RPi 4 as an OpenBSD router

[Mihai Popescu-3]

Hello,

Do you think is practical to run RPi 4 as an OpenBSD router, one interface
from the board and one from USB Ethernet adapter?
I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
will be a router with dhcp only, pf active.
If anyone is running this scenario, what usb to ethernet adapter do you
use? Do I need some special measures like extra cooling, etc?
Basically I need a two interface board able to route that amount of
traffic. Do you have another suggestion in this price range, please?
APU is out of the question, I can't afford the price.

Thank you.

[Stuart Henderson]

I didn't get _great_ performance from USB Ethernet on pi4, IIRC it was in
the region around 200-250Mb from tcpbench - I tried a USB3 ure(4). However
forwarding should be faster than tcpbench and it's not far off your
connection speed so it maybe good enough for you.

I think you may see a bit better performance if you can use the onboard
bse(4) ethernet (I saw pretty much line speed from this with 1500-byte
packets) with a vlan-capable switch to break it out to multiple ports.
CPU/network-wise, Pi 4 with the onboard nic is quite a lot faster than APU.

I think you'll at least want a heatsink and a case that allows good
airflow. A fan maybe a good idea if the environment is warm and the machine
is regularly under high load, but you might not need it. (the firmware
throttles the CPU if it gets too hot; it draws a thermometer icon on the
HDMI output if this happens).

--
  Sent from a phone, apologies for poor formatting.

On 16 November 2020 18:58:28 Mihai Popescu <[hidden email]> wrote:

> Hello,
>
> Do you think is practical to run RPi 4 as an OpenBSD router, one interface
> from the board and one from USB Ethernet adapter?
> I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
> will be a router with dhcp only, pf active.
> If anyone is running this scenario, what usb to ethernet adapter do you
> use? Do I need some special measures like extra cooling, etc?
> Basically I need a two interface board able to route that amount of
> traffic. Do you have another suggestion in this price range, please?
> APU is out of the question, I can't afford the price.
>
> Thank you.

[Lee Nelson]

I am using a more complicated version of the scenario you are describing
and it works well for me.  I have multiple USB interfaces which gets
complicacated, but if you are using only one USB interface, then you
should be fine.  I would use the USB to connect to your ISP and the
built-in to connect to your LAN.  That way, if something goes wrong with
the USB, you still have access to the RPi.

You absolutely want heat sinks at a minimum.  They are cheap.  If you are
going to be using it in a case, then you want a fan too.  One thing in
particular is that the USB controller gets very hot. The metal in the
connectors attached to the USB can be painful to touch when removing them.

As for adapters, it really depends on the chipset of the adapter and
OpenBSD's usb support for Ethernet adapters.  usb(4) has a list.  If you
look closely, you'll notice that only axe(4), axen(4), mue(4) and ure(4)
specifically say that they support GigE, which you will need. Then try to
find listings for adapters online that describe the chipset.  I had one
adapter lie about it's chipset on Amazon and had to return it.  The
adapters I'm using most are using the axen(4) driver and have worked fine
for me.

Power consumption is another consideration.  Unless you are using a lot of
other USB devices with the RPi, then you should be fine powering directly
from the RPi.  I'm using a USB 3 hub with external power since I'm using
multpile adapters.  If you notice strange behavior, like the adapter
suddenly disappearing, you might try an externally powered hub.

If you are going to using PF, then you might want some sort of
semi-permanent serial connection or make sure you have a keyboard and
monitor connected just in case you create a rule that locks you out.
Because I do a lot with microcontrollers, I had a dozen or more ttl serial
to usb adapters (not cables) in a drawer.  All I need in case I lock
myself out is a USB cable to connect to the adapter.  That save me from
having to remember pinouts and hope I got it right when I'm already angry
at myself for locking myself out of because I was stupid with pf. I also
connected an I2C real-time clock since the RPi has no onboard RTC.

  On Mon, 16 Nov 2020, Mihai Popescu wrote:

> Hello,
>
> Do you think is practical to run RPi 4 as an OpenBSD router, one interface
> from the board and one from USB Ethernet adapter?
> I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
> will be a router with dhcp only, pf active.
> If anyone is running this scenario, what usb to ethernet adapter do you
> use? Do I need some special measures like extra cooling, etc?
> Basically I need a two interface board able to route that amount of
> traffic. Do you have another suggestion in this price range, please?
> APU is out of the question, I can't afford the price.
>
> Thank you.
>

[Lee Nelson]

I haven't done the performance testing that Stuart has done, so keep that
in mind when reading what I wrote.  I live in the middle of nowhere and my
only available uplink is via Satellite.  That will always be the weakest
link in anything I do.  Before I switched to my RPi 4 I was using an i386
from around 2002 and had no problems with it either.  My standards are not
high.

On Mon, 16 Nov 2020, Mihai Popescu wrote:

> Hello,
>
> Do you think is practical to run RPi 4 as an OpenBSD router, one interface
> from the board and one from USB Ethernet adapter?
> I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
> will be a router with dhcp only, pf active.
> If anyone is running this scenario, what usb to ethernet adapter do you
> use? Do I need some special measures like extra cooling, etc?
> Basically I need a two interface board able to route that amount of
> traffic. Do you have another suggestion in this price range, please?
> APU is out of the question, I can't afford the price.
>
> Thank you.
>

[Mark Kettenis]

> From: Mihai Popescu <[hidden email]>
> Date: Mon, 16 Nov 2020 20:50:07 +0200
>
> Hello,
>
> Do you think is practical to run RPi 4 as an OpenBSD router, one interface
> from the board and one from USB Ethernet adapter?
> I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
> will be a router with dhcp only, pf active.
> If anyone is running this scenario, what usb to ethernet adapter do you
> use? Do I need some special measures like extra cooling, etc?
> Basically I need a two interface board able to route that amount of
> traffic. Do you have another suggestion in this price range, please?
> APU is out of the question, I can't afford the price.

The RPi 4 is easy to obtain and has a decent "out-of-the-box"
experience, but hardware-wise it is somewhat disappointing.  Cooling
is an issue and the lack of eMMC means you have to use a micro-SD card
or external USB drive for storage.  And the RPi 4 does not support the
ARM AES crypto instructions which can speed up IPsec with some
upcoming diffs.

Some interesting alternatives are:

- NanoPi R2S

  Has two Ethernet ports on the board.  The 2nd one is is ure(4), so
  USB though and some folks reported issues with it.  That may be a
  matter of using different firmware (U-Boot) though.  Cortex-A53 CPUs
  are slower than the Cortex-A72 found on the RPi 4.  No eMMC and the
  only USB port is USB-2.0.  Only 1GB of memory.

- Odroid-N2/N2+

  Very well built board with integrated heatsink.  Supports eMMC
  modules for storage and has an RTC.  Quite a bit faster than the RPi
  4.  Slight downside is that the firmware isn't 100% open source (but
  neither is the BIOS on the APU).  Has 4 USB 3.0 ports.

- Odroid-C4

  Well-built board that comes with a good heatsink.  Supports eMMC
  modules.  The Cortex-A55 cores are not much slower than the
  Cortex-A72's on the RPi 4.  No RTC.  Has 4 USB 3.0 ports.

- RockPro 64

  Needs a heatsink or fan.  Supports eMMC modules.  Has an RTC, but
  you need to get a battery with the right wires soldered on.  Has a
  PCIe slot which you can use for an NVMe disk or a PCIe network
  interface (e.g. a cheap re(4)).  Only one USB 3.0 port.

Cheers,

Mark

[Jonathan Gray-11]

On Mon, Nov 16, 2020 at 10:07:33PM +0100, Mark Kettenis wrote:

> > From: Mihai Popescu <[hidden email]>
> > Date: Mon, 16 Nov 2020 20:50:07 +0200
> >
> > Hello,
> >
> > Do you think is practical to run RPi 4 as an OpenBSD router, one interface
> > from the board and one from USB Ethernet adapter?
> > I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
> > will be a router with dhcp only, pf active.
> > If anyone is running this scenario, what usb to ethernet adapter do you
> > use? Do I need some special measures like extra cooling, etc?
> > Basically I need a two interface board able to route that amount of
> > traffic. Do you have another suggestion in this price range, please?
> > APU is out of the question, I can't afford the price.
>
> The RPi 4 is easy to obtain and has a decent "out-of-the-box"
> experience, but hardware-wise it is somewhat disappointing.  Cooling
> is an issue and the lack of eMMC means you have to use a micro-SD card
> or external USB drive for storage.  And the RPi 4 does not support the
> ARM AES crypto instructions which can speed up IPsec with some
> upcoming diffs.
>
> Some interesting alternatives are:
>
> - NanoPi R2S
>
>   Has two Ethernet ports on the board.  The 2nd one is is ure(4), so
>   USB though and some folks reported issues with it.  That may be a
>   matter of using different firmware (U-Boot) though.  Cortex-A53 CPUs
>   are slower than the Cortex-A72 found on the RPi 4.  No eMMC and the
>   only USB port is USB-2.0.  Only 1GB of memory.

They are doing a RK3399 based board with a pcie re(4) (RTL8111H) and
optionally 4GB of memory:
https://wiki.friendlyarm.com/wiki/index.php/NanoPi_R4S
though who knows when/if mainline U-Boot will support it.

>
> - Odroid-N2/N2+
>
>   Very well built board with integrated heatsink.  Supports eMMC
>   modules for storage and has an RTC.  Quite a bit faster than the RPi
>   4.  Slight downside is that the firmware isn't 100% open source (but
>   neither is the BIOS on the APU).  Has 4 USB 3.0 ports.
>
> - Odroid-C4
>
>   Well-built board that comes with a good heatsink.  Supports eMMC
>   modules.  The Cortex-A55 cores are not much slower than the
>   Cortex-A72's on the RPi 4.  No RTC.  Has 4 USB 3.0 ports.
>
> - RockPro 64
>
>   Needs a heatsink or fan.  Supports eMMC modules.  Has an RTC, but
>   you need to get a battery with the right wires soldered on.  Has a
>   PCIe slot which you can use for an NVMe disk or a PCIe network
>   interface (e.g. a cheap re(4)).  Only one USB 3.0 port.
>
> Cheers,
>
> Mark
>
>

[Diana Eichert]

I know the Macchiatobin "single shot" is an entirely different price
point than devices y'all listed.  But it appears from this commit,
https://marc.info/?l=openbsd-cvs&m=160536308709715&w=2 , it might be a
very good system.

diana

On Mon, Nov 16, 2020 at 5:32 PM Jonathan Gray <[hidden email]> wrote:

>
> On Mon, Nov 16, 2020 at 10:07:33PM +0100, Mark Kettenis wrote:
> > > From: Mihai Popescu <[hidden email]>
> > > Date: Mon, 16 Nov 2020 20:50:07 +0200
> > >
> > > Hello,
> > >
> > > Do you think is practical to run RPi 4 as an OpenBSD router, one interface
> > > from the board and one from USB Ethernet adapter?
> > > I try to replace my ISP router, the connection is 300/150 Mbps down/up. It
> > > will be a router with dhcp only, pf active.
> > > If anyone is running this scenario, what usb to ethernet adapter do you
> > > use? Do I need some special measures like extra cooling, etc?
> > > Basically I need a two interface board able to route that amount of
> > > traffic. Do you have another suggestion in this price range, please?
> > > APU is out of the question, I can't afford the price.
> >
> > The RPi 4 is easy to obtain and has a decent "out-of-the-box"
> > experience, but hardware-wise it is somewhat disappointing.  Cooling
> > is an issue and the lack of eMMC means you have to use a micro-SD card
> > or external USB drive for storage.  And the RPi 4 does not support the
> > ARM AES crypto instructions which can speed up IPsec with some
> > upcoming diffs.
> >
> > Some interesting alternatives are:
> >
> > - NanoPi R2S
> >
> >   Has two Ethernet ports on the board.  The 2nd one is is ure(4), so
> >   USB though and some folks reported issues with it.  That may be a
> >   matter of using different firmware (U-Boot) though.  Cortex-A53 CPUs
> >   are slower than the Cortex-A72 found on the RPi 4.  No eMMC and the
> >   only USB port is USB-2.0.  Only 1GB of memory.
>
> They are doing a RK3399 based board with a pcie re(4) (RTL8111H) and
> optionally 4GB of memory:
> https://wiki.friendlyarm.com/wiki/index.php/NanoPi_R4S
> though who knows when/if mainline U-Boot will support it.
>
> >
> > - Odroid-N2/N2+
> >
> >   Very well built board with integrated heatsink.  Supports eMMC
> >   modules for storage and has an RTC.  Quite a bit faster than the RPi
> >   4.  Slight downside is that the firmware isn't 100% open source (but
> >   neither is the BIOS on the APU).  Has 4 USB 3.0 ports.
> >
> > - Odroid-C4
> >
> >   Well-built board that comes with a good heatsink.  Supports eMMC
> >   modules.  The Cortex-A55 cores are not much slower than the
> >   Cortex-A72's on the RPi 4.  No RTC.  Has 4 USB 3.0 ports.
> >
> > - RockPro 64
> >
> >   Needs a heatsink or fan.  Supports eMMC modules.  Has an RTC, but
> >   you need to get a battery with the right wires soldered on.  Has a
> >   PCIe slot which you can use for an NVMe disk or a PCIe network
> >   interface (e.g. a cheap re(4)).  Only one USB 3.0 port.
> >
> > Cheers,
> >
> > Mark
> >
> >
>

--

-

Past hissy-fits are not a predictor of future hissy-fits.
Nick Holland(06 Dec 2005)

To announce that there must be no criticism of the president,
or that we are to stand by the president, right or wrong, is not
only unpatriotic and servile, but is morally treasonable to
the American public.  - Theodore Roosevelt(1918)