Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm building a router out of a Mini-ITX pc + compact flash card setup and I'm trying to choose a suitable distro. My criteria are:

  • Must be able to run from a CF card (so no excessive disk writes)
  • I'm mostly interested in having a high powered router for the purpose of traffic shaping
  • That said, I'm also interested in using this to learn more about how routing / networking works (my original plan was to use a basic bare-bones distro like LFS and put the routing software on top myself) so I'm not after a distro that hides the inner workings from me
  • I'd also like to have SSH

I think I've narrowed it down to two - Monowall and pfSense (pfSense being a fork of Monowall)

Monowall has the advantage of being targetted towards flash cards, wheras pfSense has more of the traffic shaping and other features I'm interested in.

I also understand that they use different mechanisms unerneath the covers, but I cant say I understand that much about the differences to make an informed decision.

Does anyone have any advice / information on either of those (or another alternative I havent yet considered)

share|improve this question
Not answering the question but should help. Most of the writing happens to log files. I run pf on a readonly card and offload log writing to an NFS mount. – Ryaner Sep 7 '09 at 21:02
@ryaner -- how does that recover from the NFS server failing? – chris Sep 7 '09 at 21:19
Well my idea was to mount a RAM disk and have it flush the logs to another machine whenever its online - seeing as I have my computer off at night that could be quite infreqently, but with 1GB of ram I could allocate ~200 MB of space and not notice. – Justin Sep 7 '09 at 23:08
up vote 5 down vote accepted

I have used Smoothwall for a long time, though I have been watching pfSense with great anticipation. I am kind of sad that third-party development for smoothwall seems to have largely died out since the great 2.0 days... thus I have been watching other products to see where they are going.

pfSense has an embedded version that is perfect for running from flash media. I think you will ultimately be much happier with it than monowall for what you describe as key criteria above, though I think it also is a touch more advanced so it might take a bit more elbow grease on your part to get it where you like it. But the best thing in my opinion, is that pfSense still seems to be a very active project.

share|improve this answer

"Monowall is first and foremost, a routing platform. Nothing more, nothing less. The distribution comes in two flavors, either for embedded systems or for regular PCs."

"pfSense is a hybrid of sorts, that has multiple sources for it’s major components. It was originally derived from monowall, but uses OpenBSD’s ported Packet Filter, a package management system to provide an integrated extensibility to the platform and Alternate Queuing (ALTQ) from FreeBSD"

From here: A little old, but still current.

Also, read here for my experience with pfSense.


share|improve this answer

M0n0wall is good for you:

  • Has traffic Shapping
  • Can be installed in CF

Unfortunately, has no ssh and inner-working is a bit hidden - very little in exec.php

You might want to look at Zeroshell from Has much more

M0n0wall Captive Portal logout url - not pop-up window

share|improve this answer

I have been useing pfSense myself without any hitche. I have also been considering trying out MoNowall since ipv6 is implemented from the get-go with it. I have tried load-balancing from both sides and configured ipv6 tunnels. I have installed both to systems, and specialized hardware. I use SSH for managing my box and like that it can do openBGP.

share|improve this answer

I tried IPCop, Smoothwall, m0n0wall and finally landed and stuck with pfSense. Extremely good, we are hosting WAN, DMZ, LAN, WLAN and One other without falt.

share|improve this answer

Rather than using either of these, I'd use OpenBSD, and PF. It's able to do all the same routing stuff that Monowall or PFsense can do, but it's firewall (pf) is far more capable than the IPfilter monowall uses. You'll have to write rules by hand, but OpenBSD and PF is a wonderful firewall platform, and is more than capable of traffic shaping, using AltQ. It comes with ssh (OpenBSD is responsible for the SSH used with most Unixs these days).

share|improve this answer
Uhhh.... pfSense is based on OpenBSD, and uses PF as you suggest. – Goyuix Sep 7 '09 at 20:46
I don't see the benefit to pfsense rather than base OpenBSD, is my main reasoning though. And the OpenBSD community is larger than the PFsense one. – Cian Sep 7 '09 at 21:21
Well the only advantage that I can see is the web front-end. The one thing that put me off just a normal distro was having to find / build a web front end. – Justin Sep 7 '09 at 23:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.