OPNsense performance on APU2c4

[ifzenc]

Hello,

I'm currently looking for a new home firewall and I found the APU2c4 board from pcengines (quad-core 1ghz and 4 GB RAM) with 16GB mSATA SSD and probably a wireless card in addition.

I would like to use features like IPS, VPN, proxy, and eventually Netflow and Antivirus. Do you think this is powerful enough for all these features?

If you have any advice and experience on this, it will be greatly appreciated.

Thank you very much for your help,
Best regards

[mow4cash]

Did you end up getting one? I'm looking into purchasing the same device.

[schnauz]

Hi @ifzenc @mow4cash
I use an APU2C4. The Swiss designed device is ideal for small environments like home network or even a small SME if you want to use the more than the standard nat filtering feature set of OPNsense. The bandwidth performance with 16.7 is quite good (I made 500/50 Mbits/sec, the intel ethernet helps here) if you are using it as a classic firewall without IPS, with IPS my APU slowed the traffic down to 70-80 MBit/s (tested with the FAST test). But the speed gain is clear, because each packet will be analyzed, inspected and so on. OpenVPN works well with a handful of users (more I do not have, sry). I did not yet used the APU as proxy and antivirus nor WLAN (check this forum for hints), from the devices (CPU/RAM/bus) perspective that all should be possible;-). With the upcoming ONPsense 17.1 the APUs ethernet chipset will be directly supported by the igb driver. I look forward to 17.1.
-oliver

[tux.JCC]

@schnauz

We're using here with Proxy and Webfilter/IPS/VPN and everything works like a charm!

We have been using PcEngines about a 10 yeas and the cost/benefit is great!

[kapara]

Before looking at that check out this one.  I am going to buy one for testing.  Fanless and it has a higher heat tolerance.  Also phone support and great warranty.

Operating Temperature:
   -20°C to 60°C (-4°F to 140°F)

Quad Core Atom
Serial
VGA
USB
up to 8GB ram

Just needs m.2 SSD and ram

[Rainmaker]

Hi @ifzenc @mow4cash
I use an APU2C4. The Swiss designed device is ideal for small environments like home network or even a small SME if you want to use the more than the standard nat filtering feature set of OPNsense. The bandwidth performance with 16.7 is quite good (I made 500/50 Mbits/sec, the intel ethernet helps here) if you are using it as a classic firewall without IPS, with IPS my APU slowed the traffic down to 70-80 MBit/s (tested with the FAST test). But the speed gain is clear, because each packet will be analyzed, inspected and so on. OpenVPN works well with a handful of users (more I do not have, sry). I did not yet used the APU as proxy and antivirus nor WLAN (check this forum for hints), from the devices (CPU/RAM/bus) perspective that all should be possible;-). With the upcoming ONPsense 17.1 the APUs ethernet chipset will be directly supported by the igb driver. I look forward to 17.1.
-oliver

Sorry to bump this thread, but I've just joined the forum and I also have an APU2C4. I'm surprised the performance drops so much when running IPS! I know pfSense is also heavy with (e.g.) Snort, but I didn't think it would be so bad. Running IPS/snort and guardian on IPFire (Linux based firewall/router distro) barely registers a few percent CPU and doesn't affect speeds when running on the same device. So, as good as *BSD is if someone wishes to run IPS on the APU2C4 with a high speed WAN connection I can only recommend IPFire. I got line speed (220/20) no issues when I ran it on mine. I don't bother with IPS these days as I don't really need it, so I'm happy back in BSD land now.

[xmichielx]

See in another thread my reply to the performance hit, newer Suricata 4.* shows better performance.
Knowing OPNsense and how they track packages, I guess Suricata 4.* will be part of one of the next releases.