Advice on if OPNsense can do what I need (4G failover, VIA padlock)?

[drbob]

Hi,

I'm currently putting hardware together to make an FOSS based router for my LAN, I've just found out about OPNsense, I'm interested in trying it out, however I'm not sure it will actually fit my needs, hence this post.

Main requirements:

• basic firewall and NAT
• Works with a SIP VoIP server behind the NAT (i.e disable NAT source port rewriting, forward relevant ports)
• QoS to maintain good performance of multiple VoIP channels even when download or upload is saturated.
• Auto failover if main WAN goes down using a 4G USB stick
• openVPN endpoint

I've bought an Igel 5/4 thin client which is essentially a standard x86 PC based around a 1Ghz VIA C7 processor (which has VIA padlock AES acceleration for good openvpn performance) and only uses ~10w idle/20W under load. It has a PCI slot which I'm going to populate with an Intel 2 port gigabit card (e.g. this). I believe it should more than adequate to handle my limited ADSL (5mbit down/800kbps up) and even be fine if I upgrade to VDSL (~30Mbit down/6Mbit up predicted for my line). No cable where I am.

From the docs it seems 1-3 and the failover part of of 4 should be no problem, however I can't find anything about OPNsense support for 4G modems, is support just undocumented or actually non-existant? I suppose I could get a small secondary router like the TP-Link TL-MR3020, install a distro with good 4G support such as openWRT and bridge the connection over to OPNsense but I'd me much happier just plugging the USB stick directly into the Igel unit. Is 4G support planned if not currently available?

I also can't find anything about VIA padlock support for speedy, low CPU openVPN, other distributions such as pfSense definitely support this and I'd prefer something which support it without a lot of messing around.

Any comments or advice on the proposed build welcome.

 

[franco]

Hi there,

Devices with padlock engines are quite old, I would think that it works for your use case, but gives no room to grow. 1 GB of RAM should be the minimum. Whatever Intel-based device this offers is the one you should use.

Padlock crypto support is in FreeBSD and hence also available for OPNsense.

4G does not work, 3G is ok if you can find an older one that works with FreeBSD.

In short: 1, yes, 2, yes ,3, yes, 4, no, 5, yes


Cheers,
Franco

[drbob]

Update on this though it's years later 

The igel thin client turned out to be unsuitable for OPNsense. It's passively cooled and the system would overheat and lock up. I recently set up an OPNsense system using an old laptop and I'm very happy with it so far.

[franco]

Happy to hear