Favorite cheap multi-GBE SBCs for use as router/firewall appliances

[cdev]

A number of cheap SBCs that run limux have multiple gigabit lan ports. They all are very energy efficient, and have GPIOs and have basic connectivity options. But the rest vary a lot.

Do any stand out for good wired networking capabilities when used as a software router/switch?

I dont know much about how the various CPUs perform in that usage scenario.

Presumably they all have GPIOs and UART that can be used with a NMEA speaking device (GPS) and its one pulse per second source for accurate timekeeping?

I don't know much about the many new SBC HW platforms.

Presumably even OSs like FreeBSD might be fairly straightforward to compile on a new hardware platform.. If one had a complete Linux for it.

[brucehoult]

How many ethernet ports do you want?

If it's more than just a couple then it's hard to go past something designed specifically for the purpose, such as the $99 Mikrotik RB450Gx4 with quad core 716 MHz ARM cpu, 1 GB RAM, and 5 gigE ports. Industrial quality at close to hobbyist prices.

https://mikrotik.com/product/rb450gx4

[brucehoult]

Banana Pi BPI-R2 is also an option, but at only $10 less than the Mikrotik I'd go for the Mikrotik every time based on known quality and support.

https://www.amazon.com/Open-Source-Compatible-Raspberry-Quad-core-Cortex-A7/dp/B07JZ8LM6Q

[Nominal Animal]

For the MikroTik products, do take a look at the Results tab in the product page.  Typical real-world performance is somewhat less, but should give a rough idea of the capabilities.

I'm using an RBM33G as a 4G/LTE router/firewall myself.

[DiTBho]

The MediaTek's MTK MT7622 SoCs look interesting ...

[DiTBho]

FreeBSD

On Atom, Geode, and x86-compatible SoC.

[cdev]

I have a Geode based HP thin client. But I would need to use a USB NIC and it only has USB2, not USB3

What do you think about firewalling performance?

[cdev]

The Mikrotic is designed for hat kind of application but closed source and they hav had security issues in the past, but youre right, it does look like a hell of a value and four ports is pretty good, plus the list of features in the OS is quite respectable.

Thanks, this is a good suggestion. One thats pretty hard to beat, even now with all the new SBCs out there.

How many ethernet ports do you want?

If it's more than just a couple then it's hard to go past something designed specifically for the purpose, such as the $99 Mikrotik RB450Gx4 with quad core 716 MHz ARM cpu, 1 GB RAM, and 5 gigE ports. Industrial quality at close to hobbyist prices.

https://mikrotik.com/product/rb450gx4

[cdev]

Four ports would be ideal. Two gigabit ports would be adequate.

[cdev]

https://www.amazon.com/Open-Source-Compatible-Raspberry-Quad-core-Cortex-A7/dp/B07JZ8LM6Q
[/quote]

This board looks much more flexible but it is too expensive for me right now. .


Around a year ago I saw a two port Banana Pi that was super cheap, (under $30)

Now I cant find it.
 

Banana Pi BPI-R2 is also an option, but at only $10 less than the Mikrotik I'd go for the Mikrotik every time based on known quality and support.

If I could install some well respected firewall distro. that would be ideal. I would love to find a hardware platform that I could install any x86_64 image onto. A small energy efficient server

Actually, I just remembered I have seen a number of RPI ComputeModule4 expansion boards that have multiple -GBEs I forget their prices.

Buut I dont think super expensive. 

[2N3055]

Don't waste your time reinventing the wheel.
Just use Mikrotik.

As for "...and they hav had security issues in the past, ...." comment, by that token, nobody should use ANTHING made by Cisco EVER...

[David Hess]

I just bought a PC Engines APU2 with 4 x Intel i211AT Gigabit Ethernet ports for that application, and they have ECC RAM as well.

[Nominal Animal]

The Mikrotic is designed for hat kind of application but closed source

I run OpenWRT on my RBM33G.  RB450gx4 is fully supported by robimarko's OpenWRT branch.

The only closed source part running is the routerboot boot loader, which I personally accept gladly, because it makes these things unbrickable (at least via normal upgrade mechanisms), and is perfectly happy booting OpenWRT.  You could replace that with u-boot, but it just isn't worth it in my opinion.

[DiTBho]

I like OpenWRT, but I would recommend it only to developers and to people who both have skills and strong motivation.

[DiTBho]

I have a Geode based HP thin client. But I would need to use a USB NIC and it only has USB2, not USB3

You mentioned FreeBSD, my answer was only related to the best supported architecture

• FreeBSD on x86 is Tier class 1 -> Fully-Supported Architectures)
• FreeBSD on ARM is Tier class 2 -> Developmental and Niche Architectures

Tier class 2
Tier class 2 platforms are functional, but less mature FreeBSD platforms. They are not supported by the security officer, release engineering, and port management teams.

[PlainName]

I can highly recommend pfSense:

https://www.pfsense.org/products/

Originally ran it on a PC Engines Geode with tiny compact flash, but now it's running on some firewall box which is basically a PC in a firewall-looking case. I've run it in a VM (saves on hardware), installed to clients, paid a bounty to get a feature incorporated, etc. I looked at OpenWRT but that sucks dogs in comparison, IMO.

Netgate sponsors them now (they used to be entirely commercial-free), so the site wants you to buy Netgate stuff. Ignore all that, and the pfSense Plus (unless you need that kind of support, of course). However, that product page does have a handy table of CPU power appropriate to various sustained throughputs, which might be useful in your choice of hardware.

[cdev]

Yes, PFSense looks like a keeper. I realoly want to have fine grained control. I really need it actually, thanks..

[David Hess]

Originally ran it on a PC Engines Geode with tiny compact flash, but now it's running on some firewall box which is basically a PC in a firewall-looking case. I've run it in a VM (saves on hardware), installed to clients, paid a bounty to get a feature incorporated, etc. I looked at OpenWRT but that sucks dogs in comparison, IMO.

I am trying to go the other way.  I have been running M0n0wall and pfSense at various times on PC hardware for but picked up a PC Engines APU2 a couple months ago to use instead.

I have been experimenting with OPNsense because it supports more of what I want to do but problems may leave me switching back to pfSense.

[PlainName]

I have been experimenting with OPNsense because it supports more of what I want to do but problems may leave me switching back to pfSense.

What kind of problems?

I keep meaning to take a look at it (particularly since it seems many bad remarks were made by the pfSense people), but I rely on pfBlockerNG-devel quite heavily to protect my servers (email hack attempts are annoying, but also provide an unending list of IP ranges to blacklist).

[David Hess]

I have been experimenting with OPNsense because it supports more of what I want to do but problems may leave me switching back to pfSense.

What kind of problems?

I have not been able to get DNS working properly with any configuration of DNS.

[PlainName]

That's not a small problem!

[dredd]

I can highly recommend pfSense:

OPNsense is step ahead of pfSense, you'll be better off. MIT licenced too. www.opnsense.org

[PlainName]

It's the pfBlockerNG-devel plug-in that would give me pause for thought, possibly terminally. Pretty much essential for my setup.

[cdev]

OPNSense uses "unbound" as its DNS which is fairly well documented. But there are some gotchas.

If you could post any log messages. there is a small program to check your configuration's well formedness.

Also a program to fetch trust anchor file. There are a bunch of files actually to get the DNS server bootstrpped with the Internet's root DNS servers for the various TLDs and so on.

At the beginning it fetches and caches a lot of data.

I have been experimenting with OPNsense because it supports more of what I want to do but problems may leave me switching back to pfSense.

What kind of problems?

I have not been able to get DNS working properly with any configuration of DNS.

[cdev]

I have been experimenting with OPNsense because it supports more of what I want to do but problems may leave me switching back to pfSense.

What kind of problems?

I keep meaning to take a look at it (particularly since it seems many bad remarks were made by the pfSense people), but I rely on pfBlockerNG-devel quite heavily to protect my servers (email hack attempts are annoying, but also provide an unending list of IP ranges to blacklist).

similar to Suricata, Snort, etc, or something better?

[PlainName]

Maybe. It's hard to tell from the headline feature lists what they can do for me - at least there is a feature list instead of just a list of recent updates

As I said, I use the failed email login logs to block ranges of IP (which could range from single IP to entire country). Can those things do that for me?

[cdev]

Suricata certainly can. And its free, but some lists of rules may cost money.

[PlainName]

How would it know the mail server has bumped an incorrect login?

[ve7xen]

The vendor Qotom on Aliexpress builds a variety of fanless mini PCs with up to 8 Intel NICs and Atom to i7 CPUs that are a good fit for this use. Price point is higher than Mikrotik etc. but performance is too. I've been evaluating one of them for potential wide deployment at $DAYJOB and been pretty happy with it. It's the best value I've found for an x86 GigE-class network appliance. No other affiliation.

Lanner out of Taiwan is a somewhat more 'respected' vendor of similar appliances, at the corresponding higher price point and annoying distribution channel. These are nice too but expensive.

[cdev]

There are now several new options based on the raspberry pi 4 compute module. They are described as carrier boards and all I have seen have two ports, the CM costs around $25 and these carrier boards run as little as $30. So they make a functional small router/firewall box starting at around $55 that can handle gigabyte ethernet.

That's pretty cheap.

[cdev]

The vendor Qotom on Aliexpress builds a variety of fanless mini PCs with up to 8 Intel NICs and Atom to i7 CPUs that are a good fit for this use. Price point is higher than Mikrotik etc. but performance is too. I've been evaluating one of them for potential wide deployment at $DAYJOB and been pretty happy with it. It's the best value I've found for an x86 GigE-class network appliance. No other affiliation.

Lanner out of Taiwan is a somewhat more 'respected' vendor of similar appliances, at the corresponding higher price point and annoying distribution channel. These are nice too but expensive.

I've looked at them but they seem a bit more expensive than I'd hope them to be. Thin clients are a lot cheaper, it seems. Some are basically really cheap.

What do people think about using USB3 NICS with a USB3 -capable thin client and a USB3 hub  for a firewall?

[cdev]

What do the Mikrotics with their dedicated switch chips bring to the table thats superior to a plain PC with multiple NICS? Performance, but is the performance that much better? How does that wrk? I am looking for an explanation about how the hardware elements interact?

I think the setup I am envisioning would ideally need at least four ports plus WAN so five. This is to have physical separation between different kinds of devices (like VOIP phones, servers and PCs and wireless PCs) all with a firewall to rule them all...

How many ethernet ports do you want?

If it's more than just a couple then it's hard to go past something designed specifically for the purpose, such as the $99 Mikrotik RB450Gx4 with quad core 716 MHz ARM cpu, 1 GB RAM, and 5 gigE ports. Industrial quality at close to hobbyist prices.

https://mikrotik.com/product/rb450gx4

[cdev]

How would it know the mail server has bumped an incorrect login?

By parsing your mail server's log for strings indicating so?  And comparing that info to its own internal queue's records?

With the caveat that I literally have just recently started looking at them it appears they use dedicated filters to break packets into categories and then operate on the individual packets in queues.. before letting them go to their final destinations. Suricata uses a lanugage "Rust" which seems particularly well suited for doing this.

Similar to a firewall but with finer granularity and more verbosity in logging. The IDS systems (Surcata, Snort, and it seems many others most of which support rules written in one of the two firmats) download large text files that contain literally thousands of rules every hour or day or week or so and update their behaviors. They can go much further than the log-centric checking IP addresses and domain names resolve to something that makes sense for what they are doing or check them against a "bad people" list and then adding failed attempts to a list the firewall then blocks for a period of time. (thats what fail2ban does).Smaller switch/ruters even the fancy ones like the aforementioned ones seem to not be up for being used with or as an IDS. They just dont have the horsepower.

They may also (like fail2ban)  keep records of failed logins in a fast database and make it extremely difficult to sit at a server trying different logins or paswords.. All the time compiling statistics if anybody keeps trying and failing again and again. The more they try the more the ban thats used for them is lengthened or expanded to a larger scope.. say banning entire hosting companies  or IP address blocks if banning similar hosts makes sense. .. etc.

[ve7xen]

I've looked at them but they seem a bit more expensive than I'd hope them to be. Thin clients are a lot cheaper, it seems. Some are basically really cheap.

What do people think about using USB3 NICS with a USB3 -capable thin client and a USB3 hub  for a firewall?

In theory it will work, but it's pretty janky and may be unreliable. I have also found most USB3 NICs struggle to achieve close to 1G of throughput. If you don't need multi-Gbps of throughput, I would prefer to use one or two real 1G interfaces from the thin client/NUC/mini PC to a managed switch and make a 'router on a stick' using VLANs.

What do the Mikrotics with their dedicated switch chips bring to the table thats superior to a plain PC with multiple NICS? Performance, but is the performance that much better? How does that wrk? I am looking for an explanation about how the hardware elements interact?

The switch means that port-to-port traffic within the same VLAN doesn't need to hit the CPU for bridging, so depending on your use case may improve performance. But it sounds like in your case it won't help at all, any routing / NAT needs to be done on the CPU. It's basically a way to save BOM cost by avoiding needing dedicated NICs for every port (which also means you need a PCIe interface on the controller and a bus for the NICs). You can assign different VLANs to each port with a single (internal) GigE attached to the CPU and it appears to outside hosts that each port is independent. Very common for low-end network hardware to be designed this way. Basically what I suggest above, but integrated in the box.

[bingo600]

I'd go for the Mikrotik every time based on known quality and support.

Quality     ... "Cough..Cough"
https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/


Well to be fair i have used some OK products from them , but they seem to have quite some Oopzes in RouterOS

/Bingo

[cdev]

I have to say though, they pack a lot of value into those devices.

Whenever a manufacturer does that its impossible to avoid vulnerabilities, etc. unless they have an unlimited budget. (or somebody else does)

I'd go for the Mikrotik every time based on known quality and support.

Quality     ... "Cough..Cough"
https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/




Well to be fair i have used some OK products from them , but they seem to have quite some Oopzes in RouterOS

/Bingo

I think their user-interface could be improved a lot without too much pain.