Roll your own high performance corporate firewall/router
July 14th, 2008Jake Shimabukuro – Time after Time
So yesterday I was bored and contemplating some discussions we’ve been having around our team at work. After some complicated backhistory, our office had replaced its perfectly fine Linux based firewall with a string of Juniper Netscreens, which can be best described as prohibitively complicated and increasingly useless. We cannot do any decent logging, graphing or statistics. We cannot easily put in a VPN to a client. We cannot maintain reliability of our own VPN services. We are tied to a platform that simply isn’t working, is wasting a lot of time to maintain and simply providing no business value. And for what? The illusion that hey, we get support from Juniper, and we pay money so it must be better! etc
Now, geeks and tinkerers will all yell out loud about how you can just get commodity PC hardware from a pile of decommissioned junk and throw in some cheap $5 NICs and install TEH LUNIX! Linux will save the day, linux will feed your cat and pleasure your wife in ways the Kama Sutra could only dream about, blah blah blahnix, while I work in my basement getting a realtek driver ported to an older kernel so that I can get 0.0001% performance out of this 486! IN LUNIX!
And they’re right, you can recycle an old box with a couple of NICs and make yourself a very powerful router and firewall using something like Smoothwall, or, if you have a bit more grunt, Clarkconnect or Untangle.
But we’re talking corporate level stuff here. All the advantages of no vendor lock-in with all the performance of corporate level gear. And a Celeron with a few realtek cards from Dick Smith simply won’t cut it. Especially when you’re talking multiple gigabit ethernet connections which will completely flood an ancient PCI bus.
We specifically have a need for some 18 ports of routing, some of which can get by with plain old 10/100, but most if not all should be GbE if possible. So, you’re looking at a PCIe bus and maybe these, Intel Pro/1000 PT Quad PCIe cards. Also for the kind of theoretical maximum throughput, you’re looking at a CPU over 3GHz preferably.
Anyone got a 3GHz+ box with multiple PCIe slots just lying about? Didn’t think so.
So I was looking around for specific products that achieved this; looking specifically at SBC, PC/104, m-ITX etc with a scope for scalability, rack-mountability, and the ability to be used for other tasks such as graphing, logging, SNMP, DHCP, DNS caching and Transparent Squid proxying. I was disheartened to find no such devices at the easy end of a google search and contemplated rolling my own solution and on-selling it. There was plenty with lots of 10/100 ports, a few with GbE but only a PCI slot… none with quite the right combination.
Then I found this:
It’s almost perfect. Using a mix of PCI and PCIe, you could max that out with 10x GbE ports and 8x 10/100 ports. Throw in a mini-PCI VPN accelerator, a hard drive for logs and caching, then either hand craft OpenBSD or install pfsense. If you need more ports or redundancy, configure another one and link the two together using CARP.
I would also recommend maxing out the CPU at the fastest that the board can take, as well as maxing out the memory with a decent brand (crucial, mushkin). Sure, you could spec it lower and upgrade further down the track, but on the other hand will the components still be around when it comes time to upgrade? Max it out now and you should get a considerable life-time out of the device.
I’m still waiting on a local distributor to get back to me with a price, but it’s promising.
Article Tags>> firewall | openbsd | pfsense | router
