Router recommendation need.

[zMaliz]

Hi,
By the end of the week I should be on a fibre 900 package so I'm trying to work out what to do re my router.
Currently I'm running Opnsense and it does work very well but I'm not sure if the hardware will support the new connection. My plan is to test it but also have a backup in case my current server isn't capable.

My options are to buy a new server for opnsense or get a router.
My requirements are:
Support Full Fibre - FTTP 1800/120 to allow for future upgrade (PPPOE)
Port forwarding based on specific external IP addresses
IPsec VPN and restrict which Lan devices have access
Wireguard VPN and restrict which Lan devices have access
All the usual DHCP, NAT etc.

Has anyone any suggestions for this ?

Thanks

 

[Tech9]

Has anyone any suggestions for this ?

Upgrade your OPNsense appliance.

 

[zMaliz]

Upgrade your OPNsense appliance.

Thanks. I'm looking at an N100 based server but there are so many options, and I've no idea which are any good !

 

[Tech9]

You never mentioned what you currently have so I have no idea what is going to be an upgrade for you.

 

[zMaliz]

The server I have now is running an AMD GA420CA CPU with 8gb ram and 128 m2 SSD.
Running Opnsense and connecting via PPPOE to an 80/20 FTTP connection , when I speed test CPU usage is approx 3%
Thanks

 

[Tech9]

It will work just fine with your new ISP plan. Upgrade when you need >Gigabit.

 

[zMaliz]

Thanks. I'm hoping so, as it will make things easier.

 

[Tech9]

The CPU in your mini PC may be old, but perhaps still better than the CPU found in many home routers.

 

[zMaliz]

My concern is Opnsense / BSD uses a single core for PPPOE, I'm sure if this CPU will have enough power to cope.

 

[ddaenen1]

Honestly, i would also do what @Tech9 is proposing. First see how far you get with the current hardware. As it is easy to transfer your config from your current box to another box with newer hardware. I did the same about 6 months ago when i went from a Xeon E3-1270v2 to a Xeon D-1521. Didn't do it because the E3 wasn't fast enough anymore but i wanted less power-hungry and an enclosure with front I/O which wasn't possible with a mATX board, at least not with the Supermicro 1U rack options.

 

[Tech9]

Not sure why we have second thread with exactly the same question over exactly the same concern before even trying if the existing hardware is good enough or not. Otherwise I don't mind someone else spending money for nothing.

 

[zMaliz]

Going live at the end of the week with the existing kit. Will be interesting to see what happens Thanks

 

[Tech9]

You never mentioned what ISP device this fibre 900 package comes with. If it comes with ISP provided Gateway - it can do the PPPoE connection and your hardware behind it can manage your own network just like before.

 

[zMaliz]

You never mentioned what ISP device this fibre 900 package comes with. If it comes with ISP provided Gateway - it can do the PPPoE connection and your hardware behind it can manage your own network just like before.

Must admit I hadn't thought of this.
The ISP router has a DMZ, would I connect my opnsense box to that, and then set all the clients default gateway as the opnsense box ?
Any issues with double NAT etc ?

Any idea how the WAN would need to be configured in opnsense ?

Thanks

 

[Tech9]

Any idea how the WAN would need to be configured in opnsense ?

You just have to allow private IPs on the WAN side in settings.

Any issues with double NAT etc ?

This depends on use case, but no issues are expected in general.

 

[zMaliz]

Thanks. FTTP went live today using the ISP router.
I plan on testing my existing box tomorrow

 

[sfx2000]

Thanks. I'm looking at an N100 based server but there are so many options, and I've no idea which are any good !

N100 might not do...

 

[zMaliz]

N100 might not do...

Why ? Most people are recommending it for a 1GB circuit. Thanks

 

[zMaliz]

Using the ISP router I'm getting 940/110.
When I use my opnsense server I get 600/110 approx.

When I run a speedtest top shows the following. So it looks like PPPOE is using one core.

Would an N100 be able to cope with this ?
Thanks

 

[Tech9]

If nothing on your network requires UPnP - double NAT your appliance and test again. It will split the workload between the two devices you already have and you may not need to replace anything. PPPoE is single threaded. N100 is much faster CPU and won’t have issues with this speed, but may not be needed.