Jump to content
RESET Forums (homeservershow.com)
nguyendot

Home firewall options?

Recommended Posts

itGeeks

With all this talk about powerful CPU's such a Xeon & Core i7 to run routers, So much for low power consumption for always on devices :unsure: Hopefully if and when the new multi-threaded Snort gets released this will tame the CPU specs needed for fast internet speeds.

Share this post


Link to post
Share on other sites
Drashna Jaelre

With all this talk about powerful CPU's such a Xeon & Core i7 to run routers, So much for low power consumption for always on devices :unsure: Hopefully if and when the new multi-threaded Snort gets released this will tame the CPU specs needed for fast internet speeds.

Not necessarily.  

 

Core i7's that have a U after the 4 digit model are "ultra low power", same with "Y" 

For Xeon's, if t hey start with an L (the 1366 socket line), or end with an L, they're low power optimized. 

 

So it's possible to get the higher end CPUs with lower power consumption.  However, will it compare to Atom CPUs and the like? No. But it may be a reasonable compromise. 

  • Like 1

Share this post


Link to post
Share on other sites
snapper

 

For Xeon's, if t hey start with an L (the 1366 socket line), or end with an L, they're low power optimized. 

 

So it's possible to get the higher end CPUs with lower power consumption.  However, will it compare to Atom CPUs and the like? No. But it may be a reasonable compromise. 

 

 

I have a Skylake E3-1260L v5 in the work lab at the moment fitted to a AsRockRack E3C236D2I board with 32gb DDR4 and a 500gb Samsung EVO SSD.

Just running ESXi6 and UTM9 at the moment and 24 hour average power consumption at the wall is 28 watts.

 

Swapping the CPU to E3-1220 v5 (i.e. not L version and no HT) raised the power consumption by 5 watts for the same workload...

Share this post


Link to post
Share on other sites
snapper

I *wouldn't* call this a fair assessment, actually.  Sophos UTM is meant to be a very locked down, heavily restricted UTM device.  "Trust no one".  As others have mentioned, it's not really meant to support home use out of the box.  It's meant to LOCK DOWN EVERYTHING. 

 

 

 

When I said its a fair comparison, it was in the context of a home UTM.

It IS harder to configure, and can cause family friction due to stuff being locked until allowed.

As you point out, that is by design.

 

Having used all 3 now, if someone asked me the easiest for home use, I would suggest Untangle home licence at $50 per year as it provides good security out of the box without impeding too much on usage. 

 

Personally, I'm using UTM9 and value its locked down approach. I have even looked at getting the Sophos AC wifi access points for an all-in-one integration but the thing that stops me is that if the UTM9 vm or host goes down, wifi is lost and I would need to find a wired LAN port to fix it...

 

I'm going to look at Untangle and XG again, but thats only because I need to be able perform packet capture on the gateway. (XG & UT can do this but UTM9 cannot)

  • Like 1

Share this post


Link to post
Share on other sites
Drashna Jaelre

I have a Skylake E3-1260L v5 in the work lab at the moment fitted to a AsRockRack E3C236D2I board with 32gb DDR4 and a 500gb Samsung EVO SSD.

Just running ESXi6 and UTM9 at the moment and 24 hour average power consumption at the wall is 28 watts.

 

Swapping the CPU to E3-1220 v5 (i.e. not L version and no HT) raised the power consumption by 5 watts for the same workload...

 

I've be curious at what the consumption difference was with the 1260v5 instead. 

 

Though, this depends on the CPU usage. Haswell and Skylake CPUs are really good about energy savings when "idle" IIRC. So if you're not using a lot of CPU, then it may not matter. 

 

But that brings up the next point: if it's under heavy use all the time... I suspect that it may make a good deal of difference. 

Share this post


Link to post
Share on other sites
snapper

I've be curious at what the consumption difference was with the 1260v5 instead. 

 

Though, this depends on the CPU usage. Haswell and Skylake CPUs are really good about energy savings when "idle" IIRC. So if you're not using a lot of CPU, then it may not matter. 

 

But that brings up the next point: if it's under heavy use all the time... I suspect that it may make a good deal of difference. 

 

 

Good point.

 

UTM9 has only 2 vCPU assigned, so the box is very lightly loaded, although IIRC ESXi will schedule onto 2 pCPUs rather than 1 pCPU + 1 HT CPU, so net behaviour is the same as the 1220v5...

 

Next time I need to open the box on that machine, I'll setup a test to stress the CPUs and see what the draw is.

Suspect something like Prime95 would do the trick, but I would need to disable HT on the 1260Lv5 to make sure only 4 cores are being used.

I only have access to those CPUs, so unfortunately like-for-like isn't possible.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • JROrtiz
      By JROrtiz
      I've been banging my head for a few days now trying to figure this out and I've run out of ideas. Hoping the very intelligent crew here can help me out.
       
      I have a Drobo 5N and a Synology RS816 on my network, both of which have been working without issue for quite some time now. I've always connected to both via Windows Explorer by simply going to the network address i.e., \\N5 and \\SYN (sample names). 
       
      I recently got a new desktop which is where the issues are coming up. When I try to go to \\N5, it results in a message saying it cannot find that location. However, \\SYN works just fine. What's strange is that I can see and manage the Drobo through the Drobo Dashboard software. What could be preventing Windows from seeing the Drobo on the network? 
       
      I've already enabled the SMB 1.x protocol, ensured the workgroup names are the same, rebooted both the machine and the Drobo, made sure network sharing is enabled, and even did a fresh install to ensure that some program I installed didn't cause the issue. Every other machine I have can access the Drobo without issue. It's just this new desktop, and everything is running Windows 10.
       
      Another strange phenomenon that I discovered is that if I go to "\\DROBO" (verbatim, not a sample name) it leads me to the Synology. Where is Windows getting the mapping from that it is directing that address to the Synology?
       
      This is driving me nuts so any advice would be greatly appreciated.
    • Jason
      By Jason
      Have been running a Windows DHCP server on home WSE12R2 box for quite some time behind my Sophos UTM firewall. Also allowed me to seamlessly run Windows Deployment Services at home. WDS just worked.
       
      But if I needed to make a particular LAN IP address exception on the firewall, I had to 1.) create a Windows DHCP server reservations AND 2.) create a network definition for that IP on the Sophos UTM box. 2 steps. Not very efficient; was sure I was doing something incorrectly...
       
      Tried to migrate to Sophos UTM running the DHCP Server, but now WDS doesn't work. LAN devices can no longer PXE boot. Seems possible. Many guides. None have proven especially successful.
       
      Is it possible to run a Windows DHCP server and have Sophos UTM import DHCP reservations instead of maintaining 2 unique entries for each IP reservation (one in Windows DHCP, another on Sophos UTM box)?
       
      What is best practice?
       
       
      Sent from my iPhone using Tapatalk
    • donschmidt
      By donschmidt
      Good morning.  I've just  purchased a home still under construction and plan to have CAT6 installed throughout the living areas. I'm hoping that someone can advise me as to the specific quality/specs of cable that I should use.
      Thanks and Happy New Year.
    • Joe_Miner
      By Joe_Miner
      I've been looking at the Intel Compute Stick BOXSTK1AW32SC and was wondering if anyone here has experience with that and if the Intel AC 7265 built into it is backwardly compatible with older N and A,B wifi?
    • heavy21
      By heavy21
      I want to optimize the performance and security of my home network of servers, PCs, laptops printers, smartphones, TVs, etc.  Current network appliances include layer 2 and 3 switches (Cisco small business) and Linksys router.  I’m looking to replace the Linksys with a security (pfSense) router appliance (w/OpenVPN).  I will also be adding security cameras and a NVR to the network.
       
      The gigabit network is straightforward in structure with all Ethernet connections hanging off the24 port switch connected to the cable modem and router except a cascaded 8 port switch in a room to provide 4 Ethernet connections in a room with only one data port.  Wireless connections presently come off the Linksys but will eventually come off the to-be-purchased security/router appliance with a wireless card.  I don’t see more than 100 devices in total for the whole network.  No VLANS and no sub-netting.  All hardware supports IPv6.
       
      Hardware line up is:
      Dual Zeon server w/RAID 10 of 24 TB of storage, 64GB memory
      Cisco managed switches layer 2 and 3
      HPEX495 server
      Workstations, Desktops, Laptops, Tablets, iPads
      Printers
       
      Software line up is:
      Windows Server Essentials 2012 R2, single domain controller, storage and file server duties
      Windows 10 Pro all non-server Intel computing devices
      PLEX server for streaming audio and video to display units
      Office 365
       
      From what I’ve read so far, it appears that I need to incorporate an IP addressing scheme for clients and servers on the network.  It would also appear that I need to implement VLANS and/or sub-netting to protect access to certain files and security footage, provide guest networking with future consideration for electronic door locks and some sort of server based media distribution to various display devices,
      What are best practices on assigning client and server devices to IP ranges, fixed or dynamic IP addresses?  Do I need to assign clients or servers to IP ranges?  What are the considerations in establishing sub-nets over VLANS or vice versa?  I’m pretty sure I want to restrict access to cameras and their security footage and personal files on my workstation.
       
      Thanks for any resources and advice provided.
       


×
×
  • Create New...