Hacker News Reader

Comment by thayne | Hacker News Reader

What are some alternatives?

Maybe Netgate [1] for anyone using PcEngines + pfSense CE. It’s less hardware, but functionally close (for throughput) and gets you onto pfSense Plus. I know they’re not liked here, but I doubt there are going to be many (or any) sub $200 firewall appliances that I’d be willing to rely on once the PcEngines supply runs out.

I’ve configured ~150 pfSense CE setups on APU2s. It’s a sad day for small businesses. Hopefully Netgate doesn’t increase prices on that low end appliance. I’d love to be proven wrong, but it’s the only pragmatic option now for small businesses.

1. https://shop.netgate.com/collections/desktop-appliances/prod...

I don't like that pfsense phones home.

I have no personal experience with either of these, but I was considering them when looking for options to handle router duties for my 10 Gbit fiber link:

https://protectli.com/product-comparison/

https://shop.opnsense.com/product-categorie/hardware-applian...

I've used Protecli in several small office NGFW builds (<20 people, ~5 remote VPN users, 1 dedicated VPN tunnel to home office) and they have been great over the past 4-5 years. Can recommend.

Protectli includes coreboot.

The i7 model has TPM and DRTM features matching the $200 APU2, but costs ~$1000 USD, https://protectli.com/product/vp4670/

https://www.crowdsupply.com/traverse-technologies/ten64

Those boxes are at higher price point, but far exceed the apu lineup in features/compute.

  All firmware component source code (e.g., ARM Trusted Firmware and U-Boot)

Do you know if they allow customization of the Trusted Firmware, e.g. with owner-signed TrustZone?

The most recent project update was July 2021? https://www.crowdsupply.com/traverse-technologies/ten64/upda...

https://forums.servethehome.com/index.php?threads/article-yo...

> [Ten64] platform (Layerscape) is somewhat interesting but sadly has been so slow to appear in reasonable products that it has been surpassed by basic Celeron-based systems ... seems to me that the Layerscape platform will go the same route as the Marvell (Armada 385 I think) ones did; one or two revisions and then radio silence where only highly integrated partners still keep using it ... it's not powerful enough as a CPU, and the hardware acceleration suffers from the same problems that basic Broadcom SoCs and higher-end ASIC-accelerators do: they get outdated and useless rather quickly

Hi, I'm the person behind the Ten64.

Ten64's have been shipping for a while now, though you are best to ask in our support forum: https://forum.traverse.com.au/ . We haven't posted much on Crowd Supply as it's a very manual process to get stuff up on there.

I'm not too familiar with TrustZone, but I'm not aware of any limitations in the secure world. I haven't tried OP-TEE or any similar secure world firmware' simply as no one has asked for it.

You can see all our firmware components here: https://gitlab.com/traversetech/ls1088firmware

Thanks for posting. Looking to use Arm DRTM, implemented in TrustZone as part of Arm Trusted Firmware. Will follow up in your support forum.

https://www.youtube.com/watch?v=xZoCtNV8Qs0&t=9080s

https://documentation-service.arm.com/static/620e0f9b0ca3057...

https://review.trustedfirmware.org/q/topic:%22mb%252Fdrtm-pr...

When we did the research for our network appliance customers, we were very interested in NXP. Have you tried to buy Application Solutions Kit from NXP? We faced the problem of not achieving spec performance using NXP reference boards. After reaching NXP, support informed us that we should buy ASK, which would solve our problems. Unfortunately, it was beyond our research budget.

No, we haven't bought any ASKs. We have worked with them on a DPDK project and they were quite helpful when it came to debugging difficult bugs with it.

Improving the routing performance in Linux is near the top of my TODO list, however. XDP is one candidate (see https://forum.traverse.com.au/t/vyos-build-my-repo/181/5 for some results) and using the LS1088's AIOP is another possibility.

Linux is important but FreeBSD is the key to heart of majority of DYI firewall builders. I'm huge fan of your project and looking for opportunities to get hands on experience with it.

I see that support for FreeBSD going in good direction:

https://forum.traverse.com.au/t/freebsd-preview-for-ten64/17...

Are there any performance reports for FreeBSD? Especially VPN/wireguard bandwidth would be interesting.

dsl (Dmitry) is the main developer behind the DPAA2 drivers for FreeBSD and he's done a fantastic effort so far. Myself and Bjoern (bz) have also written bits of it.

The performance has improved compared to how it was a year ago (e.g struggling to get 400mbps throughput) but there are some severe issues in -CURRENT :( I believe dsl is trying to get them fixed by 14.0-RELEASE.

A prior employer shipped a lot of systems based on Lanner and Portwell equipment:

https://www.lannerinc.com/products/network-appliances

https://portwell.com/products/ca-b.php

I’d be shocked if companies that won’t even publish their prices come close to the value of the PcEngines stuff.

No personal experience with it, but the Compulab Fitlet2/Fitlet3 looks interesting.

Reply on news.ycombinator.com