Suggestions for low-power gigE firewall?

[Chris Nehren]

On Fri, Jun 13, 2014 at 21:06:01 -0700, Artem Belevich wrote:
> On Fri, Jun 13, 2014 at 5:17 AM, Chris Nehren
> <cnehren+freebsd-stable at pobox.com> wrote:
> > Speaking of Soekris elsethread, I'm presently interested in
> > picking up a small device to use as a router + firewall for my
> > home network.  I initially looked at what Soekris has to offer,
> > of course, but they only have 4xgigE products (the net650x line).
> > I don't need that many ports, but they don't offer anything that
> > has just 2xgigE.  I'd like something smaller than the net650x
> > line[0], preferably similarly low power.
> >
> > The box will run pf, some form of local name resolution for the
> > network, a RADIUS server for my wifi AP, and openvpn.  It'd be
> > helpful if the NICs and drivers support VLANs.
> >
> > Any suggestions?
> 
> ALIX apu1c may be an alternative:
> http://www.pcengines.ch/apu.htm
> 
> The board is a bit cheaper - $145/$160, according to
> http://www.pcengines.ch/order1.php?c=4
> The downside is that it's got Realtek RTL8111E NICs.

I was initially concerned that the RTL8111E was in the same
family as the dreaded 8139 (see the source for if_rl(4) for why I
had apprehensions).  However, I see that it's supported by the
separate if_re(4), which is more comforting.  While generally I'm
trying to stick to server / workstation hardware, I realize I may
need to compromise on that here to get what I want. 

The APU definitely seems like what I will want to pick up,
assuming I don't go with a used Juniper or something similar.
Thank you, Artem and Kurt, for the information.

> Or you can try Ubiquiti EdgeRouter Lite --
> http://www.ubnt.com/edgemax#edge-router-lite
> The downside is that it's not a Tier-1 platform (mips). The hardware
> under the hood is capable of a lot more than you could achieve on any
> other box at that price point. If you can live with stock software or
> willing to deal with rough edges of a new platform, this may work,
> too.

Hmm.  I know that, by definition, I'm getting myself into some
amount of work with setting up all the services I want.  I'm more
than a little wary, however, of having the network I need to pay
the bills (I work from home) depending on a tier 3 (unsupported)
architecture.  If it was tier 2 I might experiment with it, but
tier 3 is out of the question for my needs.  Thanks for the
pointer, though.

-- 
Chris Nehren
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 904 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20140614/0e54bcff/attachment.sig>