Favorite cheap multi-GBE SBCs for use as router/firewall appliances - Page 1
Forum section: electronics / general

author: cdev
author_rank: Super Contributor
timestamp: July 18, 2021, 10:59:43 pm
content: A number of cheap SBCs that run limux have multiple gigabit lan ports. They all are very energy efficient, and have GPIOs and have basic connectivity options. But the rest vary a lot.Do any stand out for good wired networking capabilities when used as a software router/switch?I dont know much about how the various CPUs perform in that usage scenario.Presumably they all have GPIOs and UART that can be used with a NMEA speaking device (GPS) and its one pulse per second source for accurate timekeeping?I don't know much about the many new SBC HW platforms.Presumably even OSs like FreeBSD might be fairly straightforward to compile on a new hardware platform.. If one had a complete Linux for it.

author: brucehoult
author_rank: Super Contributor
timestamp: July 19, 2021, 04:41:59 am
content: How many ethernet ports do you want?If it's more than just a couple then it's hard to go past something designed specifically for the purpose, such as the $99 Mikrotik RB450Gx4 with quad core 716 MHz ARM cpu, 1 GB RAM, and 5 gigE ports. Industrial quality at close to hobbyist prices.https://mikrotik.com/product/rb450gx4

author: brucehoult
author_rank: Super Contributor
timestamp: July 19, 2021, 04:48:13 am
content: Banana Pi BPI-R2 is also an option, but at only $10 less than the Mikrotik I'd go for the Mikrotik every time based on known quality and support.https://www.amazon.com/Open-Source-Compatible-Raspberry-Quad-core-Cortex-A7/dp/B07JZ8LM6Q

author: Nominal Animal
author_rank: Super Contributor
timestamp: July 19, 2021, 08:31:48 am
content: For the MikroTik products, do take a look at theResultstab in the product page. Typical real-world performance is somewhat less, but should give a rough idea of the capabilities.I'm using anRBM33Gas a 4G/LTE router/firewall myself.

author: DiTBho
author_rank: Super Contributor
timestamp: July 19, 2021, 10:55:47 am
content: The MediaTek's MTK MT7622 SoCs look interesting ...

author: DiTBho
author_rank: Super Contributor
timestamp: July 19, 2021, 12:18:21 pm
content: Quote from: cdev on July 18, 2021, 10:59:43 pmOn Atom, Geode, and x86-compatible SoC.

author: cdev
author_rank: Super Contributor
timestamp: July 20, 2021, 10:23:08 pm
content: I have a Geode based HP thin client. But I would need to use a USB NIC and it only has USB2, not USB3What do you think about firewalling performance?

author: cdev
author_rank: Super Contributor
timestamp: July 20, 2021, 10:28:25 pm
content: The Mikrotic is designed for hat kind of application but closed source and they hav had security issues in the past, but youre right, it does look like a hell of a value and four ports is pretty good, plus the list of features in the OS is quite respectable.Thanks, this is a good suggestion. One thats pretty hard to beat, even now with all the new SBCs out there.Quote from: brucehoult on July 19, 2021, 04:41:59 am

author: cdev
author_rank: Super Contributor
timestamp: July 21, 2021, 12:50:15 am
content: Four ports would be ideal. Two gigabit ports would be adequate.

author: cdev
author_rank: Super Contributor
timestamp: July 21, 2021, 12:58:34 am
content: https://www.amazon.com/Open-Source-Compatible-Raspberry-Quad-core-Cortex-A7/dp/B07JZ8LM6QThis board looks much more flexible but it is too expensive for me right now. .Around a year ago I saw a two port Banana Pi that was super cheap, (under $30)Now I cant find it.Quote from: brucehoult on July 19, 2021, 04:48:13 amIf I could install some well respected firewall distro. that would be ideal. I would love to find a hardware platform that I could install any x86_64 image onto. A small energy efficient serverActually, I just remembered I have seen a number of RPI ComputeModule4 expansion boards that have multiple -GBEs I forget their prices.Buut I dont think super expensive.

author: 2N3055
author_rank: Super Contributor
timestamp: July 21, 2021, 06:48:22 am
content: Don't waste your time reinventing the wheel.Just use Mikrotik.As for "...and they hav had security issues in the past, ...." comment, by that token, nobody should use ANTHING made by Cisco EVER...

author: David Hess
author_rank: Super Contributor
timestamp: July 21, 2021, 07:21:05 am
content: I just bought a PC Engines APU2 with 4 x Intel i211AT Gigabit Ethernet ports for that application, and they have ECC RAM as well.

author: Nominal Animal
author_rank: Super Contributor
timestamp: July 21, 2021, 09:35:29 am
content: Quote from: cdev on July 20, 2021, 10:28:25 pmI run OpenWRT on myRBM33G.RB450gx4is fully supported byrobimarko's OpenWRT branch.The only closed source part running is the routerboot boot loader, which I personally accept gladly, because it makes these things unbrickable (at least via normal upgrade mechanisms), and is perfectly happy booting OpenWRT. You could replace that with u-boot, but it just isn't worth it in my opinion.

author: DiTBho
author_rank: Super Contributor
timestamp: July 21, 2021, 08:33:44 pm
content: I like OpenWRT, but I would recommend it only to developers and to people who both have skills and strong motivation.

author: DiTBho
author_rank: Super Contributor
timestamp: July 21, 2021, 08:43:46 pm
content: Quote from: cdev on July 20, 2021, 10:23:08 pmYou mentioned FreeBSD, my answer was only related to the best supported architectureFreeBSD on x86 is Tier class 1 -> Fully-Supported Architectures)FreeBSD on ARM is Tier class 2 -> Developmental and Niche ArchitecturesTier class 2Tier class 2 platforms are functional, but less mature FreeBSD platforms. They are not supported by the security officer, release engineering, and port management teams.

author: PlainName
author_rank: Super Contributor
timestamp: July 21, 2021, 10:19:50 pm
content: I can highly recommend pfSense:https://www.pfsense.org/products/Originally ran it on a PC Engines Geode with tiny compact flash, but now it's running on some firewall box which is basically a PC in a firewall-looking case. I've run it in a VM (saves on hardware), installed to clients, paid a bounty to get a feature incorporated, etc. I looked at OpenWRT but that sucks dogs in comparison, IMO.Netgate sponsors them now (they used to be entirely commercial-free), so the site wants you to buy Netgate stuff. Ignore all that, and the pfSense Plus (unless you need that kind of support, of course). However, that product page does have a handy table of CPU power appropriate to various sustained throughputs, which might be useful in your choice of hardware.

author: cdev
author_rank: Super Contributor
timestamp: July 21, 2021, 10:47:40 pm
content: Yes, PFSense looks like a keeper. I realoly want to have fine grained control. I really need it actually, thanks..

author: David Hess
author_rank: Super Contributor
timestamp: July 21, 2021, 11:24:37 pm
content: Quote from: dunkemhigh on July 21, 2021, 10:19:50 pmI am trying to go the other way. I have been running M0n0wall and pfSense at various times on PC hardware for but picked up a PC Engines APU2 a couple months ago to use instead.I have been experimenting with OPNsense because it supports more of what I want to do but problems may leave me switching back to pfSense.

author: PlainName
author_rank: Super Contributor
timestamp: July 21, 2021, 11:54:29 pm
content: QuoteWhat kind of problems?I keep meaning to take a look at it (particularly since it seems many bad remarks were made by the pfSense people), but I rely on pfBlockerNG-devel quite heavily to protect my servers (email hack attempts are annoying, but also provide an unending list of IP ranges to blacklist).

author: David Hess
author_rank: Super Contributor
timestamp: July 22, 2021, 07:30:53 pm
content: Quote from: dunkemhigh on July 21, 2021, 11:54:29 pmI have not been able to get DNS working properly with any configuration of DNS.

author: PlainName
author_rank: Super Contributor
timestamp: July 22, 2021, 09:06:02 pm
content: That's not a small problem!

author: dredd
author_rank: Contributor
timestamp: August 01, 2021, 12:40:53 pm
content: Quote from: dunkemhigh on July 21, 2021, 10:19:50 pmOPNsense is step ahead of pfSense, you'll be better off. MIT licenced too.www.opnsense.org

author: PlainName
author_rank: Super Contributor
timestamp: August 01, 2021, 01:10:47 pm
content: It's the pfBlockerNG-devel plug-in that would give me pause for thought, possibly terminally. Pretty much essential for my setup.

author: cdev
author_rank: Super Contributor
timestamp: August 25, 2021, 02:31:20 pm
content: OPNSense uses "unbound" as its DNS which is fairly well documented. But there are some gotchas.If you could post any log messages. there is a small program to check your configuration's well formedness.Also a program to fetch trust anchor file. There are a bunch of files actually to get the DNS server bootstrpped with the Internet's root DNS servers for the various TLDs and so on.At the beginning it fetches and caches a lot of data.Quote from: David Hess on July 22, 2021, 07:30:53 pm

author: cdev
author_rank: Super Contributor
timestamp: August 25, 2021, 02:35:53 pm
content: Quote from: dunkemhigh on July 21, 2021, 11:54:29 pmsimilar to Suricata, Snort, etc, or something better?

author: PlainName
author_rank: Super Contributor
timestamp: August 25, 2021, 04:05:46 pm
content: Maybe. It's hard to tell from the headline feature lists what they can do for me - at least there is a feature list instead of just a list of recent updatesAs I said, I use the failed email login logs to block ranges of IP (which could range from single IP to entire country). Can those things do that for me?

author: cdev
author_rank: Super Contributor
timestamp: August 25, 2021, 06:46:14 pm
content: Suricata certainly can. And its free, but some lists of rules may cost money.

author: PlainName
author_rank: Super Contributor
timestamp: August 25, 2021, 08:10:15 pm
content: How would it know the mail server has bumped an incorrect login?

author: ve7xen
author_rank: Super Contributor
timestamp: August 25, 2021, 08:45:53 pm
content: The vendorQotomon Aliexpress builds a variety of fanless mini PCs with up to 8 Intel NICs and Atom to i7 CPUs that are a good fit for this use. Price point is higher than Mikrotik etc. but performance is too. I've been evaluating one of them for potential wide deployment at $DAYJOB and been pretty happy with it. It's the best value I've found for an x86 GigE-class network appliance. No other affiliation.Lanner out of Taiwan is a somewhat more 'respected' vendor of similar appliances, at the corresponding higher price point and annoying distribution channel. These are nice too but expensive.

author: cdev
author_rank: Super Contributor
timestamp: August 27, 2021, 05:19:38 pm
content: There are now several new options based on the raspberry pi 4 compute module. They are described as carrier boards and all I have seen have two ports, the CM costs around $25 and these carrier boards run as little as $30. So they make a functional small router/firewall box starting at around $55 that can handle gigabyte ethernet.That's pretty cheap.

author: cdev
author_rank: Super Contributor
timestamp: August 27, 2021, 05:25:26 pm
content: Quote from: ve7xen on August 25, 2021, 08:45:53 pmI've looked at them but they seem a bit more expensive than I'd hope them to be. Thin clients are a lot cheaper, it seems. Some are basically really cheap.What do people think about using USB3 NICS with a USB3 -capable thin client and a USB3 hub for a firewall?

author: cdev
author_rank: Super Contributor
timestamp: August 27, 2021, 05:30:18 pm
content: What do the Mikrotics with their dedicated switch chips bring to the table thats superior to a plain PC with multiple NICS? Performance, but is the performance that much better? How does that wrk? I am looking for an explanation about how the hardware elements interact?I think the setup I am envisioning would ideally need at least four ports plus WAN so five. This is to have physical separation between different kinds of devices (like VOIP phones, servers and PCs and wireless PCs) all with a firewall to rule them all...Quote from: brucehoult on July 19, 2021, 04:41:59 am

author: cdev
author_rank: Super Contributor
timestamp: August 27, 2021, 05:44:26 pm
content: Quote from: dunkemhigh on August 25, 2021, 08:10:15 pmBy parsing your mail server's log for strings indicating so? And comparing that info to its own internal queue's records?With the caveat that I literally have just recently started looking at them it appears they use dedicated filters to break packets into categories and then operate on the individual packets in queues.. before letting them go to their final destinations. Suricata uses a lanugage "Rust" which seems particularly well suited for doing this.Similar to a firewall but with finer granularity and more verbosity in logging. The IDS systems (Surcata, Snort, and it seems many others most of which support rules written in one of the two firmats) download large text files that contain literally thousands of rules every hour or day or week or so and update their behaviors. They can go much further than the log-centric checking IP addresses and domain names resolve to something that makes sense for what they are doing or check them against a "bad people" list and then adding failed attempts to a list the firewall then blocks for a period of time. (thats what fail2ban does).Smaller switch/ruters even the fancy ones like the aforementioned ones seem to not be up for being used with or as an IDS. They just dont have the horsepower.They may also (like fail2ban) keep records of failed logins in a fast database and make it extremely difficult to sit at a server trying different logins or paswords.. All the time compiling statistics if anybody keeps trying and failing again and again. The more they try the more the ban thats used for them is lengthened or expanded to a larger scope.. say banning entire hosting companies or IP address blocks if banning similar hosts makes sense. .. etc.

author: ve7xen
author_rank: Super Contributor
timestamp: August 27, 2021, 06:10:42 pm
content: Quote from: cdev on August 27, 2021, 05:25:26 pmIn theory it will work, but it's pretty janky and may be unreliable. I have also found most USB3 NICs struggle to achieve close to 1G of throughput. If you don't need multi-Gbps of throughput, I would prefer to use one or two real 1G interfaces from the thin client/NUC/mini PC to a managed switch and make a 'router on a stick' using VLANs.QuoteThe switch means that port-to-port traffic within the same VLAN doesn't need to hit the CPU for bridging, so depending on your use case may improve performance. But it sounds like in your case it won't help at all, any routing / NAT needs to be done on the CPU. It's basically a way to save BOM cost by avoiding needing dedicated NICs for every port (which also means you need a PCIe interface on the controller and a bus for the NICs). You can assign different VLANs to each port with a single (internal) GigE attached to the CPU and it appears to outside hosts that each port is independent. Very common for low-end network hardware to be designed this way. Basically what I suggest above, but integrated in the box.

author: bingo600
author_rank: Super Contributor
timestamp: September 12, 2021, 06:25:30 pm
content: Quote from: brucehoult on July 19, 2021, 04:48:13 amQuality... "Cough..Cough"https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/Well to be fair i have used some OK products from them , but they seem to have quite some Oopzes in RouterOS/Bingo

author: cdev
author_rank: Super Contributor
timestamp: September 19, 2021, 05:40:32 pm
content: I have to say though, they pack a lot of value into those devices.Whenever a manufacturer does that its impossible to avoid vulnerabilities, etc. unless they have an unlimited budget. (or somebody else does)Quote from: bingo600 on September 12, 2021, 06:25:30 pmI think their user-interface could be improved a lot without too much pain.