AIAIO: Our Blog

I’ve wanted to replace our office firewall for awhile now. I currently use a manually maintained bash script to manage iptables. It’s worked fine for me for a few years, but it gets tedious.

In addition, the firewall is an old desktop (from around 2001) running CentOS 4. It’s certainly been powerful enough for our needs, but its big and bulky, and uses more energy than it needs to.

I needed to know what software I was going to run before investing in any new hardware. I found a list of firewall distributions and picked out Vyatta. Once I chose my software, I started looking at hardware.

Since I wanted to make the new firewall as energy efficient as possible, my choice from the beginning was an Atom based system. The trick was finding the right combination of parts to get the 4 NICs that I wanted to fit into a more reasonably sized case.

I began looking for mini ITX rack mount cases. It would be a nice change from the old desktop sitting next to the rack now. But they were so expensive. After seeing how small the compact cases were (smaller than the cisco router hooked up to our T1), I decided that I’d save some money, and get a small case that’s wall mountable.

In the end, I settled on the following parts list:

• Jetway JNC92-N330 – $110
• AD3RTLANG – Jetway 3 x Gigabit LAN Daughter board – $48
• picoPSU-150-XT + 102W Adapter Power Kit – $70
• M350 Universal Mini-ITX enclosure – $40
• 8GB 40 pin Embedded Disk Card 4000 – $89
• 2GB DDR2 Memory – $28

For a total (minus tax and shipping) of $385. Depending on what you want to install on the firewall, you may be able to save some money by getting a smaller flash card. I believe Vyatta, for example, would be fine with a 2 gig flash card.

It’s a dual core Intel Atom based system. Many of the Jetway motherboards support daughter boards. I needed one of those so I can use their 3 NIC add on board.

The picoPSU power supply is very cool. They’re very small and efficient (the one I got is up to 96%.) I was shocked at the size, actually. They plug directly into the motherboard’s ATX power supply socket, and eliminate the need to have dedicated space for a DC-DC ATX board inside the case.

I am a little worried about having Realtek NICs. I may need to set up a build environment for Vyatta, and compile the drivers for them. You should definitely research whether the NICs are supported in your distribution of choice before investing in the same parts I did.

I’m not afraid of a little bit of work. Since I know that there are linux drivers for the NICs I’m getting, I know I can get them to work with Vyatta (eventually) if they don’t work out of the box.

The parts should be here within a week, and then I’ll be able to see if they all play nice together.