1

I'm considering putting OpenBSD on a netbook for use as a firewall. I am entertaining the idea of using a netbook because it has a built-in screen and keyboard, built-in battery backup, and a relatively small physical footprint. The firewall will be for a small office (i.e. <20 computers).

I'd like to know what drawbacks there are to using a netbook as an OpenBSD firewall -- and what alternatives I might wish to consider. One apparent drawback is that netbooks rarely (if ever?) have two ethernet ports, so a USB-Ethernet adapter will be required. What other pros/cons/issues ought to be considered when looking at an OpenBSD netbook firewall?

Thanks for reading. I'm grateful for your thoughts, and look forward to reading your feedback.

Brian

1
  • 1
    Is this for home or work? (if for home, go for it) You should be able to run the firewall on a single NIC, havent looked at it in years. If the firewall fails, how much of a bother is it to put up a replacement or work without a firewall on the boundary?
    – samt
    Dec 9, 2010 at 14:10

5 Answers 5

3

Your line of thinking is great, but what you really want is a server that has:

  1. The same Atom processor family as a netbook, for power consumption in the single-digit watts. This ensures that it will have a very long run time in the event of a power outage, even when plugged into a very inexpensive desktop UPS. Dual-core wouldn't hurt.

  2. Integrated KVM-over-IP, so you can access its console from anywhere on the network (or even remotely by VPN) so you never need to plug in a keyboard and a mouse.

  3. Dual network interfaces (and a PCIe slot so you can add more if the need arises, e.g. for a DMZ or a guest wireless network).

  4. Small form factor.

  5. Very low price.

The Supermicro SYS-5015A-PHF has all of these features, so it's a good place to start. It is available for around $350 (more like $425-450 once you've added 2GB of RAM and a hard drive) at Newegg, Buy.com, and other reputable vendors.

[edit] The older SYS-5015A-H is an even less expensive option at around $250, but it does not support KVM over IP.

5
  • @Miles Erickson: This is great advice. I've one concern, really: Presuming physical access is never an issue so point #2 gives no advantage, that the network connection is DSL (i.e. USB-Ethernet won't be maxed out) so point #3 gives no advantage, that the netbook has all the other points as well, and given that you can get a netbook for $250 all-in, what advantage is there to the server option? Reliability? If that's the only significant advantage - in this context - is it worth paying nearly double the price for the difference in reliability? Or are there other advantages? Thanks! Nov 8, 2010 at 18:08
  • You do get a dual core processor and a great deal more flexibility for future upgrades. If you don't need KVM over IP, there is a slightly older model that costs about $100 less.
    – Skyhawk
    Nov 8, 2010 at 18:59
  • @Miles Erickson: Thanks for the reply. The $100 I'd save on KVM over IP I'd have to spend on a monitor & keyboard. ha! I like the idea of these mini-servers, but for the price I'm not compelled that it offers a decided advantage over a cheap netbook - for the job at hand. A network that was much bigger and I'd consider one of these servers. Nov 8, 2010 at 21:35
  • Obviously, you can and will make your own call on the hardware, but it is definitely unconventional to use a netbook as a firewall. If a supervisor or client ever asked me to do such a thing, I would decline to participate. The main problem with this type of a solution is that it looks unprofessional: any problems with the internet connection, whether connectivity or security, will forever get pinned on the guy who decided that 15 users should depend on a netbook for their internet access. Appearances really do matter.
    – Skyhawk
    Nov 8, 2010 at 21:44
  • Also, it is not really necessary to buy a monitor and keyboard for occasional administration of a server that lacks KVM over IP. One just borrows whatever is available. Or, if you'd like a few free CRTs, I know plenty of people who will pay you five or ten bucks for every one that you're willing to pick up...
    – Skyhawk
    Nov 8, 2010 at 21:46
2

Use PFsense.. its amazing.. Check it out.. I use it everywhere i can :D

2

It really does come down to hardware and driver availability. The processing is typically adequate, hardware and driver support for different NICs to accommodate different networking speeds and/or media types may be challenging. You may also consider the inherent inefficiencies of USB 2.0 when attempting to drive multiple devices and/or devices beyond 480 mbps.

1

Although the netbook has a battery, does the switch/router/gateway device have battery power? If not, this is one of the advantages which don't matter. Not sure I would trust what is basically your entire internet access for your office on netbook hardware. They are not build for this type of work- you only need a power supply problem/hard drive etc to fail, and you have no internet in your office.

0

Have you considered using a small mini-itx (or smaller) embeded computer with a serial port?

A serial ports gives you console access from you PC or any other laptop nearby. The footprint is lowered, but you still have easy screen+keyboard access to it (without needing to remove a keyboard/monitor from somewhere else.

A netbook may be cheaper though, but good luck with the second ethernet port.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .