Contributed by jose on from the tiny-things dept.
What is everyone else using?"
(Comments are closed)
OpenBSD Journal
Contributed by jose on from the tiny-things dept.
What is everyone else using?"
(Comments are closed)
Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]
By Anonymous Coward () rb a.t. gincks d.0.t. net on mailto:rb a.t. gincks d.0.t. net
Comments
By grey () on http://www.soekris.com
By dan () on
By Greg Hennessy. () me@privacy.org on mailto:me@privacy.org
30 quid at the local fair got me a small box thats
Whisper quiet.
P2-350
128meg
6 gig drive.
Its currently running 3.4 using its onboard intel nic with a SUN QFE in pci slot 1.
CPU load as measured by symon since last may, has struggled to reach 10%.
greg
Comments
By colin () colin@NADASPAM.sspca.org on mailto:colin@NADASPAM.sspca.org
A little of topic but...
I have been using some Compaq Deskpro EN's SFF for snort IDS sensors but can't get the boxes to boot w/out having a keyboard attached
Any ideas?
-Colin
By emb3dd3d () on
By gollum () gollum@ccrypt.net on mailto:gollum@ccrypt.net
The net4501 is a great little 486 based box with 3 nics
ide flash support and optional hardware vpn cards...
It's about the size of an 8 port netgear switch... and has
support for OpenBSD, NetBSD, FreeBSD, Linux.. etc..
I have built quite a few OpenBSD based firewall and VPN solutions with these things, and I have yet to find anything
better for the price.
Check out opensoekris.sourceforge.net for current OpenBSD build scripts.
Comments
By nethead () nethead@yahoo.com on mailto:nethead@yahoo.com
Built several for friends using Cardflash as firewalls & they've worked out excellently over the past couple years - average uptimes of over 1 year per unit!
By Greg Anderson () on
http://www.pcengines.ch
http://m0n0.ch
http://www.soekris.com
http://www.routerboard.com
Comments
By bob () soekris_obsdj@2fm.de on mailto:soekris_obsdj@2fm.de
i use two NET4801.
best bob
By SolarfluX () on
By Anonymous Coward () on
pros: silent, almost instant boot up, cheap
cons: slow, no permanent storage, limited expandability / can't change its purpose
now i use a mini-itx:
pros: silent (get the fanless + a seagate barracuda iv or v), 1-2 pci expansion slots -- i use a dual port nic, but also just bought a quad port (matrox fnic can be had for <$50 on ebay), dual purpose potential (if you're crazy like me, doubles as a digital mp3 hookup to my stereo, large net storage device), cheap
cons: slightly more costly than the soekris, bigger footprint, but can be converted into many things $50>
Comments
By Anonymous Coward () on
And does each interface use the same MAC address or different ones? I'm curious on the uses/advantages of this.
TIA.
Comments
By Greg Hennessy () on
Of course you can do LB or FT using dot1q with them.
greg
By nethead () nethead@yahoo.com on mailto:nethead@yahoo.com
Depends on how you build & mount your file systems!
I built & use one (512 meg flash card) that has a full root file system that can change - /var has quite a bit of storage - as I store weeks of logs in it, All of which do get backed up and stored elsewhere - after several weeks.
Comments
By Anonymous Coward () on
compact flash often starts failing after some
number of writes (10 million?), and if you're
running some standard things (logs in particular)
you're hitting that write count more quickly than
you'd like, and will see failures in a quite 'human'
amount of time...
while you can offload your logs to a remote box,
it made more sense for me to just make the remote
box the firewall as well :)
By MotleyFool () mootley@dig.org on mailto:mootley@dig.org
I don't want to have to hookup a monitor to my firewall box.
Comments
By Anonymous Coward () on
you've got a floppy that boots to serial console
-- which may be easy -- i dunno), you can turn on
serial console after the initial install...
i've used serial console after the first install
for everything...
Comments
By MotleyFool () on
Comments
By Anonymous Coward () on
I've heard there are special add-on cards that provide this kind of functionality (they act like a simple videocard to the server, and are able to send text-mode stuff over the serial port). Anyone who has some experience with those?
Comments
By MotleyFool () on
$350 for the card, hmmm, how much does a mini-itx systemboard cost?
By SH () on
However, the VIA C3 CPU with the Nehemiah core (used in Eden-N) also has this. So does OpenBSD use hardware accelleration for this VIA C3 as well?
Confusingly, on the VIA C3 site they talk about a new generation of VIA C3 with a "New Nehemiah" core. Are there two types of Nehemiah cores around?
http://www.via.com.tw/en/viac3/c3.jsp
This appears to be a nice mini-ITX with dual LAN and one PCI available. If this can get hardware accelleration for 1GHz C3 Nehemiah core, I would seriusly consider buying it.
http://www.viavpsd.com/product/epia_cl_spec.jsp?motherboardId=181
Comments
By Anonymous Coward () on
M series = The first model aimed for multimedia. The M10000 (1Ghz) can handle all video without breaking a sweat.
CL series = M series with dual LAN connections. Its too bad the LANs they use suck. There is a third party who makes VIA style setups but using Intel LAN connections. Its also in a non-standard format. :(
MII series = Slight changes from the M series, some new connections.
TC series = includes a DC-DC thingy. (Power related feature).
Eden means the CPU onboard can operate in fanless or lower voltage than regular C3 and EPIA-based CPUs.
Eden-N is a shrunk down version of CPU. Its about the size of a "quarter" compared to current EPIA-based CPUs. (maybe smaller...In any case, its insanely small.)
A new format, even smaller than Mini-ITX will be released. Its called Nano-ITX. It will be fitted with the tiny Eden-N CPU running at 1Ghz.
Later this year, VIA will release 2Ghz models, since they selected IBM to make the next generation of low power CPUs using 90nm SOI technology. (faster, and cooler).
The upcoming one is called C5P (current Nehemiah-core is C5XL)...
The next one (manufactured by IBM) is called Esther and is officially known as C5I. It will support more features in relation to its RNG and will have SSE2 and 200Mhz FSB, Pentium-M style FSB. (The current are using the PIII bus running at 100 and 133Mhz FSB).
VIA also created a prototype DUAL CPU C3 on a Mini-ITX mobo...I'm waiting for this to be a retail product. :D
Comments
By Alejandro Belluscio () baldusi@hotmail.com on mailto:baldusi@hotmail.com
By Anonymous Coward () on
? M series certainly supports the dual riser.
"M series = The first model aimed for multimedia. The M10000 (1Ghz) can handle all video without breaking a sweat."
Wrong. Hardly the first multimedia centric model. V series was aimed at multimedia, with the infrared for remote header, video acceleration in the PLE133 chipset. It also had a header for an mpeg4 accelerator, which Sigma Designs never seemed to have released, or was only available to their OEM partners. Via just didn't know necessarily who was going to use the boards, but that was their first release. When they realzed who was buying the mini-itxs, they smartly shifted focus to the market.
Also, there were 2 M1000s. Yes, same model number. mini-itx.com covered this issue. The later of the two is the one you want, but you usually have to ask the supplier which they have (I forget how to distinguish this, but some suppliers advertised they were selling the refined core on pricewatch at the time).
"MII series = Slight changes from the M series, some new connections."
...being CF and cardbus support onboard. Also, not yet released into general distribution. Unknown whether third-party near integrated power supplies can handle the new board layout.
By hopfgartner () on
By Anonymous Coward () on
http://www.lex.com.tw
By dominique () dom@blueyonder.co.uk on mailto:dom@blueyonder.co.uk
they have version with 3 NICs onboard. They make very good firewalls and although I have only used these with Linux so far, it seem compatible with OpenBSD.
http://www.linitx.com/ sell full barebone system based on these boards.
Dom.
By Wim () Wim@kd85.com on http://soekris.kd85.com
Tech Drawing
Images of 4501 and 4801
Cheap: prices range from EUR 195 to EUR 270 You can buy them from the US or from Belgium, local shipping.
Efficient: kind of how you want to calculate this? Weight of machine per bandwidth? Price of a 4801 versus the time it takes to install it? ;-)
Seriously, as you are talking about a 486/133MHz or a Geode/266MHz, you cannot expect unlimited resources. Interupts will kill you if you hit it with plenty of small fragmented packets (good way to make any system crawl, the Soekris just has shorter legs).
Don't look at it as Slow -- it's fast enough for most uses, how many of you have more than a 5 Mbit connection at home or office?
Storage: the 4801 can be equiped with a 2.5>
Crypto cards can also speed up VPN connections
wireless extentions via either miniPCI, full PCI or PCMCIA cards.
But then again, I'm a bit biased ;-)
Comments
By Anonymous Coward () on
- How do you boot it? Is the only way to preload a flash card on another computer, or can you netboot it?
- What (usb) cardreaders do you suggest for preloading Flash cards?
- How well does an internal 2.5" harddisk work? Can the device do things like spin the disk down when not in use? (so that I can have a quiet backup server that only makes noise when in use)
- Any problems with Flash durability? Let's say I'd want to keep some information between reboots, power failures,... Any problems if I overwrite the same file eg. daily? What happens if a Flash card fails on you btw? a kernel panic? Should I take special care (ie. rather add a file to a partition than overwrite the old one every time), or isn't that necessary?
- Is there a dmesg of OpenBSD booting on one of these devices online somewhere?
- What kind of NIC's are in there? Are they decent, like fxp's, or more crappy, like rl's?
Thanks!
Comments
By Wim () wim@kd85.com on http://soekris.kd85.com
Any USB reader/writer that works. My favourite one is the Belkin CF/CF2 (EUR 20) but it seems that one is end of life... I would really like to buy some more but can't get them. There are also very cheap PCMCIA based ones available (EUR 10) but they attach differently: the USB one is an sd device while the PCMCIA one is a wd device. I have had less problems with multiple inserts and ejects with the USB one.
The 2.5" disk works fine, like any other IDE disk. it's a bit slower, you can get 4200 RPM, 5400 and 7200 RPM disks, don't get the expensive 7200 RPM ones as they get too hot in the case. Spin down is something your host OS should take care of. The new 2.5" drives are surprisingly quiet.
Flash has a limited lifetime for writes, reads are not such an issue. (specs say you can do 1 million writes, after that you probably get read/write errors). So everybody keeps their CF in read-only and uses a small mfs to store tmp files & log files. If you want to update a certain file every day, consider putting it on a ramdisk, instead of re-mounting the CF rw, changing file and remounting ro.
the system boots like any ordenary PC: 4501 boot log
4521 boot log
4801 boot log
The onboard NIC is based on the National Semiconductor DP83815 (MacPhyter) PCI Ethernet controller and shows up as an sis device. While it's a fairly cheap design, it's not as crappy as the rl or ne2k. There are some issues with short cables and wrong speed selection but I have not had that much complaints about it.
If you want to see more pictures, have a look at http://soekris.kd85.com/images/ or for more info, browse http://soekris.com
Comments
By AC () on
Comments
By Anonymous Coward () on
By Wim Vandeputte () wim@kd85.com on http://soekris.kd85.com
The issue has been fixed in the mean time
By Anonymous Coward () on
Comments
By Anonymous Coward () on
Comments
By Anonymous Coward () on
FreeBSD 5.1 posted today on soekris-tech by Reto Burkhalter,
With h/w accelerator and crypto framework:
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
des-ede3-cbc 868.51k 3767.01k 14664.85k 47937.66k 1030052.66k
Without h/w accelerator and crypto support:
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
des-ede3-cbc 432.37k 448.18k 454.90k 458.31k 452.44k
By sthen () on
Flash durability - the flash card load-balances writes, so you can happily write to the same block again and again. They are just IDE-attached. When CF is written to very many times, it apparently just becomes read-only.
Loading the flash - most USB readers seem to work without too much trouble - since they're usually fairly unbranded, your best bet is probably to buy one locally that can be exchanged if there's any trouble. I've found myself flashing mostly from a win2k box with the physdiskwrite tool linked from the m0n0wall website out of ease of accessibility, but dd works fine. CF-IDE adapters are available too but not hotswap, so more of a pain.
NICs - fairly reasonable - not world's best, but no big problem. Until a recent fix in -current on a 4801 all NICs need to be ifconfig'd up, otherwise there's poor performance (driver bug). Very old drivers had problems with short cables on some cards, which was then fixed (but causing some problems with very long cables), but a better fix is now in -current. These all apply easily to -stable too.
4801 dmesg, http://tinyurl.com/38y8s. You'll probably want some patches from -current (machdep.c to disable the TSC which doesn't work correctly, and the if_sis.c I already mentioned). FreeBSD -current has slightly better support for the hardware at present. In general there's better support already available for 45x1 hardware than 4801 (error leds, watchdog timer, gpio, hi-res counter). But 4801 is getting there (e.g. volt/temp sensors are now accessible from all BSDs).
If you want a fileserver too, something that can take 3.5" HDs might be a better idea (Seagate have quiet, fast, large drives in the shape of Barracudas, and I have the impression they're a little more robust than laptop drives).
If you want some (small-ish number of Gb) HD storage, 4801 seems a good idea, maybe keep an eye on discussions on soekris-tech for a little while if you want to boot from flash (CF slave, HD master seems fine though).
I have a 4501 firewall handling altq+pf on a reasonably busy ADSL line which hasn't gone above about 7% cpu (3.4+flashdist+nsh+symon pointing at symux on a fileserver, and that 7% cpu was probably from running scp), which I'm very happy with, and a couple of 4801s which I haven't decided on homes for yet (one is intended as a replacement home mail server, but at the moment I'm veering towards FreeBSD on that box).
I've worked with EPIA boards too, the Soekris are a rather different class of kit. EPIA are a small 'normal PC', Soekris are inexpensive (but not in any way "cheap"-feeling) embedded systems. EPIA are probably a little easier to get to grips with (hmm, though it doesn't always feel like it after wrangling with vr drivers trying to increase the network stability under load), Soekris might require a little more effort but I found to be more rewarding to work with.
Of course there is also the Pegasos ... mini-itx form factor, non-i386, but still there are vr chips...
By Mestizo () security@mestizo.net on mailto:security@mestizo.net
Comments
By Kurt Mosiejczuk () on
And the other thing to watch out for is that most sun4c machines now have weak or dead NVRAM batteries. I love the sun4c machines (especially the lunchbox IPC/IPX) but all my NVRAMs have died.
Comments
By Anonymous Coward () on
Comments
By Anonymous Coward () on
By Chema () on
Even the product Pegasos Guardian as seen here a few days ago.
Apparently it does not consume a significant amount of energy nor it is noisy.
But I guess is more expensive and maybe more than you need for just a firewall.
By trygve () on
http://www.thinkgeek.com/computing/accessories/5ad1/
Comments
By Alejandro Belluscio () baldusi@hotmail.com on mailto:baldusi@hotmail.com
By matthew () matt@ice-nine.org on mailto:matt@ice-nine.org
You can also squeeze a (minimal) regular OpenBSD release (base.tgz, etc.tgz, misc.tgz, bsd) onto a 128MB compact flash card.
Soren's NET4501 board has no moving parts at all, and draws ~8watts peak.
By Arnaud ZIEBA () azieba@mac.com on mailto:azieba@mac.com
By Anonymous Coward () on
Comments
By MotleyFool () on
By Anonymous Coward () on
By Anonymous Coward () on
Z.
Comments
By MotleyFool () on
Comments
By Anonymous Coward () on
By Haroon Laghari () haroonl@vonemm.com on http://www.snazio.com/Links/SIG.html
By Muce () on