Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm considering putting OpenBSD on a netbook for use as a firewall. I am entertaining the idea of using a netbook because it has a built-in screen and keyboard, built-in battery backup, and a relatively small physical footprint. The firewall will be for a small office (i.e. <20 computers).

I'd like to know what drawbacks there are to using a netbook as an OpenBSD firewall -- and what alternatives I might wish to consider. One apparent drawback is that netbooks rarely (if ever?) have two ethernet ports, so a USB-Ethernet adapter will be required. What other pros/cons/issues ought to be considered when looking at an OpenBSD netbook firewall?

Thanks for reading. I'm grateful for your thoughts, and look forward to reading your feedback.

Brian

share|improve this question
1  
Is this for home or work? (if for home, go for it) You should be able to run the firewall on a single NIC, havent looked at it in years. If the firewall fails, how much of a bother is it to put up a replacement or work without a firewall on the boundary? –  samt Dec 9 '10 at 14:10

5 Answers 5

It really does come down to hardware and driver availability. The processing is typically adequate, hardware and driver support for different NICs to accommodate different networking speeds and/or media types may be challenging. You may also consider the inherent inefficiencies of USB 2.0 when attempting to drive multiple devices and/or devices beyond 480 mbps.

share|improve this answer

Although the netbook has a battery, does the switch/router/gateway device have battery power? If not, this is one of the advantages which don't matter. Not sure I would trust what is basically your entire internet access for your office on netbook hardware. They are not build for this type of work- you only need a power supply problem/hard drive etc to fail, and you have no internet in your office.

share|improve this answer

Your line of thinking is great, but what you really want is a server that has:

  1. The same Atom processor family as a netbook, for power consumption in the single-digit watts. This ensures that it will have a very long run time in the event of a power outage, even when plugged into a very inexpensive desktop UPS. Dual-core wouldn't hurt.

  2. Integrated KVM-over-IP, so you can access its console from anywhere on the network (or even remotely by VPN) so you never need to plug in a keyboard and a mouse.

  3. Dual network interfaces (and a PCIe slot so you can add more if the need arises, e.g. for a DMZ or a guest wireless network).

  4. Small form factor.

  5. Very low price.

The Supermicro SYS-5015A-PHF has all of these features, so it's a good place to start. It is available for around $350 (more like $425-450 once you've added 2GB of RAM and a hard drive) at Newegg, Buy.com, and other reputable vendors.

[edit] The older SYS-5015A-H is an even less expensive option at around $250, but it does not support KVM over IP.

share|improve this answer
    
@Miles Erickson: This is great advice. I've one concern, really: Presuming physical access is never an issue so point #2 gives no advantage, that the network connection is DSL (i.e. USB-Ethernet won't be maxed out) so point #3 gives no advantage, that the netbook has all the other points as well, and given that you can get a netbook for $250 all-in, what advantage is there to the server option? Reliability? If that's the only significant advantage - in this context - is it worth paying nearly double the price for the difference in reliability? Or are there other advantages? Thanks! –  Brian M. Hunt Nov 8 '10 at 18:08
    
You do get a dual core processor and a great deal more flexibility for future upgrades. If you don't need KVM over IP, there is a slightly older model that costs about $100 less. –  Skyhawk Nov 8 '10 at 18:59
    
@Miles Erickson: Thanks for the reply. The $100 I'd save on KVM over IP I'd have to spend on a monitor & keyboard. ha! I like the idea of these mini-servers, but for the price I'm not compelled that it offers a decided advantage over a cheap netbook - for the job at hand. A network that was much bigger and I'd consider one of these servers. –  Brian M. Hunt Nov 8 '10 at 21:35
    
Obviously, you can and will make your own call on the hardware, but it is definitely unconventional to use a netbook as a firewall. If a supervisor or client ever asked me to do such a thing, I would decline to participate. The main problem with this type of a solution is that it looks unprofessional: any problems with the internet connection, whether connectivity or security, will forever get pinned on the guy who decided that 15 users should depend on a netbook for their internet access. Appearances really do matter. –  Skyhawk Nov 8 '10 at 21:44
    
Also, it is not really necessary to buy a monitor and keyboard for occasional administration of a server that lacks KVM over IP. One just borrows whatever is available. Or, if you'd like a few free CRTs, I know plenty of people who will pay you five or ten bucks for every one that you're willing to pick up... –  Skyhawk Nov 8 '10 at 21:46

Use PFsense.. its amazing.. Check it out.. I use it everywhere i can :D

share|improve this answer

Have you considered using a small mini-itx (or smaller) embeded computer with a serial port?

A serial ports gives you console access from you PC or any other laptop nearby. The footprint is lowered, but you still have easy screen+keyboard access to it (without needing to remove a keyboard/monitor from somewhere else.

A netbook may be cheaper though, but good luck with the second ethernet port.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.