login
Search
Hi all I would like to make a firewall / router running OpenBSD. I watch the ARM processors / Geode but they are less powerful and expensive for a complete solution. I also looked at the solution Soekris but is expensive compared to D510mo from Intel. In the doc OpenBSD i386: http://openbsd.org/fr/i386.html " PROCESSEURS Tous les processeurs compatibles avec l'architecture Intel 80386 (i386), C l'exception du 80386 lui-mC*me, sont supportC)s : * 80486 (DX/DX2/DX4) * Intel Pentium/Pentium-MMX * Intel Pentium Pro/II/III/Celeron/Xeon * Intel Pentium 4/D * Intel Pentium M * Intel Core * Intel Core 2 * Intel Atom "
On Thu, Jun 10, 2010 at 7:32 PM, Joachim Schipper I guess he is asking if all Atom processors are compatible with OpenBSD, which i guess is pretty much a given :) My question (sorry for hijacking this thread) is : is there any people on this list who switched from soekris (geode) to atom, and are they happy with speed and everything? Reason I mention that is i'd love to move my setup to atom/ssd eventually but haven't seen much on the list about it. Cheers, Steph
I have not switched from Soekris to Atom. But I have two firewalls that are on ASUS 1005HA netbooks with four interfaces on each (athn0, alc0, and two USB nics -- axe0 and axe1). OpenBSD as usual works great and so far I have not had any problems with the hardware. $ sysctl hw hw.machine=i386 hw.model=Intel(R) Atom(TM) CPU N280 @ 1.66GHz ("GenuineIntel" 686-class) hw.ncpu=2 hw.byteorder=1234 hw.pagesize=4096 hw.disknames=sd0 hw.diskcount=1 hw.sensors.acpitz0.temp0=59.00 degC (zone temperature) hw.sensors.acpibat0.volt0=10.80 VDC (voltage) hw.sensors.acpibat0.volt1=12.31 VDC (current voltage) hw.sensors.acpibat0.amphour0=5.80 Ah (last full capacity) hw.sensors.acpibat0.amphour1=0.51 Ah (warning capacity) hw.sensors.acpibat0.amphour2=0.26 Ah (low capacity) hw.sensors.acpibat0.amphour3=5.59 Ah (remaining capacity), OK hw.sensors.acpibat0.raw0=0 (battery idle), OK hw.sensors.acpibat0.raw1=0 (rate) hw.sensors.acpiac0.indicator0=On (power supply) hw.sensors.cpu0.temp0=41.00 degC hw.cpuspeed=1667 hw.setperf=100 hw.vendor=ASUSTeK Computer INC. hw.product=1005HA hw.version=x.x hw.physmem=1064529920 hw.usermem=1064452096 hw.ncpufound=2 -- Vijay Sankar, M.Eng., P.Eng. ForeTell Technologies Limited 59 Flamingo Avenue, Winnipeg, MB, Canada R3J 0X6 Phone: (204) 885-9535, E-Mail: vsankar@foretell.ca
yes, exactly !!! See my complete post before. On Thu, 10 Jun 2010 15:02:23 -0400, Brad Tilley <brad@16systems.com> -- @plus
http://marc.info/?l=openbsd-misc&m=127050936423288&w=2 And pretty easy remote install and management of the box too: http://marc.info/?l=openbsd-misc&m=127078571618143&w=2 Works well so far. Daniel
You can use an Atom, I'm using a 1.6GHz dual-core version on my home firewall. It is more than sufficient for small-medium traffic.
Well it depends what size of a box etc. you want, but for example I have a Jetway NC92-330-LF mini-itx motherboard with a daughterboard of 3 Intel gigabit NICs and everything works great with OpenBSD! :-) Teemu
I'm curious about the 'expensive' part of the OP. What price for good little firewall? And what level of performance are you looking for? I only need 5M/.7M for a small number of client machines and a couple of servers (web/dns/mail). I've been running my firewalls on old Sun IPX machines (upgraded to Cyclades motherboards, and Fujitsu TurboSparc 170) for so long that I recently thought I should move out of the 90s. So I bought a PC Engines Alix 2d13 (same as a 2d3 but with a real time clock). I spent a total of < $150US on it (including 2G CF card, case, power supply and motherboard). Showed up in like three days from Europe to CA, US. Installation was little more than hooking up to a box that could be a PXE server, and bam, Bob's your uncle, the OS installed in no time (first time with the new installer -- VERY SLICK). I haven't gotten the box installed as a firewall (planning on doing that tonight, maybe tomorrow), but the only thing I've had an issue with so far is the real time clock (I only got the 2d13 because the 2d3 was out of stock). The Jetway referenced above seems to be about the same price (maybe a little bit more expensive) than the Alix board. I didn't go with an Atom board because, well, PC Engines makes it clear they work with OpenBSD -- Money where my mouth is and all that. Not that I wouldn't have gone with the Jetway, I hadn't stumbled on it. Because the RTC isn't read correctly I had to switch ntpd to use -s to set the time. That's the only thing I've had to work around at all. And I really could care less about that. (and I've done NOTHING to try and fix it yet, since I only noticed it on the last reboot last night. dmesg follows. Sean PS I have to admit I'm befuddled why you'd want a frame buffer on a firewall -- it's a firewall, not a desktop. But whatever. Do what you want, buy what you want. Hell, I used old desktops for over 10 years (granted, without using the frame buffer)! I'm happy with how my stuff's working out. And ...
Tank you Sean, I'll try to respond to your message Indeed, a firewall is not a desktop. On the site openbsd.org is indicated support for OpenBSD i386 processors Atom platform. But it is not clear Atom1, Atom2, while the responses were made, are on Atom1. A firewall must be 100% supported by the platform. It's a box of confidence, the error is
http://www.openbsd.org/faq/faq12.html#i386cpu (yes, its a new article) you are asking the wrong question. The CPU is not going to cause any issue, it will be the rest of the machine you should be wondering about. If you want low power consumption and low cost, I'd suggest a small PIII or Celeron based system, hard to beat for the price (usually, free!). IF the new, cool stuff has any real power savings, you are unlikely to ever recoup the initial cost over recycled hardware. Add an IDE to CF adapter and a CF for a disk (more savings that will probably never be recovered), you can make it even quieter and save a few more watts. You should be able to get to around 35W or less at idle (which is what the machine will be most of the time). Nick.
that might be (I am not convinced tho) with the electricity price in the US, but certainly isn't universal. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
it is a very bad idea, PIII low performance, low puissance, high hot, high why pay 100dollars/month, 1200dollars/yaer for a server ???. 2 plateform Atom = 120 dollars, 1 firewall, 1 serveur web, 1 disc openbsd4.7 = 50 dollars :). Openbsd is very best performance, is best security. One problem: attack sript-kiddie, server datacenter or server home, the same thing. -- @plus
Heh PIII and low performance when comparing with Atom? Are you sure that you know design and construction of Atom? ;-) Same with low puissance, about hot and electricity...there is PIII mobile and then 100dollars/month or more is with some services around and you need to know what do you really want. For some people is enough their own small server at home, for some people it's not a way. You think that you will have same security if your server is at home or in some
mother card PIII, is compatible: usb2, usb3, e-sata, sata2, sata3, firewire800, raid0, raid1, raid6 . Atom, yes .... I do not work in Intel. I simply seek solutions recent, inexpensive, with good performance. the X7SPA-HF is very good solution, full functionnality, datacenter, offer hosting services, not security services.
See tables with consumption http://www.thinkwiki.org/wiki/Intel_Mobile_Pentium_III-M (especially Are you sure that you know function of data center? Or maybe it's not standard in France, but here you have : access restrictions to datacenter with pictures, personal data, cameras are everywhere with long enough backup of data, encoded racks so only you or persons you allowed have access to your servers, fire protection, power backups and protections against overloading and a lot of other services. Security is not just about brilliantly written system/apps by OpenBSD engineers. When someone get access to your OpenBSD machine (which is much more easy at your home) and do boot> boot -s , then where is you security? ;-)
yes, datacenter in french, camera, backup, protection fire. Datacenter in frech : inverter on fire, crash server datacenter attack, maintenance operation catastrophy, server on fire site web black-out. It's reality in french. There is no accident, datacenter america and canada?
Can't find any physical. Only those like this one http://tinyurl.com/hsbcbreach which is from employee of HSBC and those datacenters are managed by different people and companies. Which is in fact just confirmation that most of the problems come from inside of companies. Because it's much more easy to apply social engineering or simply pay some money to someone then try to break trough SW of physical security.
It depends on data which you provide and I don't think that Google people is server at home all they need and they are comfortable with it. For some people it's not an option. So choose whatever you like. Regarding performance of Atom see eg. this thread http://marc.info/?l=openbsd-misc&m=126203835608528&w=2
Yes exactly, plateform Atom is bad. Low-cost ~60-70dollars. Soekris and X7SPA-HF cost 250dollars.... . Budget student is impossible.
Are we comparing CPUs or living standard in different countries and professions? If we are talking about money then it's easy. Go for Atom or any other Intel/AMD cheap line of CPUs
Can you try learning english ? This is an english-only mailing list. You make us frogs really ashamed by you simili-engrish. Oh, and stop talking about things you don't know, especially here... Landry
A buildings a building and it depends on what measures are taken. At a data center who knows who should be where. At home you can remove secure from ttys asking for password on boot -s use solanoids which lock the metal case to the pc from bios setting and set the bios to prevent boot without pass or cdrom boot, lock doors, have alarms, know there shouldn't be ANYONE going in there. It could easily though unlikely be more secure aside from the cost of generators if your ups goes flat.
chamber closed, rack closed no boot : Cd-rom USB PXE ZIP Enabled anti-malware bios, not read /boot :)
On Sat, 12 Jun 2010 15:06:47 +0200 I'm not sure what you're saying, aside from cages are good? Data centres are often complicated and have many with keys or lockpics, kvms or people leaving fingerprints around etc and the machines have been rebooted a lot, without precautions. We've always said fingerprint readers were insecure but convenient, now most people are only just realising this. The number of times I see security firms make stupid mistakes is rediculous because security is often intangible unless something terribly blatant happens. If I thought physical security to my system at home was so important, I can guarantee that I could make it more secure than most data centre's and obviously ones that aren't in a military bunker and I would only need to trust myself. I also train most days which would add an extra layer, if I was in or near. Security is a process of choices, not a choice. At home you have more control over choices, but likely less resources. Of course that guy in Dubai has his own private spy satellite, his home could really be something, if he cared and knew the right people.
looking at my PIII-based (yes, kinda the last ones, onethousandtwohundredsomething mhz) storage machines and my atom systems, the "more powerful" is obvious bullshit. atom performs quite well. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
No. I seriously doubt that you will get usb3 or sata2 adapters (PCI?) for PIII systems. And even if you get them, they don't make sense. Even new Intel systems have problems with usb3 performance... And I'd love to see your face when your PIII system rebuilds your 10TB RAID6 array... :-) Best Martin
Sure thing!
On Wed, 16 Jun 2010 23:30:58 +0200 Maybe if you're using lots of usb3s and a 16x graphics card etc, you may run out of bandwidth, but I heard the real reason is intel have some intermediary chips halfway between usb2 and 3 that need to be sold.
PCI-E has independent bandwidth for each lane, so you can use a full blow 16x graphics and your 4x slot will not be affected. The only exception is those mobos that have a 2 16x slots that actually runs in 8x when both are in use.
On Thu, 17 Jun 2010 09:44:40 -0300 A 16x graphics card uses 16 lanes and a 4x pci uses four but eventually you MAY? saturate your superio chip. Intel may be switching to something more like amd or have heat issues on the superio but I doubt that. You would saturate it quicker on an atom however but then it supports less ports. PCI-E is certainly not the bottleneck. I would be far more likely to believe the want to sell intermediary chips.
No. Their chipsets give a 16 PCIe 2 lanes and 4 PICe 1.1 lanes, so you have a 16x2 PCIe slot for the gfx card and a 4x1.1 PCIe slot (or 4 1x1.1 PCIe slots). USB 3 is faster 1x1.1 PICe, so you need a 4xPICe USB3 card. Most USB3 cards are 1xPICe, though. If you need USB 3, get an AMD board. All PCIe lanes are 2.0 Best Martin
I was talking about intels ability to add usb3 and not addon cards, but I didn't realise the practical problems of using usb3 addon cards or devices developed with the already released usb3 development kit and chips on intel boards. I guess the addon card makers dropped a clanger and this will be rectified. Do you know if they just run at a lower speed on some boards?
Any real data for these claims? Nick has posted measurements on this The calculations pretty much added up for me with domestic electricity prices in Finland and no cooling costs (it's cold enough here anyway most of the time). Caveat: an inefficient PSU may be worth replacing with an efficient one. Maybe. This is assuming 5 years service life, which is not very hard to get with carefully chosen hardware from the dumpster, but seems to be too much to ask when buying new... Saving 10 watts will save you (0.01kW * 24h * 365) = 87.6kWh per year. Realistic savings might be around 20 watts, for a 35-40 watt P3 and 15-20W Atom. Calculate for yourself if it is worth it. Small-ish, dull looking HP, IBM, Dell and other "name-brand" office PCs tend to be rather low-power, and quiet too. It takes some time to learn to dumpster-dive the correct machines, after that you will be able to Since when have recycled machines cost 100 dollars a month?
The future is processor ARM, Openbsd suppoorted ARM is good way. This month, canoncial and linaro((ARM, IBM, Freescale, TI, Ericsson, Samsung et Canonical)announces a job to make it compatible with the ARM world of open location server datacenter 100dollars/month
Unix world was saying immediately after start of x86 what terrible crap it is, but it was cheap and it's cheap so mostly it's still only one option. But yes, ARM or MIPS are getting more and more presence which is really good. Regarding that new alliance..... there is and there was couple of them and most of them are just history. Maybe that
Vous dC)formez mes propos lC ou avez mal compris le sens de mon post. Arm Attention, Mysql est trC)s mauvais pour la santC) de l'administrateur.
On Sat, 12 Jun 2010 12:33:35 +0300 Hear, Hear, Applies to most non specialist electronics. We just pulled out an old microwave that my parents got in Canada over 20 years ago because our 3 year old one just packed in. This is a recurring theme. Old pcs without fans are great! and also improve the security of schg on intel ;-)
AGAIN, you are confusing "processors" for "systems". I can show you PIII systems which idle at less than 30W of power. Off-the-shelf, 100% conventional systems. I can also show you PIII systems that draw more than 300W, and I discarded one a while ago that probably could have maxed out at well over 500w. Hard numbers: Compaq Deskpro EN PIII 800MHz 128M RAM Onboard fxp PCI slot "router card" (rl chip attached to five port switch, exposes four ports to the back of machine. Nice for tiny offices) unplugged the CDROM (saves a half watt or so) CF flash card in adapter (most expensive parts!) TWO unused PCI slots dmesg below. 25w idle (power factor: 0.60, 42VA. Yes, that power factor (PF) sucks. For those without an EE background, VA is what your UPS/generator/power company must put out to power the device, Watts is what the power company bills you for (at least in the US, I believe in much of the rest of the world), Power Factor is the ratio between them. At least some areas are trying to force PFs towards unity, so that power generated and power billed for are closer to the same) In order to top that, you will need one very efficient power supply on the Atom machine. I have no doubt that the Atom chip and basic main board draws less than that, but getting the second NIC and switch AND power supply efficiencies to under 25W at the power cord will be The calculations are. Cost of money (i.e., interest rate), watts saved (if any), cost of a kWh, initial costs, etc. Plug in your numbers, find out what the ROI is. Add in what your AC costs are (watts in have to be removed, and that's more watts to pump them out). Evaluate results. Going simpler, ignoring cost of money, IF your Atom machine draws 50% of the power of my PIII, my quickie calc indicates you will save 105kWh. If you also have to pay for AC, maybe double that number. Granted, ROI (Return on Investment) isn't everything. There's also coolness, there's fun, etc. If you are trying to ...
I was shocked to find my nforce board draws around 130 watts, when it's switched OFF!!!!!!! and with the new graphics card can push upto 700 watts And No, I'm not kidding Needless to say, I now have a multitap with switch on my desk as the power button. p.s. People should be aware that, ARM and atom have met similar ground for speed but they are like risc chips and usually a 500mhz does half the work of a full/non emulated instruction set chip also at 500mhz. Check out atom on wikipedia for more info. Risc chips in phones etc. do even less work per cycle.
Hence the question of having a powerful processor? One Debian turns with a facility has gnC)nC)rique 800mhz, good work. Processor mult-core 3.00ghz not utility for firewall and desktop. On Sun, 13 Jun 2010 18:44:37 +0100, Kevin Chadwick <ma1l1ists@yahoo.co.uk> -- @plus
On Sun, 13 Jun 2010 12:20:52 -0700, Andreas Gerdd <kryptosnet@gmail.com> It is? I learn something new everyday. Mehma
On Sun, 13 Jun 2010 21:08:28 +0200 You make me extra thankful that my native langage is english. Watch some DVDs and switch the english subtitles on, though I'm not sure that will help with order and grammar. I'm not sure if I understand you but PF is so lean that if you got it running on a phone it would handle a rediculous amount of traffic. I believe the faq or somewhere says a p90 and 32mb of ram will handle most situations as a pure firewall. I Just mentioned it for comparison sakes and because it's annoying when people say they have a 10 year old pc in their hand, when it's not even close (bus, memory, bridges etc.).
Sorry, my english is very bad ... On Sun, 13 Jun 2010 21:47:08 +0100, Kevin Chadwick <ma1l1ists@yahoo.co.uk> -- @plus
should be less than 50% actually, at much better performance. the
i would not even remotely consider putting a PIII-era machine into
service now. the cost of the hardware (in the case of smallish
systems) is irrelevant in the big picture.
PIII: old, rusty, reliability questionable, draws more power, adding up
-> might have to invest in bigger A/C sooner
atom: new, reliability way less questionable, has modern interfaces,
saves power, is so cool that it'll survive forever even with all fans
dead, way faster.
heck, the supermicro atoms i buy aren't even cheap. not at all. but
with server-class management, very low power consumption etc, they pay
out quickly. they even would if they cost twice as much, easily.
pretty sure my average for new smallish (you know, 1U, reaosnable
amount of ram, 1 disk, that style) machines is below that. not idle,
err, besides a stupid useless wattmeter I have dozens, if not hundreds,
of points in my power distribution infratructure where power draw is
and still lose compared to a reasonable atom.
and for giggles, the dmesg. i forgot the exact power draw of that
system, it was very very low.
OpenBSD 4.7 (GENERIC.MP) #0: Mon Apr 5 08:50:54 CEST 2010
henning@terak.bsws.de:/usr/src/sys/arch/i386/compile/GENERIC.MP
cpu0: Intel(R) Atom(TM) CPU 330 @ 1.60GHz ("GenuineIntel" 686-class) 1.61 GHz
cpu0: FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,MWAIT,DS-CPL,TM2,CX16,xTPR
real mem = 2145595392 (2046MB)
avail mem = 2070142976 (1974MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 05/05/09, BIOS32 rev. 0 @ 0xf0010, SMBIOS rev. 2.5 @ 0xfd160 (27 entries)
bios0: vendor American Megatrends Inc. version "1.0" date 05/05/2009
bios0: Supermicro X7SLA
acpi0 at bios0: rev 2
acpi0: tables DSDT FACP APIC MCFG OEMB HPET
acpi0: wakeup devices P0P2(S4) P0P1(S4) PS2K(S4) PS2M(S4) EUSB(S4) MC97(S4) P0P4(S4) P0P5(S4) P0P6(S4) P0P7(S4) P0P8(S4) LAN0(S1) P0P9(S4) LAN1(S1) ...Just one comment on all this. It is very rare for me to have a difference of opinion with you Henning, but I have to comment on P3 equipment. Dell made some incredible Optiplex models that were white, using P3's from 450MHz to about 1.2Ghz. I have several at work in production service, and some of them are 10 years old. The disks aren't, but the machine proper is. They draw more power than an Atom, thats for certain, but they are rock solid, and built FAR better than most things today. Me, I'm the IT department where I work. The calculus of spending more on electricty for systems so stable that they are more likely to die when the power dies is pretty obvious to me. ;-) I've watched everything get bigger, faster and cheaper, but usually at the cost of quality. This includes my ThinkPads, sigh. I've had several conversations where it was admitted that fewer smoothig capicators were used because a bean-counter saw they could save money by using fewer. Boards aren't cleaned any more--I have some great fingerprint samples of several techs from China. For applications were speed really matters my little Dell's lose. But in many respects they are the best servers I've ever had. --STeve Andre'
heck, I have systems that old in production. the point is - new setups using these just doesn't make sense. heck, at the very same second where I had to change ANYTHING hardware-wise on them, they get replaced. if they don't get replaced as rock solid as they might be, at this age, the likeliness of them quality is an issue. i can only say that i am very happy with pretty much anything i ever got from supermicro. but then i don't buy the newest and shiniest, ever. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
On Wed, 23 Jun 2010 02:19:17 +0200 Hard drives and fans aside, there comes a point where a system has passed the test of time, and so a system that has run for 6 months can be trusted more than something new, but of course things do wear out. Soak or stress testing for 24 hours may find, some of these. The expensive precious metals are used less and less and so modern devices have a shorter life. I don't think a pIII would be old enough to include more expensive and a lot longer lasting parts, but a particular one may be better than others?, but an even older system maybe perfect for a trusty firewall, though not the absolute best in leckie usage. Market forces make getting higher quality parts more difficult and specialist, and so if you want them the price is going up and up, whilst the off the shelf price of alternatives drops and drops. If your redundancy is top notch, like I imagine hennings is, then upgrading regularly may be very reliable and give the best cost to performance savings, considering the price of electricity!!!!!!!
because you get what you pay for. maintaining a sane & secure & reliable data center isn't exactly cheap. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
Especially the price of electricity in externally owned datacentres (*) - and restrictions on current drawn; there are still places which allow just 4A (@240V) per rack footprint (and 8A/footprint is fairly common). (*) http://redinterbushouseexchangegatenorth.net/pricing.php ;)
I know of one DC that limits you to 8A per rack (@230V) because the floor would collapse if people filled up their racks... -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
I replaced a net4801 with an Acer Aspire One(n270 atom) works without issue for 7 months now. I usually run it at 800Mhz instead of 1.6 GHz to keep the fan from getting noisy. Nice little cheap box.
