking if they can install it as they already offer OpnSense or other firewall software installation as a service. https://www.ipu-system.de/ https://www.ipu-system.de/
    - alias_neo 3y ago
      Installing it isn't really enough, you want updates. Protectli provide instructions to compile it yourself, so even if they stopped providing binary releases, you could DIY it; well worth the premium for the security conscious in my opinion.
- alias_neo 3y ago
  I also run one of these but the 6 port version. The jest part about Protectli is the Coreboot and they provide instructions to compile your own, so it even feels open. That said, fully configured with RAM and storage mine cost roughly £600. Given electricity prices in the UK, and my requirement for an as-open-as-possible software stack, it was well worth it. If it outlasts the EdgeRouter it replaced (7yrs before power circuitry died) I'll be very happy. That said, my main concern, as a reply to you pointed out, is that I'll want more than Gigabit in that time; my street is getting 10Gb/10Gb in the next couple of years.
shmerl 3y ago
They actually have their own brand of routers: https://shop.opnsense.com/product-categorie/hardware-appliances/ https://shop.opnsense.com/product-categorie/hardware-applian...
pdx6 3y ago
I use a Dell R220 with dual ssds and a sata boot key. If you need 10gig, there an expansion slot.
tiew9Vii 3y ago
Look at the CWWK n100 mini pc’s https://cwwk.net/collections/frontpage/products/intel-12th-generation-n-series-8-core-new-member-n95-n100-n200-n305-fanless-mini-host-soft-router https://cwwk.net/collections/frontpage/products/intel-12th-g... . A big thread on serve the home https://forums.servethehome.com/index.php?threads/cwwk-topton-nxxx-quad-nic-router.39685/ https://forums.servethehome.com/index.php?threads/cwwk-topto... Alternatively the Protectli’s https://protectli.com/vault-4-port/ https://protectli.com/vault-4-port/ . Protectli gets you support and coreboot, next day Amazon shipping but more expensive and older hardware. These are great devices for running Opensense bare metal or virtualised in Proxmox. I use Proxmox on a protectli so can run unifi controller and ad guard home in lxc containers with Opensense in a VM. I’d buy a cwwk if buying again, I just didn’t know about them at the time.
- ianai 3y ago
  Can you coreboot the cwwk?
redrove 3y ago
I own a DEC3840 [1] appliance and I'm happy with it so far. I was also on the search for a proper commercial vendor after running it in a VM for years. [1] https://shop.opnsense.com/product/dec3840-opnsense-rack-security-appliance/ https://shop.opnsense.com/product/dec3840-opnsense-rack-secu...
sschueller 3y ago
I went with an AMD Ryzen 7 5800X and I run OPNsense virtualized for a 25gbit uplink with 10gbit hosts. No traffic inspection or anything fancy however. [1] [1] https://sschueller.github.io/posts/wiring-a-home-with-fiber/#router https://sschueller.github.io/posts/wiring-a-home-with-fiber/...
cycomanic 3y ago
Old thinxlients are great for this. I'm running my setup on a Fujitsu Futro. They can be had for <50 euros and you can buy an additional network card if you need more ports. They are quite energy efficient (~5W) and have enough grunt for a home system. Here is a post with some more details. https://forums.servethehome.com/index.php?threads/fujitsu-futro-s920-thin-client-as-opnsense-firewall.31087/ https://forums.servethehome.com/index.php?threads/fujitsu-fu...
spants 3y ago
I use an old mac mini which has onboard gigabit ethernet (lan side) and an apple thunderbolt to gigabit ethernet dongle for wan. I am using 900/300 fibre and it has been rock solid. No need to buy expensive stuff for this task.
unethical_ban 3y ago
Some thing like this is what I have: https://www.amazon.com/QOTOM-celeron-Processor-Fanless-pfSense/dp/B01CSCGD58/ https://www.amazon.com/QOTOM-celeron-Processor-Fanless-pfSen... I had one availability blip a few months ago, don't know what it was but a full hardware reboot fixed it. I have it running proxmox, with a debian pivpn/pihole + op lnsense VMs. I believe I have 12 gb ram in it.

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

fellowmartian 3y ago

There’s this class of devices: https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-5gbe-fanless-firewall-and-router-review/ https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-... I have one of them, they’re great. I haven’t checked hardware support on FreeBSD as I run Linux so please do your own research.

nick0garvey 3y ago

You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.

hotpotamus 3y ago
The main issue I see with that option is space and power, the micro-form factor (NUC-sized) clone systems that people are discussing in here are quite nice for that. Functionally an old Dell tower should be fine.
- vladvasiliu 3y ago
  Sure, but those tend to be much more expensive, so depending on the actual cost of electricity in your area, it may take a long time for you to break even. However, if you want to have a really small appliance-like pc, then yeah, the NUC-sized ones are much better.
  - KennyBlanken 3y ago
    The low-power AMD based systems everyone recommended a couple years ago were indeed great, until the ebay resellers realized what was going on and started slapping "opnsense pfsense AES-NI" etc on their listings and doubled their prices. The systems went from selling at $40-50 to over $100. Also, the AMD processor in those systems is getting extremely long in the tooth.
alias_neo 3y ago
This really isn't viable in somewhere like the UK. At our current electricity prices, if that machine ran at 100W, you'd be spending the equivalent of what you paid for it EVERY month in electricity. I've always seen Americans, who typically have more space and cheaper energy and fuel suggest people grab 1U servers for $40 etc, and respond just like you did when people ask them _not_ to. My car also does 50mpg, and I still pay more pay mile for fuel. In Europe, we need to spend more to buy efficient tech because the running costs require it.
- stonogo 3y ago
  It's perfectly viable in the UK. The Optiplex 7050 is available for under a hundred pounds and the PSU tops out at 65W. It idles under eight watts. This is comparable with any other router capable of handling gigabit traffic. I think the misunderstanding is the assumption about form factor. The 7050 series is available in a case the size of a paperback book.
  - alias_neo 3y ago
    I'm willing to accept your point if you or they, can confirm that they are in fact talking about an optiplex that idles at 8W, which I doubt, for 43 dollars. Despite DELLs willingness to slap the same series number on everything from an ATX tower to a "paperback book", they are far from the same thing. I'm willing to accept I may be wrong, so let's see.
    - abwizz 3y ago
      power consumption is a strong point. there are a lot of old desktops that idle >10W but there also are some (not as old typically) that go below. if you want to be sure, use an old (skylake and above) laptop and give it a usb3-eth plug. my latitude e7470 idles at around 3W (powertop)
    - stonogo 3y ago
      Here you go. https://i.dell.com/sites/csdocuments/Shared-Content_data-Sheets_Documents/en/OptiPlex-7050-Towers-Technical-Specifications.pdf https://i.dell.com/sites/csdocuments/Shared-Content_data-She... First page, the one on the right. I don't see why you'd doubt an 8-watt idle, since it's basically a laptop processor and chipset. Please note that these models are available with both 35W and 65W TDP processors; I'm talking about the (generally cheaper) 35W models, of course.

Hasz 3y ago

I run mine on HP’s version of an optiplex with a 2nd hand pcie 1Gb quad nic, but if you wanted nicer “real” hardware with a proven track record, an HP microserver gen10 or gen10+ can be had on eBay for very little. A gen10+ should even come with iLo, which is nice.

KennyBlanken 3y ago
Yeah, parent commenter is being a crank. If you want "real" hardware, but (insert 1U hardware from Lenovo, HP, Dell, or Supermicro here.) I've had it running on a dell SFF desktop for years.

pigbearpig 3y ago

I just got a Protectli Vault FW4B to run it on. I wanted something small and fanless. Didn't even realize Celeron's were still made. Been running it 2 years now with no problems. Even that hardware (8GB RAM / 32GB msata) is overkill for home network. Protectli was nice to buy from, but I do think there's a lot of similar options. https://protectli.com/product/fw4b/ https://protectli.com/product/fw4b/

aborsy 3y ago
OPNSense runs very well on their boxes. You can even have it with Core boot. I think they should upgrade their NICs to 2.5G and 10G though. 1G is no longer future proof.
- squarefoot 3y ago
  Most of the boxes sold here support 2.5G. No mention of Coreboot, unfortunately, but could be worth asking if they can install it as they already offer OpnSense or other firewall software installation as a service. https://www.ipu-system.de/ https://www.ipu-system.de/
  - alias_neo 3y ago
    Installing it isn't really enough, you want updates. Protectli provide instructions to compile it yourself, so even if they stopped providing binary releases, you could DIY it; well worth the premium for the security conscious in my opinion.
alias_neo 3y ago
I also run one of these but the 6 port version. The jest part about Protectli is the Coreboot and they provide instructions to compile your own, so it even feels open. That said, fully configured with RAM and storage mine cost roughly £600. Given electricity prices in the UK, and my requirement for an as-open-as-possible software stack, it was well worth it. If it outlasts the EdgeRouter it replaced (7yrs before power circuitry died) I'll be very happy. That said, my main concern, as a reply to you pointed out, is that I'll want more than Gigabit in that time; my street is getting 10Gb/10Gb in the next couple of years.

shmerl 3y ago

They actually have their own brand of routers: https://shop.opnsense.com/product-categorie/hardware-appliances/ https://shop.opnsense.com/product-categorie/hardware-applian...

pdx6 3y ago

I use a Dell R220 with dual ssds and a sata boot key. If you need 10gig, there an expansion slot.

tiew9Vii 3y ago

Look at the CWWK n100 mini pc’s https://cwwk.net/collections/frontpage/products/intel-12th-generation-n-series-8-core-new-member-n95-n100-n200-n305-fanless-mini-host-soft-router https://cwwk.net/collections/frontpage/products/intel-12th-g... . A big thread on serve the home https://forums.servethehome.com/index.php?threads/cwwk-topton-nxxx-quad-nic-router.39685/ https://forums.servethehome.com/index.php?threads/cwwk-topto... Alternatively the Protectli’s https://protectli.com/vault-4-port/ https://protectli.com/vault-4-port/ . Protectli gets you support and coreboot, next day Amazon shipping but more expensive and older hardware. These are great devices for running Opensense bare metal or virtualised in Proxmox. I use Proxmox on a protectli so can run unifi controller and ad guard home in lxc containers with Opensense in a VM. I’d buy a cwwk if buying again, I just didn’t know about them at the time.

ianai 3y ago
Can you coreboot the cwwk?

redrove 3y ago

I own a DEC3840 [1] appliance and I'm happy with it so far. I was also on the search for a proper commercial vendor after running it in a VM for years. [1] https://shop.opnsense.com/product/dec3840-opnsense-rack-security-appliance/ https://shop.opnsense.com/product/dec3840-opnsense-rack-secu...

sschueller 3y ago

I went with an AMD Ryzen 7 5800X and I run OPNsense virtualized for a 25gbit uplink with 10gbit hosts. No traffic inspection or anything fancy however. [1] [1] https://sschueller.github.io/posts/wiring-a-home-with-fiber/#router https://sschueller.github.io/posts/wiring-a-home-with-fiber/...

cycomanic 3y ago

Old thinxlients are great for this. I'm running my setup on a Fujitsu Futro. They can be had for <50 euros and you can buy an additional network card if you need more ports. They are quite energy efficient (~5W) and have enough grunt for a home system. Here is a post with some more details. https://forums.servethehome.com/index.php?threads/fujitsu-futro-s920-thin-client-as-opnsense-firewall.31087/ https://forums.servethehome.com/index.php?threads/fujitsu-fu...

spants 3y ago

I use an old mac mini which has onboard gigabit ethernet (lan side) and an apple thunderbolt to gigabit ethernet dongle for wan. I am using 900/300 fibre and it has been rock solid. No need to buy expensive stuff for this task.

unethical_ban 3y ago

Some thing like this is what I have: https://www.amazon.com/QOTOM-celeron-Processor-Fanless-pfSense/dp/B01CSCGD58/ https://www.amazon.com/QOTOM-celeron-Processor-Fanless-pfSen... I had one availability blip a few months ago, don't know what it was but a full hardware reboot fixed it. I have it running proxmox, with a debian pivpn/pihole + op lnsense VMs. I believe I have 12 gb ram in it.