A Clever And Fast Firewall/Gateway
The Market Ticker - Commentary on The Capital Markets
Login or register to improve your experience
Main Navigation
Sarah's Resources You Should See
Full-Text Search & Archives
Leverage, the book
Legal Disclaimer

The content on this site is provided without any warranty, express or implied. All opinions expressed on this site are those of the author and may contain errors or omissions. For investment, legal or other professional advice specific to your situation contact a licensed professional in your jurisdiction.

NO MATERIAL HERE CONSTITUTES "INVESTMENT ADVICE" NOR IS IT A RECOMMENDATION TO BUY OR SELL ANY FINANCIAL INSTRUMENT, INCLUDING BUT NOT LIMITED TO STOCKS, OPTIONS, BONDS OR FUTURES.

Actions you undertake as a consequence of any analysis, opinion or advertisement on this site are your sole responsibility; author(s) may have positions in securities or firms mentioned and have no duty to disclose same.

Market charts, when present, used with permission of TD Ameritrade/ThinkOrSwim Inc. Neither TD Ameritrade or ThinkOrSwim have reviewed, approved or disapproved any content herein.

The Market Ticker content may be sent unmodified to lawmakers via print or electronic means or excerpted online for non-commercial purposes provided full attribution is given and the original article source is linked to. Please contact Karl Denninger for reprint permission in other media, to republish full articles, or for any commercial use (which includes any site where advertising is displayed.)

Submissions or tips on matters of economic or political interest may be sent "over the transom" to The Editor at any time. To be considered for publication your submission must be complete (NOT a "pitch"; those get you blocked as a spammer), include full and correct contact information and be related to an economic or political matter of the day. All submissions become the property of The Market Ticker.

Considering sending spam? Read this first.

2017-06-15 15:48 by Karl Denninger
in Technology , 241 references Ignore this thread
A Clever And Fast Firewall/Gateway *
[Comments enabled]

finally got my hands on one of these things....

Which one?  The apu2c0, which is a 2-Gigabit Ethernet, quad-core AMD, 2Gb RAM single board computer that is fanless, runs on 12v and has AESNI instructions in it along with a very nice assortment of options for storage and similar.

Specifically, it contains two mPCIe slots and one mSATA slot internally, plus an SD card slot -- all inside.  It also has an RTC (battery backed) so it's basically a "tiny PC."

It quite nicely runs a bone-stock AMD64-bit FreeBSD distribution right out of the box, but since it will boot from the SD card you have even more options -- like running NanoBSD (normal operation in "read-only" mode) which makes it incredibly "hardened" in terms of risk of corruption from power interruption and similar events.

And oh by the way, the Gigabit interfaces are the modern ones -- they attach on the igb driver, not the older em.  This means they have hardware-assisted checksumming for both IPv4 and V6, TSO and jumbo frame support plus the now-obligatory VLAN capability.

In short this damn thing is fast.

Since it can handle AES-NI internally it also makes a very dandy IPSEC gateway, should you decide you want to use one built into it (e.g. VPN.)

It boots off the serial port which is its console, so you need a null modem cable to configure it, assuming you want to change the defaults.  But you don't need to -- as it comes you can stuff an SD card or mSATA bootable device in it and it will find it and boot from it right up front.

The Pi3 is not a bad little firewall for $35.  But frankly, if you have any sort of "fast" connection you will saturate it's ability to move packets.  It's just not that fast.

For about $100, however, this thing is a beast that punches well above its weight and since it's cooled by a heat spreader that transfers the CPU heat to the aluminum case it's also fanless and damn near indestructible.  When it comes to packet forwarding and firewalling it is a screaming buy for anyone who wants a high-performance, rugged gateway box that you can stuff in a closet somewhere and have it "just work."  Since it has front-facing USB ports you can even get cute and put private keys on a USB stick, insert during boot and then yank it with appropriate configuration -- which means if someone steals it they get nothing.  (Of course this means it also can't come back online to run IPSEC unattended; that may or may not matter to you.)

There's only one "gotcha" -- it comes from Switzerland and the postal service will screw around with the package since the seller sends it registered mail.  This means it may well take 2-3 weeks to get it once you order it, but trust me -- it's worth it.

I like this thing.

A lot.

I have a bootable image for it containing all the typical firewall requirements in "NanoBSD" mode (but not the StrongSwan IPSEC package although I could certainly add it) that will come up, get an address on the first interface, and can then be logged into and configured as you wish -- but it's (quite) large; if someone has a place I can dump it who doesn't care about the size of the transfers involved in distributing it, or if you wish to toss me an SD card of 8Gb capacity or more in the mail with a SASE for its return I'll happily copy it on the card for you.  The compressed image is ~650Mb and expands to 6Gb in size, which is appropriate to write onto an 8Gb or larger full-size SD card.