Time to assemble a new router

Get used on Ebay.

Chelsio is top tier (T520 or up) if your thinking 10Gb, followed by Intel X520 line and up. When buying i buy only from North American sellers and i look for ones who tend to sell server stuff in general.

Absolutely on used.

I'll second all of this. I had a Chelsio card in my pfSense box and all of my cabling has come from fs.com.

It's funny I see Chelsio recommended a LOT on reddit and forums but I've never seen it in the enterprise. I've been in datacenters for over 15 years with HP/Compaq, IBM/Lenovo, Supermicro, and Dell and I've never seen a chelsio card in person. It's primarily been Intel or Broadcom with some Marvel and Qlogic sprinkled in.
 
And? PFsense and OPNsense are both firewall's also in their default form. Both need plugins or upgrade to capture next-gen firewall or UTM features.
And what? I'm not sure what you're replying to.

I haven't talked about "next gen" or UTM features.
 
It's funny I see Chelsio recommended a LOT on reddit and forums but I've never seen it in the enterprise. I've been in datacenters for over 15 years with HP/Compaq, IBM/Lenovo, Supermicro, and Dell and I've never seen a chelsio card in person. It's primarily been Intel or Broadcom with some Marvel and Qlogic sprinkled in.
I'm not a datacenter guy, but how many systems did you oversee that ran FreeBSD? Chelsio is heavily recommended on FreeBSD based OSes such as pfSense, OPNsense, TrueNAS Core (formerly FreeNAS), etc.... because historically they have had some of the best FreeBSD support. CXGBE for Chelsio NICs was introduced into the FreeBSD kernel around 2012 and since it's inception supported "Jumbo Frames, Transmit/Receive checksum offload, TCP segmentation offload (TSO), Large Receive Offload (LRO), VLAN tag insertion/extraction, VLAN checksum offload, VLAN TSO, and Receive Side Steering (RSS)".
 
I'm not a datacenter guy, but how many systems did you oversee that ran FreeBSD? Chelsio is heavily recommended on FreeBSD based OSes such as pfSense, OPNsense, TrueNAS Core (formerly FreeNAS), etc.... because historically they have had some of the best FreeBSD support. CXGBE for Chelsio NICs was introduced into the FreeBSD kernel around 2012 and since it's inception supported "Jumbo Frames, Transmit/Receive checksum offload, TCP segmentation offload (TSO), Large Receive Offload (LRO), VLAN tag insertion/extraction, VLAN checksum offload, VLAN TSO, and Receive Side Steering (RSS)".
Not a one I believe on BSD professionally. But I've had plenty of Linux systems over the years we always just bought Intels for those. Personally my Pfsense(1gig), TrueNAS(10gig) and Proxmox(10gig) all run Intel NICs. I guess it's a BSD thing.
 
Not a one I believe on BSD professionally. But I've had plenty of Linux systems over the years we always just bought Intels for those. Personally my Pfsense(1gig), TrueNAS(10gig) and Proxmox(10gig) all run Intel NICs. I guess it's a BSD thing.
That's exactly what it was / is. I agree, I've worked in datacenters with thousands of machines. I've never seen one either. That being said when I built the machine five or six years ago people were saying that the BSD drivers for Chelsio were far more compatible than Intel at the time. I think now things may have changed and it does not matter as much anymore.
 
Regarding concern about having all your eggs in one basket w/ virtualization. There's validity to that but the portability of a VM combined with efficient use of hardware is worth it imho. This is [H] after all and many have an old router or computer in the closet for a failure scenario. I have an old Asus AC router in AP mode that can be changed to router mode, internet back up and running in minutes.

Having a spare wifi router preconfigured w/ DHCP WAN and DHCP running on the LAN can save the day for friends and family too. User/pass clearly labeled on the top. I have a WRT54G that has been in many homes and small businesses. Now that I type this, think I'm going to get a new AP and use my Asus as the spare.
 
That's exactly what it was / is. I agree, I've worked in datacenters with thousands of machines. I've never seen one either. That being said when I built the machine five or six years ago people were saying that the BSD drivers for Chelsio were far more compatible than Intel at the time. I think now things may have changed and it does not matter as much anymore.
FreeBSD support for NICs (and hardware in general) has gotten better over the years, but Linux can sometimes be better. For a reference to supported hardware on the current release (at this time it is 13.2) you can refer to the FreeBSD 13.2-RELEASE Hardware Notes
 
Since we're going down the rabbit hole of rolling your own--definitely check out sophos as I believe it's free for home use in a roll your own form.
 
Since we're going down the rabbit hole of rolling your own--definitely check out sophos as I believe it's free for home use in a roll your own form.
The caveat that will matter to most people is the free version limits you to 50 IP addresses total. So I guess if you never intend to have that many IPs active across your networks then give it a shot. You could throw IPFire or OpenWRT into the considerations too.

The caveats that some people might not agree with is Sophos is closed source and based on Linux. I prefer open source software and I think FreeBSD as a base OS is a better choice over Linux for a firewall/router.
 
The caveat that will matter to most people is the free version limits you to 50 IP addresses total.
I didn't know it had this limitation. Is this a DHCP, subnet, or simply routing limit? Ie, can you setup up 100 static IPs and it still route or does it truly limit to 50 IPs?
 
I didn't know it had this limitation. Is this a DHCP, subnet, or simply routing limit? Ie, can you setup up 100 static IPs and it still route or does it truly limit to 50 IPs?
Sophos UTM Free has a 50 IP limit (not 100% sure how it worked but I assume it just didn't route traffic beyond the first 50 IPs it establishes). I've read using both an IPv4 and IPv6 address on a client will take up two addresses too lol. It looks like they are still offering updated software builds of it but don't as heavily advertise it? Maybe you can't even sign up anymore and you need to already have it established on the free account?

However Sophos "Free Firewall Home Edition" (I think also referred to as XG) has an unlimited IP limit, but limits you to 4 CPU cores and 6GB of RAM. Which honestly that's probably fine for 99% of home networks anyway on a somewhat modern CPU architecture. But it apparently isn't as feature rich as UTM. I'm just finding out about this, the last time Sophos came up personally for me was many years ago when a friend recommended them and I immediately turned away at reading about the 50 IP limit. I believe at that time the only product offered was UTM.

So I guess toss that into the ring to be considered. Another product that has a free tier with some various limitations is Arista NG Firewall (formerly Untangle).
 
Absolutely on used.

It's funny I see Chelsio recommended a LOT on reddit and forums but I've never seen it in the enterprise. I've been in datacenters for over 15 years with HP/Compaq, IBM/Lenovo, Supermicro, and Dell and I've never seen a chelsio card in person. It's primarily been Intel or Broadcom with some Marvel and Qlogic sprinkled in.
In my line of work it's Solarflare (now owned by AMD) or sometimes Mellanox (now owned by NVidia). They're both high performance NICs. I'm in the financial trading business. Of course we also use the usual Intel & Broadcom stuff in systems that aren't low latency trading systems. We tend to view those as "regular" NICs and not pay too much attention to them. Solarflare has kernel bypass libraries & drivers for Linux, and Mellanox supports RDMA (remote direct memory access -- allows a machine to designate a region of system memory that another machine can read from or write to without intervention from the CPU). For desktop use Mellanox/NVidia is good. RDMA can work with Windows file sharing (SMB Direct), and they have official support for client Windows. Solarflare is a PITA in Windows. No official support unless it's Windows server, and you have to jump through hoops in PowerShell to install the drivers and get one working. Both are fine in Linux, though you'll likely need a "corporate" distribution if you want all the features. RedHat for sure, Ubuntu LTS is usually ok.

Late Edit: Solarflare 8000 series does work in Win10 and Win11, it's just not officially supported and can be glitchy. I'd assume the newer ones do too, but haven't tried one. That said I wouldn't buy a Solarflare unless you specifically want a Solarflare or it's cheap and you're only going to use it with Linux. For Linux only use you can treat them as quality generic NICs.
 
Last edited:
Sophos UTM Free has a 50 IP limit (not 100% sure how it worked but I assume it just didn't route traffic beyond the first 50 IPs it establishes). I've read using both an IPv4 and IPv6 address on a client will take up two addresses too lol. It looks like they are still offering updated software builds of it but don't as heavily advertise it? Maybe you can't even sign up anymore and you need to already have it established on the free account?

However Sophos "Free Firewall Home Edition" (I think also referred to as XG) has an unlimited IP limit, but limits you to 4 CPU cores and 6GB of RAM. Which honestly that's probably fine for 99% of home networks anyway on a somewhat modern CPU architecture. But it apparently isn't as feature rich as UTM. I'm just finding out about this, the last time Sophos came up personally for me was many years ago when a friend recommended them and I immediately turned away at reading about the 50 IP limit. I believe at that time the only product offered was UTM.

So I guess toss that into the ring to be considered. Another product that has a free tier with some various limitations is Arista NG Firewall (formerly Untangle).
The ram and core limit ones was the sophos I was thinking of. And yeah that Arista one seems pretty neat too. Any of these are far better than any consumer router, that's for sure.
 
Been running untangle.for several years now. Personally I'm in favor of the licensing model as it gets updates for the UTM services.
 
Back
Top