Hardware recommendations for a Debian version of IPCop

Discussion:

Scott Ferguson

2011-07-12 08:40:34 UTC

My question is what m/bs are well supported by Debian, that can support
the following requirements comfortably?

I'd like to build a pure(-ish) Debian (stable) firewall/router that
duplicates much of the functionality of IPCop:-

To run a web interface (licence allowing, borrowed from IPCop OR using
webmin) dhcp and ntp server, wondershaper, dyndns (or tinydyndns),
snort, squid, apt-cache, shorewall, OpenVPN/StrongSWAN (or Hamachi if
Mojako improves) and very little else.

mini or micro m/b format (low-power), two+ USB 2.0 ports, serial port,
three NICs (or 1 built-in +2 pci slots), not fussed about drive support
(IDE, PATA, SATA, SDcard, don't care), bonus points for *no* built-in
video or sound.

The current box exceeds the minimum requirements for IPCop - but chugs
with UpdateAccellerator, and, chokes with caching.
I'm tired of not having usb_modeswitch to support USB UMTS
devices, would like to be able to deal with IPv6 when using dual-stack
ISPs that support it, and definitely prefer a modern version of snort.

NOTES: I'm after reliability so scratch FitPC and other mini-toasters,
unless they can to run reliably for several years without failure. I'd
rather have an overpowered device that underpowered. IPCop is a great
project - just no longer satisfies my needs.

Cheers, and thanks in anticipation

--
What did moths bump into before the electric light bulb was invented?
Boy, the lightbulb really screwed the moth up didn't it? Are there moths
on their way to the sun now going, "It's gonna be worth it!"
~ Bill Hicks

Jonathan Plews

2011-07-12 09:46:37 UTC

Permalink

Post by Scott Ferguson
I'd like to build a pure(-ish) Debian (stable) firewall/router that
duplicates much of the functionality of IPCop:-

http://linux.voyage.hk/

...

Post by Scott Ferguson
NOTES: I'm after reliability so scratch FitPC and other mini-toasters,

http://www.pcengines.ch/alix.htm
http://soekris.com/products.html

Voyage has not caused me any problems so far, I used a fairly large
compact flash card, which paid off because I was able to compile
compat-wireless directly on the system post install when the wireless
wasn't working optimally. I have only used ALIX baords, and not many
of them, but no problems so far.

Hope that is of interest

Regards

Jon

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Scott Ferguson

2011-07-12 11:35:45 UTC

Permalink

Post by Jonathan Plews

Post by Scott Ferguson
I'd like to build a pure(-ish) Debian (stable) firewall/router that
duplicates much of the functionality of IPCop:-

http://linux.voyage.hk/

Interesting (another derivative I didn't know about) - kind of takes the
fun out of it though, and I'd rather stick with Squeeze, I'm comfortable
stripping that down to Emdebian Grip size (using equivs it strips down
to Crush size, but that ruins the desired web interface), and I'm cheap
(and lazy) :-)

Post by Jonathan Plews
...

Post by Scott Ferguson
NOTES: I'm after reliability so scratch FitPC and other mini-toasters,

http://www.pcengines.ch/alix.htm

The alix2d13 looks likely - might even be Coreboot supported. :-)

Post by Jonathan Plews
http://soekris.com/products.html

I've bookmarked it - thanks. With 40C to -6C temperatures in the home
office - my boxen live naked, keeps the cleaning to a minimum too ;-p

Post by Jonathan Plews
Voyage has not caused me any problems so far, I used a fairly large
compact flash card,

I currently run a very large cache of apt packages from Squeeze and
Wheezy, plus Microsoft updates for XP and later, Adobe fixes and various
antivirus updates (hence the UpdateAccellerator mention). That currently
sits on a standalone HDD with the main OS loaded from a USBkey - but I
could just NFS mount that.
I'd like to minimise the power usage - but it's not critical,
reliability is.

Post by Jonathan Plews
which paid off because I was able to compile
compat-wireless directly on the system post install when the wireless
wasn't working optimally. I have only used ALIX baords, and not many of
them, but no problems so far.

Ouch - I lack your patience for compiling on the destination platform.
The board looks much better made than the FitPC.

Post by Jonathan Plews
Hope that is of interest

It is.

Post by Jonathan Plews
Regards
Jon

The Alix appears to fit the bill - not sure if it'll have enough grunt
for the task but if it doesn't I'm sure I'll find something else to use
it for.
I'd previously had a very unsatisfactory experience with a FitPC - VOIP
just carks it when the network is making cache demands and Snort is busy
- and VPN is not real tolerant of a flat out CPU. The FitPC lasted 3
months - and the design didn't lend itself to easy fan cooling so I
doubt it'd survived through a Canberra summer.

Cheers, thanks for your research and tips.

green

2011-07-12 19:46:00 UTC

Permalink

Post by Scott Ferguson
Interesting (another derivative I didn't know about) - kind of takes the
fun out of it though, and I'd rather stick with Squeeze

You can probably run Debian squeeze on any of the Soekris products; I run it
on a net5501.

Jonathan Plews

2011-07-12 09:48:47 UTC

Permalink

Post by Scott Ferguson
I'd like to build a pure(-ish) Debian (stable) firewall/router that
duplicates much of the functionality of IPCop:-

http://linux.voyage.hk/

Post by Scott Ferguson
NOTES: I'm after reliability so scratch FitPC and other mini-toasters,

Michael Buchholz

2011-07-12 12:25:50 UTC

Permalink

Hi,

Did anyone already mentioned the Sheeva Plug?
1.2 Ghz ARM CPU
512 MB RAM
512 MB Flash
SDHC (bootable)
1 USB 2.0
100 MBit Ethernet
Serial Console via USB (driver is in linux kernel)

Also available with eSata

Power consumption is 7 Watt
Comeswith preinstalled Linux (i forgot, which brand) in the flash - but
before i booted that twice, i had Debian on that box.

i paid 130 Euro in January 2009 including shipping from UK to Germany.

Other devices are available

Post by Scott Ferguson
My question is what m/bs are well supported by Debian, that can support
the following requirements comfortably?
I'd like to build a pure(-ish) Debian (stable) firewall/router that
duplicates much of the functionality of IPCop:-
To run a web interface (licence allowing, borrowed from IPCop OR using
webmin) dhcp and ntp server, wondershaper, dyndns (or tinydyndns),
snort, squid, apt-cache, shorewall, OpenVPN/StrongSWAN (or Hamachi if
Mojako improves) and very little else.
mini or micro m/b format (low-power), two+ USB 2.0 ports, serial port,
three NICs (or 1 built-in +2 pci slots), not fussed about drive support
(IDE, PATA, SATA, SDcard, don't care), bonus points for *no* built-in
video or sound.
The current box exceeds the minimum requirements for IPCop - but chugs
with UpdateAccellerator, and, chokes with caching.
I'm tired of not having usb_modeswitch to support USB UMTS
devices, would like to be able to deal with IPv6 when using dual-stack
ISPs that support it, and definitely prefer a modern version of snort.
NOTES: I'm after reliability so scratch FitPC and other mini-toasters,
unless they can to run reliably for several years without failure. I'd
rather have an overpowered device that underpowered. IPCop is a great
project - just no longer satisfies my needs.
Cheers, and thanks in anticipation

Scott Ferguson

2011-07-12 13:39:42 UTC

Permalink

Post by Michael Buchholz
Hi,
Did anyone already mentioned the Sheeva Plug?

No. (but I'd heard of them, and forgotten).

Post by Michael Buchholz
1.2 Ghz ARM CPU
512 MB RAM
512 MB Flash
SDHC (bootable)
1 USB 2.0
100 MBit Ethernet
Serial Console via USB (driver is in linux kernel)

I'll have to look up the specs - I'm not confident the CPU has enough
grunt, I'd require at least 2 USB ports - though maybe I could use a USB
hub (for modems and a wireless access point)... have to be able to use 3
NICs though.

Post by Michael Buchholz
Also available with eSata
Power consumption is 7 Watt
Comeswith preinstalled Linux (i forgot, which brand) in the flash - but
before i booted that twice, i had Debian on that box.

:-)

Post by Michael Buchholz
i paid 130 Euro in January 2009 including shipping from UK to Germany.
Other devices are available

I'll have a look - thanks for the suggestion.

Post by Michael Buchholz

Post by Scott Ferguson
My question is what m/bs are well supported by Debian, that can support
the following requirements comfortably?

<snipped>

Cheers

Alejandro

2011-07-12 13:48:30 UTC

Permalink

Hi

did you know where to buy that sheeva plug to test it?

thanks

Post by Michael Buchholz
Hi,
Did anyone already mentioned the Sheeva Plug?
1.2 Ghz ARM CPU
512 MB RAM
512 MB Flash
SDHC (bootable)
1 USB 2.0
100 MBit Ethernet
Serial Console via USB (driver is in linux kernel)
Also available with eSata
Power consumption is 7 Watt
Comeswith preinstalled Linux (i forgot, which brand) in the flash -
but before i booted that twice, i had Debian on that box.
i paid 130 Euro in January 2009 including shipping from UK to Germany.
Other devices are available

--
Alejandro Prats
Arts Internet Solutions S.L.
Administrador de Sistemas

Fixed Office: (+34) 952662375
Email: ***@artsinternetmalaga.com

El contenido de este mensaje es confidencial y puede contener información confidencial, algunos o todos de los cuales pueden ser legalmente privilegiados. Es para uso exclusivo para el uso de la persona o entidad a quien va dirigida. Si no es el destinatario, notifique porfavor si es tan amable al remitente respondiendo a este e-mail, y luego se ruega elimine todas las copias del correo electrónico en el sistema. Si usted no es el destinatario indicado, no debe usar, revelar, distribuir, copiar, imprimir o difundir este correo electrónico.
Aunque hemos tomado las precauciones razonables para asegurar que este e-mail y cualquier archivo adjunto ha sido revisado en busca de virus, no podemos garantizar que están libres de virus y no podemos aceptar responsabilidad por cualquier daño sufrido como consecuencia del virus de software. Le aconsejamos que lleve a cabo su propio control de virus, especialmente antes de abrir un archivo adjunto.

Contents of this message are confidential and may contain proprietary information, some or all of which may be legally privileged. It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, kindly notify the sender by replying to this e-mail, and then you are kindly requested to delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail.
Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

--
To UNSUBSCRIBE, email to debian-firewall-***@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact ***@lists.debian.org
Archive: http://lists.debian.org/***@artsinternetmalaga.com

Michael Buchholz

2011-07-12 16:24:48 UTC

Permalink

Hi,

I bought it on https://www.newit.co.uk
Already 2 years ago...
there are some new models now.

Dreamplug with 2 USB 2.0 and 2 Gigabit Ethernet, eSata

But you might want to look at the openRD Ultimate...
7 USB 2.0, 2 Gigabit Ethernet, 1 PCIe (for your extra NIC),
RS-485 (obviously console)

No extrapoints, because it has sound and VGA - but if i got the
description right, those can be disabled during power-on

Post by Alejandro
Hi
did you know where to buy that sheeva plug to test it?
thanks

--
To UNSUBSCRIBE, email to debian-firewall-***@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact ***@lists.debian.org
Archive: http://lists.debian.org/***@bubi.dnsalias.net