Comment by KennyBlanken | Hacker News Reader

Comment by KennyBlanken | Hacker News Reader

Parent Full thread

Paying $700+ for something like this is just silly. OPNsense and pfSense are both charging massive markups on this hardware.

pfSense doubles the price over the exact same box you can get from AliExpress or ebay.

Buy a standard Ryzen mobo, a low-end recent Ryzen CPU, undervolt it, toss some ram in, an old SATA SSD, and a dual or quad port PCIe adapter off ebay. Or just buy an old Dell SFF PC; you can get your choice of how powerful a processor you want.

If you want the embedded/fanless setup, then buy one of the aliexpress/ebay boxes. Qotom is one such seller, I believe.

As someone with a ton of experience with opnsense: their release style is extremely irritating. The only way to get security updates is to conduct a full upgrade of the system. The UI is clunky, outdated, full of useless "help text", and almost seems to be purposefully designed to use confusing field names and terminology. Debugging problems is difficult at best with inconsistent logging infrastructure.

I've also never once had a config restore go properly, something I've tried to do several times because I generally get about 2-3 years out of an opnsense install before enough stuff has broken that I need to reinstall from scratch.

Last but not least: they now routinely ignore their support forum except for the most simple, common problems. Every time I've had a problem, I've found a corresponding post in their forum which has gone gnored by their employees.

> OPNsense and pfSense are both charging massive markups on this hardware.

Hardware remains one of the few viable business models for open-source software. The combination of features on this particular device have literally not been sold before, so in this particular case, the price may be somewhat justified IF they are also providing regular UEFI firmware security fixes.

With such high margins, it's surprising there are no hardware clones for AMD firewalls. Is that due to CPU shortages?

Protectli is a success story for Intel firewalls, where the open (coreboot) product earns a price premium and opaque clones expand the market.

15W idle is not bad. The 20€ eBay-Cards will eat this alone. You can get better numbers with Intel cards, but those are 70€ and up. Also, Ryzen embedded is quite a bit more efficient. Now, depending on where you live, this might not matter, but a Wattyear costs me ~3.4€. So if the thing uses 35W instead of 15W, I pay 68€ extra per year just for power. Additionally, you need to find a small formfactor passive case that supports a PCIe card and a small enough mainboard to fit it. This alone will set you back quite some money.

If space or power efficiency don't matter to you, that's totally fine, then you can easily & cheaply match those specs. If you need something small and efficient, the markup isn't that large.

The cost can still favor DIY, even using new parts. I did this twice about a year ago, when the USD prices were far worse for DIY.

Nowadays, one can get a cheap Alder Lake Pentium + ITX/mATX with a cheap case, okay PSU, RAM, and SSD. That's no more than $350. Now new Intel dual SFP+ NICs are hard to find cheap, with Nvidia cards being easier to find cheap. So a dual port CX4 or CX5 from fs.com will run from $260 to $340. This still comes out ahead of the official HW. It all gets cheaper with older Intel HW.[1]

IMO, buying the official HW is officially supporting the OPNSense developers. As you noted, the DEC700 series is also quite small in terms of footprint. Those are definitely strong factors in favor of the DEC700.

[1] I mostly went with Intel HW, moving away from using a R5 3600 in that role. It seems that AMD's Zen2 is a bit less efficient vs contemporary and current Intel desktop platforms in idle to low-mid loads. Current setup with an older used Pentium and an used dual port X520 takes ~<20W on average. Though I doubt the DEC740 takes 15W at idle, probably less.

W.r.t. older Intel HW, I am thinking of 10th/11th gen parts, which can be had on good deals new.

> pfSense doubles the price over the exact same box you can get from AliExpress or ebay.

They do? Show me.

Reply on news.ycombinator.com