# 2016: Going pfSense Buy Netgate or Build...



## Kursah (Feb 29, 2016)

Well to keep in-line with my company we are expanding to deploy more and more and more pfSense devices for many of our SOHO customers where a device beyond $100 is installed. For those budget installations we are sticking with Ubiquity ERL's and UniFi AP's.

But now that I want to dabble more in IDS/IPS, OpenVPN, and maintaining decent network traffic speeds over encrypted connections, I need more hardware than the ERL has to offer. And while I like UBNT, it's tough to deny that pfSense has more to offer with what I'm interested in, especially in a web-GUI interface where UBNT is always falling a little behind.

I have nothing against building my own, but for around the same price I can get a Rangely-SOC'd unit ready to go...

Netgate 2440 - $350 - http://store.netgate.com/ADI/RCC-VE-2440.aspx

But for that kind of money, it is tough for to justify not trying to build my own low-power consuming/still powerful solution. I've read for months about the Alibaba Chinese micro-PC's, I read the recent-ish ARS article about the same thing...the prices fluxuate, the shipping is expensive and reliability/pfSense support is a mixed bag. I've been scouring pfSense forums and Reddit, the Google and beyond... I've looked at Netgate, Shuttle, pfSense store, Supermicro, mATX/ITX builds...etc. I'd like to do a power sipping, mITX or smaller, but powerful enough to handle encrypted traffic at my WAN speed build...

Please let me know your thoughts or if I might as well just go with and save for the 2440...

I wish the C2xx8-series CPU's were more widespread across vendors...they appear to provide good processing power, AES-NI, and other powerful features, all while sipping power from the wall...small footprint too... I don't NEED more than 2 gigabit ports, 1 WAN, 1 LAN is fine for me. 

Thoughts?


----------



## silentbogo (Feb 29, 2016)

I am an ARM enthusiast, but I won't recommend any cheaper ARM board in substitute for Netgate 2440.
What you can try is this:
http://www.newegg.com/Product/Product.aspx?Item=N82E16813182851

Basically the same thing on steroids: octa-core Atom C2750, up to 64GB DDR3 SODIMM and tons of I/O. Everything combined in a single low-power package (~20W max. CPU, no more than 30W combined).

Just throw in a Pico PSU, some RAM, small HDD/SSD, and a slim ITX case, and you are good to go ().


----------



## Kursah (Feb 29, 2016)

Problem is that board cost more than the 2440. I looked at it though...and I know Supermicro stuff is nice but that's outta my budget. I'm hoping to wrangle something more in the $200-300 range.


----------



## silentbogo (Feb 29, 2016)

This one is a lot simpler and much cheaper. With RAM and laptop PSU it will be less than $200 total.
http://www.newegg.com/Product/Product.aspx?Item=N82E16813157614

Also there are consumer boards like this one:
http://www.newegg.com/Product/Product.aspx?Item=N82E16813157494

I recently had one just like that, but based on Pentium J2900 (bought used for $30-something) - bad ass performance, but only a single LAN port. Can be expanded with a dual-gigabit PCI-E adapter, if you are planning to use it as a gateway/router.

Gigabyte has very similar celeron J1900 version with dual-NIC

All of them are sub-10W systems.


----------



## Kursah (Feb 29, 2016)

I only need 1 WAN and 1 LAN at this point. I have a spare switch or two I can always deploy if I need more ports...right now on my ERL I'm only using 2/3 ports as it stands.  

How does the J1900 handle encrypted traffic? I'll be running OpenVPN for 1-3 users, though primarily 1 (me).

I know all the rage right now is with the Atom C2xx8 series chips...AES-NI and Quickassist stuff for encrypted traffic but damn are those SoC's in some spendy gear!


----------



## silentbogo (Feb 29, 2016)

should be fine. It is at least 2-3 times faster than CPU inside 2440.


----------



## taz420nj (Feb 29, 2016)

You could still get yourself a Firebox x550e, upgrade the RAM and CPU, throw in a Pico PSU, and still come out less than that using only about 35 watts..


----------



## Kursah (Feb 29, 2016)

I was actually considering that, a co-worker is really pushing me to go C2558 Supermicro or Firebox...

I've seen those Firebox's on sale all over the place...definitely would be a fun option! I might have to just to say I did! 

Edit: Except I want gigabit LAN... I forgot that Firebox is 10/00...


----------



## taz420nj (Mar 1, 2016)

Kursah said:


> Edit: Except I want gigabit LAN... I forgot that Firebox is 10/00...



The X-Core-e (X550e/750e/1250e) and X-Peak-e (X5500e/6500e/8500e) series all have either 4 or 8 gigabit ports (the X-Peak-e series also had gigabit fiber options).  The older (non-*e*) versions of that box had 10/100.


----------



## Kursah (Mar 3, 2016)

So I want something that can be repurposed in the future if need be so I've decided to go with consumer-grade components for an mITX build. I've decided to go with the Intel N3150 CPU for quad core and AES-NI, and straight up affordability. The issue is that it has an onboard Realtek NIC that doesn't play nice with pfSense (oh well). But I happen to have a spare PCI-e 4X dual-port Intel gigabit NIC that I can use for this task. This creates the next challenge...I want a small case...I found one with a riser which I might go with but wanted some feedback on small mITX cases that have a single expansion slot to see if any of you have any better suggestions than I've found.

Motherboard: Asus N3150I-C - $82 (has PCI-e 4X expansion slot)
RAM: Crucial 8GB (2x4) DDR3(L) 1600 - $33
Storage: 120GB Adata SSD - $39
NIC: Intel 2-port Gigabit PCIe 4X (full and half-height adapters)
PSU: Pending on case choice, I have a $45 90W Mini-ITX PicoPSU combo...or using integrated PSU (not keen on) with case purchase...

Case 1: In-Win BP655.FH200B - $50 - 12.2" x 3.9" x 10.4"
     > Comes with shitty 200W TFX PSU, will cost about $40 to replace with a decent Seasonic unit. A bit larger than I want.

Case 2: Antec ISK 300-150 - $71 - 12.9" x 3.8" x 8.7"
     > Comes with a Pico-style 150W PSU, not many complaints about it. A little larger than I want.

Case 3: iStarUSA S-21 - $50 - 8.9" x 3.5" x 8.3"
     > Slow shipping, no PSU, but best dimensions for build goals. Takes a FLEX PSU, which can be pricey for what they are...I'd likely cap off that spot and install the PICO combo. Will need to buy a separate PCI-e riser card/cable, not a big deal.

Case 4: Mini-box.com M300 - $60 - 7.87" x 3.07" x 9.44"
     > Seems like a viable option, but not sure on shipping price or length. Will need to buy a separate PCI-e riser card/cable. Will need a PSU as well...PICO combo.

If I didn't need an expansion card and want to keep a small footprint this wouldn't be a pain in the arse. As I said before, there's a chance this PC could be re-purposed in the future if I replace it with something more dedicated...or I might keep it for years. Either way, my goal is to run with the hardware listed above, and figure out what my case situation is. Please feel free to give me feedback and thanks in advance!


----------



## Kursah (Mar 4, 2016)

Well parts ordered...I ended up going with the 300W USB3 version of the In-Win case...
http://www.newegg.com/Product/Product.aspx?Item=N82E16811108428

Reason-being is it reviewed much better than the 200W version and bang-for-the-buck for the size I wanted wasn't beatable. Should the PSU die in the future, I can either buy a $40 Seasonic TFX or bypass that and order a PICO combo.

I also changed the Crucial to more standard CL9 DDR3 1600, it was the same price as the CL11's I linked above. Between Amazon Prime and Newegg Premier I did good with shipping aside from the In-Win, I could only get free 4-7 day. That's fine, I waited this long to buy parts...I can wait another week to get parts! 

Either way I'm stoked to see how this unit performs. I came in far under what the Netgate would have cost with a lesser CPU, sure it had the low power consumption and super small footprint going for it, but I just couldn't convince myself yet. If I'm not happy with this build...it'll be easily repurposed and I'll grab a Netgate. I'm not too worried.... I have an Intel Pro 1000 PCIe 4X Dual-port NIC at the ready when all parts arrive.


----------



## silentbogo (Mar 4, 2016)

Looks good.

I'm getting another refurbished J2900 this week (for myself this time).
Decided to buy this case:
http://www.chieftec.eu/en/chassis/itx-tower/ix-01b.html
Already has a built-in PicoPSU, also made by chieftec, which is very good.

Not sure if it is available in US, but here it is listed at ~$29.00-$30.00

Also there's a review in russian, but pictures always speak for themselves:
http://ru.gecid.com/cases/chieftec_ix-01b/?s=all

The only problem is that there is no expansion slots, but I'm not going to need any.


----------



## Kursah (Mar 5, 2016)

That is a nice case, didn't see any US stores carrying it unfortunately. But if it comes up around that price, I'll be grabbing one!


----------



## Kursah (Mar 15, 2016)

Got everything by Friday evening, and slapped it all together. Went great, I took the 5.25/3.5" tray out of the case, bolted the SSD to the front mesh intake. The case is a tad bigger than I'd hoped but still pretty damn small so I'm happy. The case fan is a noisy beast...I unplugged it and the only fan running in the system is the PSU fan which is fairly quiet except for the tick from running at a lower RPM. CPU temps are between 35-40C at any given time. Even that isn't noticeable more than a foot away. The PSU had plenty of connections as I expected...cable management was much easier once the 5.25/3.5 cage was removed as well. 

pfSense installed easily, the Realtek NIC wasn't even detected which was no big deal as I didn't plan on using it, the Intel Pro1000 dual port works absolutely amazing...I might buy more at $28 shipped/ea. just to have spares. I replaced the Realtek dual-port NIC in my server with one and resolved my RDP dropout issues. 

Port forwarding was relatively easy, as UBNT's ERL and pfS use similar thoughts on firewall, NAT and port forward rules. I have yet to install Squid, AV, or started my OpenVPN server...but all those are coming very soon. I am super happy with this Asus board and build overall, and am hoping it will be a good combo to last me years. Considering what I have invested, it came in at 2/3 the price of a Netgate with lesser specs. 

Been running for several days without a hitch, the DNS-O-Matic update worked perfectly (as it did on the ERL), my latency and network speed is excellent, the system is barely stressed right now with my smaller home network and my lab network not doing much atm. Planning on loading it up soon though and seeing what I can get out of this device.

Power consumption did go up by approx 10-12 Watts over the ERL, which is rated at 7W. So not too shabby!


----------

