6 ms·

> Hardware like that makes me yearn for one with no wireless and a pair of Gigabit Ethernet ports to use as a firewall and server. Unfortunately, general purpo

> Hardware like that makes me yearn for one with no wireless and a pair of Gigabit Ethernet ports to use as a firewall and server. Unfortunately, general purpose hardware and operating system needs a fair amount of juice to route and inspect 1gbps of traffic. Best performance per watt I've found is the Edgerouter Lite but that has dedicated routing acceleration hardware to achieve what it does with the little mips processor it has. Closest you'll find is Soekris, ALIX or APU for a routing platform. A Beaglebone black makes a nice little box for lightweight serving on its own.

jrockway 12y ago
There are ARM CPUs available that do network forwarding in hardware. Some even support iptables rules. I would be very surprised if a quad-core current-gen Atom could not do that in software, though. I could route 300Mbps through OpenBSD's pf on an AMD Geode.
- wtallis 12y ago
  There's a lot out there that can do NAT and some firewalling in software at large fractions of a gigabit/s for pretty cheap. But if you throw in QoS and queue management the CPU requirements get very high by the standards of MIPS and embedded x86. And unfortunately, none of the network acceleration hardware you'll find on any of those SoCs has anything like a hardware implementation of fq_codel or even RED. The CeroWRT project has been searching for more than a year for a new generation of hardware to use as the platform for their development of better router software. There's nothing affordable that can keep up with the really fast DOCSIS connections available while doing anything intelligent on a per-packet basis.
  - walterbell 12y ago
    How about running the packet filter in a dual-NIC VM on a VT-d capable PC? Dell T20 has Xeon E3 for $500 with 1TB disk and 4GB RAM. Add a PCI NIC for firewall purposes and still have the rest of the PC for use to run other VMs. GPU can be passed through to another VM.
    - wtallis 12y ago
      Yeah, using desktop-class hardware works almost effortlessly, but it's not really a good substitute for a $120 router that gets by with passive cooling. This discussion is about whole computers that could hide inside the power supply for that server and run off its standby power rail. If you're going to be running a server 24/7 anyways, it makes sense to equip it to also be your firewall and gateway. But that doesn't eliminate the huge gap between such a machine and off-the-shelf consumer networking equipment.
      - walterbell 12y ago
        It may become easier for consumers to buy a general-purpose PC once and change software as needed, rather than chasing the ever moving ceiling of low-end disposable hardware. I've lost track of the number of cheap special-purpose appliances I've bought, which turned out to have limitations not present in a general-purpose PC. Consumer routers and NAS devices are already in this category, soon to be joined by compute sticks. The problem is that buyers rarely know which part of the long tail they may need later. As Intel motherboards converge into a SoC and peripherals support USB3.1+, hopefully we end up with a future that looks like Google's Project Ara, i.e. small modules.
rab_oof 12y ago
L7 SPI is expensive whereas simple routing of 1 Gbps usually demands only a single core and 64-128 MiB of RAM. Large production shops have such FE load balancer / router boxes in HA mode (ie CARP) that barely break a sweat.
seanp2k2 12y ago
+1 for the ERLite; it's a MIPS62r2 Cavium Octeon with 512MB RAM[1]. With the latest firmware, it's running Debian Wheezy, and I've had no trouble with adding the normal Debian repos and adding things like Privoxy to it (though I suspect these would be overwritten in a FW update). With Privoxy loaded and being used as an HTTP proxy for my local net with the EasyList rules, it doesn't break about 5%CPU with 100mbit/sec of inbound traffic and some web browsing going through it (I'm running NAT as well). Being honest, it's a bit hacky for consumers...you'd be good to know Vyatta (what it uses under the hood) to get the most out of it, since there are still some things the web UI can't do (L2TP VPN being one, or PPTP without a Radius server for auth). However, it's a heck of a lot cheaper, smaller, and more power efficient than my previous P4 box running pfSense with Intel Pro/1000GTs, so I'm pretty happy with it. I do think it'd be super awesome if Ubiquiti released a pfSense or m0n0wall-based EdgeRouter with the same hardware acceleration...I'd gladly pay $200 or so for that, but the ERLite is damn hard to beat for $100. 1. http://wiki.gentoo.org/wiki/MIPS/ERLite-3 http://wiki.gentoo.org/wiki/MIPS/ERLite-3
- justincormack 12y ago
  I have a vague memory that FreeBSD does ship with the binary blobs for the acceleration, so pfsense might be doable. I did install FreeBSD on mine for a while, but you need some external setup to build packages as there isnt enough storage for the ports tree and no mips binary packages.
- donavanm 12y ago
  Check out the Intel Atom Avoton and Rangley SOCs. Nice x86 cores, ECC, crypto acceleration, VT-x, passive TDP, and 4x 1/2.5gbe or 1x 10gbe depending on the serdes. I only wish they had VT-d to get sr iov. If you really need more connectivity going the trident + Intel + cumulus white box switch rate has crazy throughput per watt. http://en.m.wikipedia.org/wiki/Silvermont http://en.m.wikipedia.org/wiki/Silvermont
  - newman314 12y ago
    Can you shed more light/context on "trident + intel + cumulus". I'm familiar with cumulus but not trident.
bduerst 12y ago
What about an Orange Pi? Comes with Gigabit and a dedicated ethernet chip.

jrockway 12y ago

There are ARM CPUs available that do network forwarding in hardware. Some even support iptables rules. I would be very surprised if a quad-core current-gen Atom could not do that in software, though. I could route 300Mbps through OpenBSD's pf on an AMD Geode.

wtallis 12y ago
There's a lot out there that can do NAT and some firewalling in software at large fractions of a gigabit/s for pretty cheap. But if you throw in QoS and queue management the CPU requirements get very high by the standards of MIPS and embedded x86. And unfortunately, none of the network acceleration hardware you'll find on any of those SoCs has anything like a hardware implementation of fq_codel or even RED. The CeroWRT project has been searching for more than a year for a new generation of hardware to use as the platform for their development of better router software. There's nothing affordable that can keep up with the really fast DOCSIS connections available while doing anything intelligent on a per-packet basis.
- walterbell 12y ago
  How about running the packet filter in a dual-NIC VM on a VT-d capable PC? Dell T20 has Xeon E3 for $500 with 1TB disk and 4GB RAM. Add a PCI NIC for firewall purposes and still have the rest of the PC for use to run other VMs. GPU can be passed through to another VM.
  - wtallis 12y ago
    Yeah, using desktop-class hardware works almost effortlessly, but it's not really a good substitute for a $120 router that gets by with passive cooling. This discussion is about whole computers that could hide inside the power supply for that server and run off its standby power rail. If you're going to be running a server 24/7 anyways, it makes sense to equip it to also be your firewall and gateway. But that doesn't eliminate the huge gap between such a machine and off-the-shelf consumer networking equipment.
    - walterbell 12y ago
      It may become easier for consumers to buy a general-purpose PC once and change software as needed, rather than chasing the ever moving ceiling of low-end disposable hardware. I've lost track of the number of cheap special-purpose appliances I've bought, which turned out to have limitations not present in a general-purpose PC. Consumer routers and NAS devices are already in this category, soon to be joined by compute sticks. The problem is that buyers rarely know which part of the long tail they may need later. As Intel motherboards converge into a SoC and peripherals support USB3.1+, hopefully we end up with a future that looks like Google's Project Ara, i.e. small modules.

rab_oof 12y ago

L7 SPI is expensive whereas simple routing of 1 Gbps usually demands only a single core and 64-128 MiB of RAM. Large production shops have such FE load balancer / router boxes in HA mode (ie CARP) that barely break a sweat.

seanp2k2 12y ago

+1 for the ERLite; it's a MIPS62r2 Cavium Octeon with 512MB RAM[1]. With the latest firmware, it's running Debian Wheezy, and I've had no trouble with adding the normal Debian repos and adding things like Privoxy to it (though I suspect these would be overwritten in a FW update). With Privoxy loaded and being used as an HTTP proxy for my local net with the EasyList rules, it doesn't break about 5%CPU with 100mbit/sec of inbound traffic and some web browsing going through it (I'm running NAT as well). Being honest, it's a bit hacky for consumers...you'd be good to know Vyatta (what it uses under the hood) to get the most out of it, since there are still some things the web UI can't do (L2TP VPN being one, or PPTP without a Radius server for auth). However, it's a heck of a lot cheaper, smaller, and more power efficient than my previous P4 box running pfSense with Intel Pro/1000GTs, so I'm pretty happy with it. I do think it'd be super awesome if Ubiquiti released a pfSense or m0n0wall-based EdgeRouter with the same hardware acceleration...I'd gladly pay $200 or so for that, but the ERLite is damn hard to beat for $100. 1. http://wiki.gentoo.org/wiki/MIPS/ERLite-3 http://wiki.gentoo.org/wiki/MIPS/ERLite-3

justincormack 12y ago
I have a vague memory that FreeBSD does ship with the binary blobs for the acceleration, so pfsense might be doable. I did install FreeBSD on mine for a while, but you need some external setup to build packages as there isnt enough storage for the ports tree and no mips binary packages.
donavanm 12y ago
Check out the Intel Atom Avoton and Rangley SOCs. Nice x86 cores, ECC, crypto acceleration, VT-x, passive TDP, and 4x 1/2.5gbe or 1x 10gbe depending on the serdes. I only wish they had VT-d to get sr iov. If you really need more connectivity going the trident + Intel + cumulus white box switch rate has crazy throughput per watt. http://en.m.wikipedia.org/wiki/Silvermont http://en.m.wikipedia.org/wiki/Silvermont
- newman314 12y ago
  Can you shed more light/context on "trident + intel + cumulus". I'm familiar with cumulus but not trident.

bduerst 12y ago

What about an Orange Pi? Comes with Gigabit and a dedicated ethernet chip.