Router components

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|

Router components

David Higgs
I am building a replacement router/firewall for home use and am
soliciting suggestions/commentary/alternatives on the components
below.

I've heard good things on the list about Supermicro boards; any
surprises with their Atom D510 embedded boxes?  Looks like em(4)
support, which I believe is is another plus.  Ignoring performance,
are there any reasons not to run amd64 on a D510?

I was planning to use an SSD in the 32 GB size range, but the archives
indicate we don't have TRIM support yet.  Though this obviously isn't
a showstopper to usage, am I better off getting an older-generation
SSD that doesn't require TRIM, or perhaps hold off on SSDs until the
tech is more mature?

Finally, I want this box to act as wireless AP, and hope to have
out-of-the-box 802.11n support (when eventually available).  I've read
that run(4) is a solid chipset in this regard; any other suggestions?

Thanks.

--david

Reply | Threaded
Open this post in threaded view
|

Re: Router components

Nick Holland
On 10/03/10 22:11, David Higgs wrote:
> I am building a replacement router/firewall for home use

stop there.

You aren't General Motors, Yahoo, or Google.
You are looking to spend a lot of time and money trying to optimize
performance on a super-fast-sport-car that will be only used to go to
and from work in rush hour traffic.  You aren't going any faster than
the guy in front of you is going, or in this case, than your ISP is
handing you data.

There is nothing built in the last 10 years that can't do a home
router/firewall like this for most people, with the exception of a few
crappy super-low-power systems that people like to suggest as the answer
to all questions (and then complain when the pathetic NICs and anemic
CPUs don't pump data like a ten year old machine with non-pathetic NICs
does).

NONE OF IT WILL MATTER TO YOU.

Realtek NICs, three digit celeron processors, the worst of the worst
will pump more data than your ISP will deliver, so what do you gain by
tweaking for the last one percent of data flow you will never see?

Conventional stuff will cost less and run more reliably than fancy
stuff, and while you may save a few watts, you are unlikely to recoup
your investment.

And why would you put an SSD on a firewall?  so you can discover they
are a lot more expensive and less reliable than an old hard disk?  If
you want fast and reliable, use an old, burned in HD, and back up your
/etc directory.  If you want low power or silent, get a CF adapter and a
small CF card, or if your hw can boot from it, a USB flash drive.

My main firewall at home: Celeron 300, 64M RAM, couple 3G disks in a CCD
mirror (it has been around a while.  I picked the disks because this
model unreliable in my experience, so I could see how CCD mirroring
worked for me in real life...and the dang things didn't fail in
who-knows-how-many years!).  I see it suffers a bit (actually, a lot)
when I suck data from one subnet to another through my firewall, but it
still moved respectfully close to wire speed, and I really doubt the
(long) planned upgrade to a PII-450 will change that a huge amount,
considering the number of second-rate switches and such between here and
there.  I do suspect the better cache will reduce the processor
utilization numbers a lot...but then, it isn't bottoming out (but close)
so I suspect the end result will be a big no-change.  If you aren't
routing between local subnets, this machine is big overkill for you, and
if you are, like I do...probably just fine.

Nick.

Reply | Threaded
Open this post in threaded view
|

Re: Router components

David Higgs
On Sun, Oct 3, 2010 at 11:02 PM, Nick Holland
<[hidden email]> wrote:

> On 10/03/10 22:11, David Higgs wrote:
>> I am building a replacement router/firewall for home use
>
> stop there.
>
> You aren't General Motors, Yahoo, or Google.
> You are looking to spend a lot of time and money trying to optimize
> performance on a super-fast-sport-car that will be only used to go to
> and from work in rush hour traffic.  You aren't going any faster than
> the guy in front of you is going, or in this case, than your ISP is
> handing you data.
>
> There is nothing built in the last 10 years that can't do a home
> router/firewall like this for most people, with the exception of a few
> crappy super-low-power systems that people like to suggest as the answer
> to all questions (and then complain when the pathetic NICs and anemic
> CPUs don't pump data like a ten year old machine with non-pathetic NICs
> does).
>
> NONE OF IT WILL MATTER TO YOU.

Yeah, you got me -- I know it's overkill.  But give me a little
credit, I don't plan on tweaking knobs or compiling custom kernels to
squeeze performance.  I outgrew that phase five years ago on my circa
1999 desktop-turned-router that just recently passed on.  To stick
with the car analogy, I just want a reliable new car with better gas
mileage, that will get me through the next 10 years or more.

> Realtek NICs, three digit celeron processors, the worst of the worst
> will pump more data than your ISP will deliver, so what do you gain by
> tweaking for the last one percent of data flow you will never see?
>
> Conventional stuff will cost less and run more reliably than fancy
> stuff, and while you may save a few watts, you are unlikely to recoup
> your investment.
>
> And why would you put an SSD on a firewall?  so you can discover they
> are a lot more expensive and less reliable than an old hard disk?  If
> you want fast and reliable, use an old, burned in HD, and back up your
> /etc directory.  If you want low power or silent, get a CF adapter and a
> small CF card, or if your hw can boot from it, a USB flash drive.

I was researching SSDs to make the box quieter and maybe lower power;
I/O speed was just a bonus.  I can just as easily use spinning
platters until SSD tech improves and/or converges with OpenBSD
support.  I'll google up some smaller systems (Soekris, ALIX, etc?)
and see how they strike me.  Pointers here are even more welcome, as I
am not as familiar with this end of the spectrum and want to avoid the
aforementioned "crappy super-low-power systems."

Thanks for the input.

--david

Reply | Threaded
Open this post in threaded view
|

Re: Router components

Sean Kamath
On Oct 3, 2010, at 11:15 PM, David Higgs wrote:
>> NONE OF IT WILL MATTER TO YOU.
> ....
> I'll google up some smaller systems (Soekris, ALIX, etc?)
> and see how they strike me.  Pointers here are even more welcome, as I
> am not as familiar with this end of the spectrum and want to avoid the
> aforementioned "crappy super-low-power systems."
>
> Thanks for the input.

I just bought a Alix 2d13 board.  Then ended up buying about 7 of them for
work for OOB back-channel machines.

Insanely straightforward, and they Just Work(tm).

Sean

Reply | Threaded
Open this post in threaded view
|

Re: Router components

Stuart Henderson
In reply to this post by David Higgs
On 2010-10-04, David Higgs <[hidden email]> wrote:
> I am building a replacement router/firewall for home use and am
> soliciting suggestions/commentary/alternatives on the components
> below.

What sort of internet connection and what will be running over it?
Will you be doing crypto on the firewall (ipsec/some other vpn)?

> I was planning to use an SSD in the 32 GB size range, but the archives
> indicate we don't have TRIM support yet.  Though this obviously isn't
> a showstopper to usage, am I better off getting an older-generation
> SSD that doesn't require TRIM, or perhaps hold off on SSDs until the
> tech is more mature?

Newer SSDs don't *require* TRIM, it is optional. I think it's probably
a better idea to get the newer generation. Though a 2-4GB CF might be
quite good enough too.

For what a lot of people need for a router/firewall a 2-4GB CF
card in an IDE adapter would be fine too (smaller works too if you can
still find them, but it's easier to have this much space).

> Finally, I want this box to act as wireless AP, and hope to have
> out-of-the-box 802.11n support (when eventually available).  I've read
> that run(4) is a solid chipset in this regard; any other suggestions?

run(4) does not support host AP.

athn(4) is likely the best choice, I haven't used it with OpenBSD but it
looks like this is the most actively developed wireless driver at the moment.
I have used it with commercial APs running their embedded linux-based OS
and the hardware itself works very well indeed.

As I think you're aware we don't support 802.11n capabilities yet, also
note we don't support clients that use power-saving mode (this is an
absolute show-stopper for some users; some client hardware has no way
to disable this).

Reply | Threaded
Open this post in threaded view
|

Re: Router components

Forman, Jeffrey
In reply to this post by Sean Kamath
On Mon, Oct 4, 2010 at 2:28 AM, Sean Kamath <[hidden email]> wrote:

> I just bought a Alix 2d13 board.  Then ended up buying about 7 of them for
> work for OOB back-channel machines.
>
> Insanely straightforward, and they Just Work(tm).
>

I did exactly what Sean did myself several months ago. Purchased a 2d13
board from Netgate [1]. I boot off a 2GB CF card, and stuck a cheap USB HD
off of the alix board. The thing just runs without any fuss. I use it to
connect my home network to another network via OpenVPN over my home Internet
connection. When I get around to it, I might throw a mini-pci 802.11b/g card
in there to create a WAP.

dmesg porn:

OpenBSD 4.7 (GENERIC) #1: Thu Jun  3 07:32:40 EDT 2010
    [hidden email]:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Geode(TM) Integrated Processor by AMD PCS ("AuthenticAMD" 586-class)
499 MHz
cpu0: FPU,DE,PSE,TSC,MSR,CX8,SEP,PGE,CMOV,CFLUSH,MMX
real mem  = 268009472 (255MB)
avail mem = 250978304 (239MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 11/05/08, BIOS32 rev. 0 @ 0xfd088
pcibios0 at bios0: rev 2.1 @ 0xf0000/0x10000
pcibios0: pcibios_get_intr_routing - function not supported
pcibios0: PCI IRQ Routing information unavailable.
pcibios0: PCI bus #0 is the last bus
bios0: ROM list: 0xe0000/0xa800
cpu0 at mainbus0: (uniprocessor)
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 1 function 0 "AMD Geode LX" rev 0x33
glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES
vr0 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 10,
address 00:0d:b9:1b:b6:4c
ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
0x004063, model 0x0034
vr1 at pci0 dev 10 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 11,
address 00:0d:b9:1b:b6:4d
ukphy1 at vr1 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
0x004063, model 0x0034
vr2 at pci0 dev 11 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 15,
address 00:0d:b9:1b:b6:4e
ukphy2 at vr2 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
0x004063, model 0x0034
glxpcib0 at pci0 dev 15 function 0 "AMD CS5536 ISA" rev 0x03: rev 3, 32-bit
3579545Hz timer, watchdog, gpio
gpio0 at glxpcib0: 32 pins
pciide0 at pci0 dev 15 function 2 "AMD CS5536 IDE" rev 0x01: DMA, channel 0
wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 0: <SanDisk SDCFH-008G>
wd0: 1-sector PIO, LBA, 7641MB, 15649200 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 4
pciide0: channel 1 ignored (disabled)
ohci0 at pci0 dev 15 function 4 "AMD CS5536 USB" rev 0x02: irq 12, version
1.0, legacy support
ehci0 at pci0 dev 15 function 5 "AMD CS5536 USB" rev 0x02: irq 12
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "AMD EHCI root hub" rev 2.00/1.00 addr 1
isa0 at glxpcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
pcppi0 at isa0 port 0x61
midi0 at pcppi0: <PC speaker>
spkr0 at pcppi0
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
usb1 at ohci0: USB revision 1.0
uhub1 at usb1 "AMD OHCI root hub" rev 1.00/1.00 addr 1
biomask 73e7 netmask ffe7 ttymask ffff
mtrr: K6-family MTRR support (2 registers)
nvram: invalid checksum
umass0 at uhub0 port 1 configuration 1 interface 0 "Western Digital External
HDD" rev 2.00/1.75 addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, initiator 0
sd0 at scsibus0 targ 1 lun 0: <WD, 2500BMV External, 1.75> SCSI2 0/direct
fixed
sd0: 238475MB, 512 bytes/sec, 488397168 sec total
vscsi0 at root
scsibus1 at vscsi0: 256 targets
softraid0 at root
root on wd0a swap on wd0b dump on wd0b
clock: unknown CMOS layout

Cheers,
Jeff

[1] http://store.netgate.com/ALIX2D3-2D13-Kit-Blue-Unassembled-P173C86.aspx

Reply | Threaded
Open this post in threaded view
|

Re: Router components

russell-38
In reply to this post by Stuart Henderson
Stuart Henderson wrote:

> On 2010-10-04, David Higgs <[hidden email]> wrote:
>> I am building a replacement router/firewall for home use and am
>> soliciting suggestions/commentary/alternatives on the components
>> below.
>
> What sort of internet connection and what will be running over it?
> Will you be doing crypto on the firewall (ipsec/some other vpn)?
>
>> I was planning to use an SSD in the 32 GB size range, but the archives
>> indicate we don't have TRIM support yet.  Though this obviously isn't
>> a showstopper to usage, am I better off getting an older-generation
>> SSD that doesn't require TRIM, or perhaps hold off on SSDs until the
>> tech is more mature?
>
> Newer SSDs don't *require* TRIM, it is optional. I think it's probably
> a better idea to get the newer generation. Though a 2-4GB CF might be
> quite good enough too.
>
> For what a lot of people need for a router/firewall a 2-4GB CF
> card in an IDE adapter would be fine too (smaller works too if you can
> still find them, but it's easier to have this much space).
>
>> Finally, I want this box to act as wireless AP, and hope to have
>> out-of-the-box 802.11n support (when eventually available).  I've read
>> that run(4) is a solid chipset in this regard; any other suggestions?
>
> run(4) does not support host AP.
>
> athn(4) is likely the best choice, I haven't used it with OpenBSD but it
> looks like this is the most actively developed wireless driver at the moment.
> I have used it with commercial APs running their embedded linux-based OS
> and the hardware itself works very well indeed.
>
> As I think you're aware we don't support 802.11n capabilities yet, also
> note we don't support clients that use power-saving mode (this is an
> absolute show-stopper for some users; some client hardware has no way
> to disable this).
>
I tend to swear by ral(4)
Mainly due to the unscientific but proven mechanisim
all my ral cards have worked, and all my ath cards end up having a
unsupported chipset.
and there was something freaky about that zyd,
almost working is worse than not working at all.

Given half a chance stay away from usb radios.

but ral has always been there for me.
best of luck.
I know I enjoy my k6-2(450) based firewall/nat device infinitely more
than the netgear piece of crap it replaced.

Reply | Threaded
Open this post in threaded view
|

Re: Router components

David Higgs
On Mon, Oct 4, 2010 at 3:51 PM, russell <[hidden email]> wrote:

> Stuart Henderson wrote:
>>
>> On 2010-10-04, David Higgs <[hidden email]> wrote:
>>>
>>> I am building a replacement router/firewall for home use and am
>>> soliciting suggestions/commentary/alternatives on the components
>>> below.
>>
>> What sort of internet connection and what will be running over it?
>> Will you be doing crypto on the firewall (ipsec/some other vpn)?

Just your basic consumer-class cable connection, and practically
nothing.  Crypto acceleration might be nice, but in no way a
requirement.

>>> I was planning to use an SSD in the 32 GB size range, but the archives
>>> indicate we don't have TRIM support yet.  Though this obviously isn't
>>> a showstopper to usage, am I better off getting an older-generation
>>> SSD that doesn't require TRIM, or perhaps hold off on SSDs until the
>>> tech is more mature?
>>
>> Newer SSDs don't *require* TRIM, it is optional. I think it's probably
>> a better idea to get the newer generation. Though a 2-4GB CF might be
>> quite good enough too.
>>
>> For what a lot of people need for a router/firewall a 2-4GB CF
>> card in an IDE adapter would be fine too (smaller works too if you can
>> still find them, but it's easier to have this much space).

I know SSDs don't require TRIM, but most benchmarks are made by
knob-twiddlers that are presumably overemphasizing the performance
degradation you get without it.  Is this even noticeable in practice?
Good suggestion on the CF card, though I would feel dirty using it in
that overpowered Atom system...

>>> Finally, I want this box to act as wireless AP, and hope to have
>>> out-of-the-box 802.11n support (when eventually available).  I've read
>>> that run(4) is a solid chipset in this regard; any other suggestions?
>>
>> run(4) does not support host AP.
>>
>> athn(4) is likely the best choice, I haven't used it with OpenBSD but it
>> looks like this is the most actively developed wireless driver at the
>> moment.
>> I have used it with commercial APs running their embedded linux-based OS
>> and the hardware itself works very well indeed.
>>
>> As I think you're aware we don't support 802.11n capabilities yet, also
>> note we don't support clients that use power-saving mode (this is an
>> absolute show-stopper for some users; some client hardware has no way
>> to disable this).
>>
> I tend to swear by ral(4)
> Mainly due to the unscientific but proven mechanisim
> all my ral cards have worked, and all my ath cards end up having a
> unsupported chipset.
> and there was something freaky about that zyd,
> almost working is worse than not working at all.
>
> Given half a chance stay away from usb radios.
>
> but ral has always been there for me.
> best of luck.
> I know I enjoy my k6-2(450) based firewall/nat device infinitely more than
> the netgear piece of crap it replaced.

Crap, missed lack of AP support in run(4).  Disappointing that USB
radios aren't all that great.  I've been pretty happy with my ral(4)
card as well, even in the face of occasional interface hangs.

Thanks.

--david

Reply | Threaded
Open this post in threaded view
|

Re: Router components

Brad Tilley-4
David Higgs wrote:

<big snips>

> I know SSDs don't require TRIM, but most benchmarks are made by
> knob-twiddlers that are presumably overemphasizing the performance
> degradation you get without it.  Is this even noticeable in practice?

I've used an inexpensive SSD (cheapest one I could find at the time) in
an Intel Celeron based OpenBSD home firewall for more than a year. It
works fine. Here is part of an old dmesg:

wd0 at pciide1 channel 0 drive 0: <Kingston SSDNow V Series 64GB>
wd0: 1-sector PIO, LBA, 61057MB, 125045424 sectors
wd0(pciide1:0:0): using PIO mode 4, Ultra-DMA mode 6

No noise, cool, low power. Try it for a year, then post back your
experience.

Brad

Reply | Threaded
Open this post in threaded view
|

Re: Router components

Chris Eidem
In reply to this post by Sean Kamath
Hear, hear.  I just built out one of these for my home firewall and the
installation is bog simple.

-----Original Message-----
From: [hidden email] [mailto:[hidden email]] On Behalf
Of Sean Kamath
Sent: Monday, October 04, 2010 1:28 AM
To: David Higgs
Cc: [hidden email]
Subject: Re: Router components

On Oct 3, 2010, at 11:15 PM, David Higgs wrote:
>> NONE OF IT WILL MATTER TO YOU.
> ....
> I'll google up some smaller systems (Soekris, ALIX, etc?)
> and see how they strike me.  Pointers here are even more welcome, as I
> am not as familiar with this end of the spectrum and want to avoid the
> aforementioned "crappy super-low-power systems."
>
> Thanks for the input.

I just bought a Alix 2d13 board.  Then ended up buying about 7 of them
for
work for OOB back-channel machines.

Insanely straightforward, and they Just Work(tm).

Sean