Netgate (or similar) SG-3100 overkill when I have ASUS RT-AC5300?

[Ted Danson]

I'm thinking of building a pfsense box or buying a Netgate SG-3100 to put behind my ASUS RT-AC5300 router. This is for two reasons.

First, I'm reading a lot about the built in AI Protection and user data being sent to Trend (opt-in if you enable the feature). I don't want my data processed this way.
Second, I would like a device that gives me at the very least, 400 to 500mbps+ throughput for IDS/IPS, OpenVPN and general WAN connectivity purposes.

I know the RT-AC5300 is very powerful and I don't want to lose the device in my chain if it can be helped.

Is an SG-3100 overkill? How can I successfully implement it in the chain and keep some functionality, e.g. WiFi etc.

Does anyone have any tips or a buildlist for something that would suit my needs while keeping costs and power consumption down? I don't want a great big desktop. I want something with as small a footprint as possible. The SG-1000 is ideal but not powerful enough under the hood.

Thanks!

 

[joegreat]

I know the RT-AC5300 is very powerful and I don't want to lose the device in my chain if it can be helped.

Is an SG-3100 overkill? How can I successfully implement it in the chain and keep some functionality, e.g. WiFi etc.

The Pfsense Netgaste SG-3100 devices is an "under-kill" as it has only:

CPU: ARM v7 Cortex-A9 @ 1.6 GHz with NEON SIMD and FPU
CPU: Cores 2
Memory Options: 2GB DDR4L Non ECC​

If you want decent performance in Internet filtering and VPN you need to go for an Intel CPU based device!

 

[Ted Danson]

Now THAT looks juicy. I'm interested. Seeing as the thread is from 2016 some of those parts could be a good bit cheaper too.

 

[sfx2000]

The SG3100 will be fine on the front end as the primary router - then you can use the RT-AC5300 as an AP...

@joegreat - you make a point, but consider that the Armada 38x is far more powerful than the equivalent Broadcom chips, and the ARM based pfSense is designed specifically for that board.

 

[Ted Danson]

Spotted this. Would it be a good fit (in addition to the other components on that build list linked) for what I'm looking to achieve?

https://m.aliexpress.com/item/32821689998.html?pid=808_0000_0101

Q355G4 I should add is the model I am looking at.

 

[coxhaus]

You might want to consider running Untangle as a transparent bridge behind your RT-5300 router. I would think using an PC would be a lot faster. The problem with web filtering is it adds lag. The faster the processor the less lag. Clock speed is key not cores.

There are 2 ways to setup Untangle. One way is as a router and the other as a transparent bridge behind a router.

 

[Ted Danson]

You might want to consider running Untangle as a transparent bridge behind your RT-5300 router. I would think using an PC would be a lot faster. The problem with web filtering is it adds lag. The faster the processor the less lag. Clock speed is key not cores.

There are 2 ways to setup Untangle. One way is as a router and the other as a transparent bridge behind a router.

Thanks for this. It looks OK, though I think I'd prefer to have a pfsense box running due to the masses of support available etc. I'd like to do a few things with regards smart dns and openvpn/l2tp/pptp etc and pfsense ticks all the boxes for me in that respect. As well as IDS/IPS as best as the hardware will allow while all of these things will see a throughput of at least 400mbps so I don't bottleneck my WAN throughput.

EDIT: I should add I want to keep the footprint as small as possible as I can't hide this box away anywhere so don't want some desktop sat there etc.

Do you think something like this would be enough?

https://www.aliexpress.com/item/Qot...phics-HD-Video-VGA-Pocket-PC/32799580496.html (Q355G4 No RAM/SSD)

https://www.aliexpress.com/item/Kin...k-Mini-SATA-mSATA-8-16-32-60/32832979160.html (120GB SSD)

https://www.aliexpress.com/item/Sal...066mhz-SODIMM-DDR3L-DDR3-4GB/32864111819.html (8GB RAM)

 

[coxhaus]

I had a 2.4 Xeon processor which I ran both Untangle and pfsense with snort on. I thought Untangle ran best and was the easiest to setup. I am not sure I ever got the protection part completely setup in pfsense. It was a lot of work. I gave it up by reformatting and only ran pfsense naked because it was a lot faster. But I run a router now as I liked the older pfsense versions.

Over all I do not like the lag induced by that level of scan. So any small PC device would not make me happy.