I'm building a router out of a Mini-ITX pc + compact flash card setup and I'm trying to choose a suitable distro. My criteria are:

  • Must be able to run from a CF card (so no excessive disk writes)
  • I'm mostly interested in having a high powered router for the purpose of traffic shaping
  • That said, I'm also interested in using this to learn more about how routing / networking works (my original plan was to use a basic bare-bones distro like LFS and put the routing software on top myself) so I'm not after a distro that hides the inner workings from me
  • I'd also like to have SSH

I think I've narrowed it down to two - Monowall and pfSense (pfSense being a fork of Monowall)

Monowall has the advantage of being targetted towards flash cards, wheras pfSense has more of the traffic shaping and other features I'm interested in.

I also understand that they use different mechanisms unerneath the covers, but I cant say I understand that much about the differences to make an informed decision.

Does anyone have any advice / information on either of those (or another alternative I havent yet considered)

  • 2
    Not answering the question but should help. Most of the writing happens to log files. I run pf on a readonly card and offload log writing to an NFS mount. – Ryaner Sep 7 '09 at 21:02
  • @ryaner -- how does that recover from the NFS server failing? – chris Sep 7 '09 at 21:19
  • Well my idea was to mount a RAM disk and have it flush the logs to another machine whenever its online - seeing as I have my computer off at night that could be quite infreqently, but with 1GB of ram I could allocate ~200 MB of space and not notice. – Justin Sep 7 '09 at 23:08

I have used Smoothwall for a long time, though I have been watching pfSense with great anticipation. I am kind of sad that third-party development for smoothwall seems to have largely died out since the great 2.0 days... thus I have been watching other products to see where they are going.

pfSense has an embedded version that is perfect for running from flash media. I think you will ultimately be much happier with it than monowall for what you describe as key criteria above, though I think it also is a touch more advanced so it might take a bit more elbow grease on your part to get it where you like it. But the best thing in my opinion, is that pfSense still seems to be a very active project.


"Monowall is first and foremost, a routing platform. Nothing more, nothing less. The distribution comes in two flavors, either for embedded systems or for regular PCs."

"pfSense is a hybrid of sorts, that has multiple sources for it’s major components. It was originally derived from monowall, but uses OpenBSD’s ported Packet Filter, a package management system to provide an integrated extensibility to the platform and Alternate Queuing (ALTQ) from FreeBSD"

From here: A little old, but still current.


M0n0wall is good for you:

  • Has traffic Shapping
  • Can be installed in CF

Unfortunately, has no ssh and inner-working is a bit hidden - very little in exec.php

You might want to look at Zeroshell from www.zeroshell.net/eng. Has much more

M0n0wall Captive Portal logout url - not pop-up window


I have been useing pfSense myself without any hitche. I have also been considering trying out MoNowall since ipv6 is implemented from the get-go with it. I have tried load-balancing from both sides and configured ipv6 tunnels. I have installed both to systems, and specialized hardware. I use SSH for managing my box and like that it can do openBGP.


I tried IPCop, Smoothwall, m0n0wall and finally landed and stuck with pfSense. Extremely good, we are hosting WAN, DMZ, LAN, WLAN and One other without falt.


Rather than using either of these, I'd use OpenBSD, and PF. It's able to do all the same routing stuff that Monowall or PFsense can do, but it's firewall (pf) is far more capable than the IPfilter monowall uses. You'll have to write rules by hand, but OpenBSD and PF is a wonderful firewall platform, and is more than capable of traffic shaping, using AltQ. It comes with ssh (OpenBSD is responsible for the SSH used with most Unixs these days).

  • 2
    Uhhh.... pfSense is based on OpenBSD, and uses PF as you suggest. – Goyuix Sep 7 '09 at 20:46
  • I don't see the benefit to pfsense rather than base OpenBSD, is my main reasoning though. And the OpenBSD community is larger than the PFsense one. – Cian Sep 7 '09 at 21:21
  • Well the only advantage that I can see is the web front-end. The one thing that put me off just a normal distro was having to find / build a web front end. – Justin Sep 7 '09 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.