Fanless Intel J4125 4x i225 Virtualized Firewall Appliance Review

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

ReturnedSword

Active Member
Jun 15, 2018
526
235
43
Santa Monica, CA

cfl246tho

New Member
Apr 29, 2022
1
0
1
I just bought the newer N6005 barebones.

It cost $277 before tax, about $300 after tax. With coupons, a few bucks less.

In terms of hardware, a N6005 isn’t much faster than the older J4125, but it has dual channel memory, and the main storage slot switches to NVMe M.2 2280 (PCIe 3.0 x2).

There is an in-between processor designated Celeron N5105. It and the "Pentium Silver" N6005 were released by Intel Q1/'21 and have nearly identical specs, including 10nm die size.

The Celeron J4125 was released Q4/'19 and is based on the older 14nm die size.

The N6005 has a faster burst clock speed for both the CPU and the GPU. O/w N5105 and N6005 look nearly the same.

All three- the J4125, N5105 and N6005- have 2GHz base clock speeds and 10W TDPs.

Prices of mini-PC boxes with these processors are incremented very roughly by $70. I think it's worth considering the newer N5105 and N6005 silicon. And I think the N5105 is the better deal, saving maybe $70 with nearly the same specs.
If you poke around on AliExpress (and probably other China based sellers), you'll find nearly identical looking boxes for each processor AND with 2xDDR4 slots and some with 1xDDR4 slot (and yes, apparently also the i225 NICs). That is, you don't HAVE to pick an N6005 to find 2xDDR4. There are some 2xDDR4 boxes with the J4125. You just have to muddle your way thru the confusingly long list of items available. It's hard to be sure the i225 NICs are the B3 stepping. Those Chinese sites can be very confusing.

Oh, and many/most seem to say the aluminum cases come in both black and "brushed aluminum" (silver), but seller ships the different colors randomly?
 

Roelf Zomerman

Active Member
Jan 10, 2019
147
27
28
blog.azureinfra.com
bought a couple and got them in today.. first things first.. install Windows Server 2022.. found out that the NIC's are not installing automatically, nor via Windows Update.. the trick is to download the Intel PRO set (LAN-Win10_Win11-1.0.2.14) and then manually add the driver for the NIC's by providing your own driver, then NIC and then selecting the I225-LM driver.. and voila 4x 2.5Gb

for the screen, download the Intel Gemini drivers (igfx_win_101.1660)

so, you can also run Hyper-V (core) or native Windows Server on it.. (although I get a feeling most people on this site are not really pro MS)
 

djtech2k

New Member
May 18, 2022
10
3
3
I have been looking for a pfSense device like this. I am looking at New Firewall Router Jasper Lake Pentium N6005 4 Intel i225V 2500M Nics NVMe 2*DDR4 Mini PC HDMI2.0 pfSense OPNsense VyOS AES NI| | - AliExpress
and
Industrial Fanless Soft Router Intel i5 8260U i3 8140U 6x 2.5GbE i225 LAN Mini PC AES NI 4*USB Rs232 pfSense Firewall Appliance| | - AliExpress.

I'd rather order domestic and get faster shipping but the options do not seem to be there. Any thoughts on the comparison between the 4 port with N6005 CPU vs the 6 port with i3 8140U CPU? I am looking build something that will be fast and reliable. I have a house with a lot of devices and I think my current setup doesn't always keep up with the traffic on my 1Gbps connection.
 

ReturnedSword

Active Member
Jun 15, 2018
526
235
43
Santa Monica, CA
I have been looking for a pfSense device like this. I am looking at New Firewall Router Jasper Lake Pentium N6005 4 Intel i225V 2500M Nics NVMe 2*DDR4 Mini PC HDMI2.0 pfSense OPNsense VyOS AES NI| | - AliExpress
and
Industrial Fanless Soft Router Intel i5 8260U i3 8140U 6x 2.5GbE i225 LAN Mini PC AES NI 4*USB Rs232 pfSense Firewall Appliance| | - AliExpress.

I'd rather order domestic and get faster shipping but the options do not seem to be there. Any thoughts on the comparison between the 4 port with N6005 CPU vs the 6 port with i3 8140U CPU? I am looking build something that will be fast and reliable. I have a house with a lot of devices and I think my current setup doesn't always keep up with the traffic on my 1Gbps connection.
What is your current setup? My Topton N6005 finally shipped, so waiting for arrival so I can test it out.

I’d suspect the N6005 would be more than plenty, though the 8260U box is only a “little” more cost. It uses i210 1 Gbps NICs though vs i225 2.5 Gbps.

I prefer to use physical NICs on the router vs VLANs on a switch, though I might change to VLANs on a switch once I upgrade to 10 Gbps. 4 NICs is plenty already for me (WAN, LAN, WiFi, IoT). I haven’t envisaged a scenario where I would require 6 NICs, though that would be useful if there were multiple WAN ingress.

Topton also posted up a new appliance that uses a i7-1165G7 that would be a bit faster than the 8260U, and it has 6x i225 NICs. It also costs quite a lot more though.

 

djtech2k

New Member
May 18, 2022
10
3
3
I have been using an ASUS AC-68U with a custom firmware for a long time. It has a lot of capability and has worked very well. Sometimes I just think that it could be bottlenecking me as I have a 1Gb connection but I never get close to that on any speed tests. I know that’s not scientific proof but it’s another reason why I want to upgrade. I want to enhance and get more current security as well so it’s just more reason. I am also planning to separate WiFi by using pfsense and a separate AP. Thinking Ubiquiti for AP’s but have no experience with those.

I could make a 4 port work and just get another switch to use with it. So the 6 ports are not a hard requirement but I figured I’d look at it if the cost was close. If I get a device like this, I plan to add the ram and ssd myself. I will trust those brands more if I do it. I have looked at the NetGate and Protectli devices and would consider those too but they are pricey and the specs are pretty low. When looking at all these device options, the cpu is the one that I wonder the most about. Benchmark scores are one thing but the age and the corresponding chipset capabilities are a whole other thing. From the j4125, n6005, 8140u, 8260u, and so on, it’s hard to make sense out of picking one.


That one seems to have 6 ports and the i225 chipset but it only offers the i3 or i5 and not the n6005. Not sure how those 3 CPU’s would compare for this use case and if they would all work well in a fanless scenario.
 

ReturnedSword

Active Member
Jun 15, 2018
526
235
43
Santa Monica, CA
I have been using an ASUS AC-68U with a custom firmware for a long time. It has a lot of capability and has worked very well. Sometimes I just think that it could be bottlenecking me as I have a 1Gb connection but I never get close to that on any speed tests. I know that’s not scientific proof but it’s another reason why I want to upgrade. I want to enhance and get more current security as well so it’s just more reason. I am also planning to separate WiFi by using pfsense and a separate AP. Thinking Ubiquiti for AP’s but have no experience with those.

I could make a 4 port work and just get another switch to use with it. So the 6 ports are not a hard requirement but I figured I’d look at it if the cost was close. If I get a device like this, I plan to add the ram and ssd myself. I will trust those brands more if I do it. I have looked at the NetGate and Protectli devices and would consider those too but they are pricey and the specs are pretty low. When looking at all these device options, the cpu is the one that I wonder the most about. Benchmark scores are one thing but the age and the corresponding chipset capabilities are a whole other thing. From the j4125, n6005, 8140u, 8260u, and so on, it’s hard to make sense out of picking one.


That one seems to have 6 ports and the i225 chipset but it only offers the i3 or i5 and not the n6005. Not sure how those 3 CPU’s would compare for this use case and if they would all work well in a fanless scenario.
It would likely be very difficult to bottleneck a RT-AC68U on ethernet. I run 3 in AiMesh for my APs, though the main node has been set back to router mode while I wait for my new Topton appliance to arrive (my Jetway N2930 appliance died suddenly after serving me for years). Are the majority of your devices on WiFi? That can be the problem, as the RT-AC68U is a "gen1" 802.11ac router. It doesn't even have MU-MIMO, beam forming, or band steering, and the WiFi disconnect handling isn't that great. Actually mine were T-Mobile TM-AC1900 units that I got for very cheap brand new and re-flashed to stock RT-AC68U. In my home, I've been resistant to installing ceiling/wall-mount APs. Kinda hoping there will be a desktop style mesh unit that supports VLAN tagging, but that's probably not going to happen anytime soon in the consumer space.

A bit of anecdotal observation:

My old Jetway appliance with the N2930 CPU has a PassMark of 1,003, and it had no issue running fairly flat network segmented into 3 subnets, along with full IDS/IPS stack via pfSense plugins. The point where it struggles is for VPN throughput, as the CPU clock speed is quite low, and that generation of Atom wasn't that efficient in terms of IPC. The Topton N6005 appliance I'm expecting (same one you linked up there) has a PassMark of 4,662 and much higher clock speed, along with much better IPC. I was trying to wait out for the "next gen" Atom based on Gracemont (Alder Lake-N), however, Tremont was "released" almost 3 years now I think, and finally the CPUs are available in the form of Jasper Lake (which itself was released last year) outside of Intel Snow Ridge (for 5G/communications edge, and even that was delayed). So I'm not holding my breath for Gracemont Atoms anymore.

i3-8140U has similar PassMark as the N6005, though half the cores. i5-8260U is quite a bit faster, almost 2x on PassMark, and should be overkill for most homelab environments. Ofc we always want more, and the i7-1165G7 has a PassMark of 10,558 and and the Topton appliance has i225V NICs, which support 2.5 Gbps. As I and others discussed in my router/firewall thread though, I think at that point, it may be worth it to roll my own router appliance with a used TMM node and a fiber 10 Gbps NIC, with a managed switch doing the VLANs.
 

djtech2k

New Member
May 18, 2022
10
3
3
My network has a lot of wifi of course but it also has a bit of ethernet/LAN as well. I have multiple switches throughout my house in effort to connect all of the ethernet drops throughout the house. As I mentioned, I fear that some of the drops are not great connections and do not get good speeds, but again that's another story for another day. That will probably be my "next" project after I upgrade my network gear.

I actually use my provider's modem/router device and then have my AC-68U sitting inside of that, so I guess that would be a double-NAT situation. I have an even older/smaller Asus on the other 2 levels that are connected to ethernet and function as an AP. I know they are slower on wifi as well as 100mb ports. I just put them there for to offer an option if the signal from the AC-68U was too weak on the top level. They also do have 4 or 6 ports, so they do function as small switches as well.

In the past, I have done all kinds of speed tests trying to find the bottleneck but its always been inconsistent. I have gotten better speeds by going directly to the modem/router, which makes sense but I would think the other speeds would be close and sometimes they are not. So my goal with this is to increase wifi speed, increase wifi range (if possible), increase the throughput of my router (removing any possible bottlenecks), and maintain or increase security posture. I think pfSense will do that for me so I just need to find a good device that will be more than capable of performing well and will last a long time. I think I have been using my AC-68U for over 8 years now. The custom firmware provides a lot of functionality and it works. I do wish the version upgrades were a little easier, but otherwise its been fantastic.

I am definitely interested to see how the Topton device performs. At this point, the Topton's seem to be the best value I can find. I'd rather go with a more commercially supported device like NetGate or Protectli but like I said, the prices are a bit crazy and the hardware specs are much lower. I did notice that the i3 and the N6005 CPU's have a similar performance score. The i5 is definitely higher. I'd like to have 6 ports but like I said, I can work around that if I need to. Out of the i3, i5, and N6005, would you just rate them by benchmark score? I worry about the age because of chipset/pin config as well as heat since they're fanless. How would you rank those?
 

ReturnedSword

Active Member
Jun 15, 2018
526
235
43
Santa Monica, CA
My network has a lot of wifi of course but it also has a bit of ethernet/LAN as well. I have multiple switches throughout my house in effort to connect all of the ethernet drops throughout the house. As I mentioned, I fear that some of the drops are not great connections and do not get good speeds, but again that's another story for another day. That will probably be my "next" project after I upgrade my network gear.

I actually use my provider's modem/router device and then have my AC-68U sitting inside of that, so I guess that would be a double-NAT situation. I have an even older/smaller Asus on the other 2 levels that are connected to ethernet and function as an AP. I know they are slower on wifi as well as 100mb ports. I just put them there for to offer an option if the signal from the AC-68U was too weak on the top level. They also do have 4 or 6 ports, so they do function as small switches as well.
This may be the root cause of your problem. Most apps and services use pinhole port punching nowadays with no user intervention so double NAT shouldn't pose an issue except where port forwards are required. If it were me, I'd first resolve the physical Ethernet drops to ensure the drops are terminated correctly (and thus are capable of running at the full speed of the cable spec/your equipment). Secondly, your WiFi units will perform worse if there's mix-and-matching going on, even with the same brand. My guess is your lower spec ASUS routers are RT-N10/RT-N12 or something like that. These are pretty crappy and aside from low WiFi performance, they shouldn't have an issue running at 100 Mbps as a "switch" though.

In the past, I have done all kinds of speed tests trying to find the bottleneck but its always been inconsistent. I have gotten better speeds by going directly to the modem/router, which makes sense but I would think the other speeds would be close and sometimes they are not. So my goal with this is to increase wifi speed, increase wifi range (if possible), increase the throughput of my router (removing any possible bottlenecks), and maintain or increase security posture. I think pfSense will do that for me so I just need to find a good device that will be more than capable of performing well and will last a long time. I think I have been using my AC-68U for over 8 years now. The custom firmware provides a lot of functionality and it works. I do wish the version upgrades were a little easier, but otherwise its been fantastic.
As mentioned, even the old RT-AC68U shouldn't have an issue even with 1 Gbps ISP ingress. If your ISP equipment has a bridge mode I'd definitely use that to remove any double NAT situation however, or at least enable IP pass through mode, which is sort of like a fake bridge mode. Running your own router in the form of pfSense would not solve any drop termination issues though if that is causing the bad hardwired link speeds.

I am definitely interested to see how the Topton device performs. At this point, the Topton's seem to be the best value I can find. I'd rather go with a more commercially supported device like NetGate or Protectli but like I said, the prices are a bit crazy and the hardware specs are much lower. I did notice that the i3 and the N6005 CPU's have a similar performance score. The i5 is definitely higher. I'd like to have 6 ports but like I said, I can work around that if I need to. Out of the i3, i5, and N6005, would you just rate them by benchmark score? I worry about the age because of chipset/pin config as well as heat since they're fanless. How would you rank those?
NetGate doesn't manufacture any of its own equipment. They purchase from an ODM. I can't recall which NetGate appliance atm, but I remember the ODM version of a few models was floating around on Aliexpress a while back. Protectli/Qotom similarly also purchase and resell from ODMs based in Shenzhen. The convenience factor of Protectli/Qotom is that they have stock available on Amazon to get it faster than waiting for something to get shipped from Shenzhen/China. That's where the premium cost lies. Protectli/Qotom also have direct stores on Aliexpress where the price is slightly cheaper if you’re willing to wait for the appliance to be shipped from China. My suggestion is to compare the front/back ports and specs of different appliances, you may find a cheaper one from another rebrand store. Btw, Topton, KingNovy, etc are also rebrands; they also purchase the barebone board from the ODM and the chassis from another ODM. Many times you’ll be able to find appliances that use a different chassis but can be almost certain the board inside is the same by cross checking the ports and specs.

As I mentioned before, my dead appliance had a N2930 which has a very low PassMark score, and using pre-i210 NICs, but even that was overkill for my network. I imagine the N5095/N5105 variants of the Topton box would be more than sufficient as those CPUs aren’t much slower than the N6005. In terms of heat, all these CPUs are 15W class (the Core models) and can be passively cooled no problem. The Jasper Lake Atom ones are sub-10W so even lower power usage. When I get my Topton I’ll see if I can repaste the CPU though with higher quality thermal paste just to make sure it’s making good contact with the chassis. The i5/i7 appliances are probably very overkill for your network, which appears to be quite simple/flat compared to my network (and my network is already flat).
 

Patrick

Administrator
Staff member
Dec 21, 2010
12,513
5,802
113
I know that the newer Netgate appliances are made by a publicly-traded company that we have reviewed products for before.

I also wish I knew the OEM for the N5105 boards.
 

djtech2k

New Member
May 18, 2022
10
3
3
This may be the root cause of your problem. Most apps and services use pinhole port punching nowadays with no user intervention so double NAT shouldn't pose an issue except where port forwards are required. If it were me, I'd first resolve the physical Ethernet drops to ensure the drops are terminated correctly (and thus are capable of running at the full speed of the cable spec/your equipment). Secondly, your WiFi units will perform worse if there's mix-and-matching going on, even with the same brand. My guess is your lower spec ASUS routers are RT-N10/RT-N12 or something like that. These are pretty crappy and aside from low WiFi performance, they shouldn't have an issue running at 100 Mbps as a "switch" though.



As mentioned, even the old RT-AC68U shouldn't have an issue even with 1 Gbps ISP ingress. If your ISP equipment has a bridge mode I'd definitely use that to remove any double NAT situation however, or at least enable IP pass through mode, which is sort of like a fake bridge mode. Running your own router in the form of pfSense would not solve any drop termination issues though if that is causing the bad hardwired link speeds.



NetGate doesn't manufacture any of its own equipment. They purchase from an ODM. I can't recall which NetGate appliance atm, but I remember the ODM version of a few models was floating around on Aliexpress a while back. Protectli/Qotom similarly also purchase and resell from ODMs based in Shenzhen. The convenience factor of Protectli/Qotom is that they have stock available on Amazon to get it faster than waiting for something to get shipped from Shenzhen/China. That's where the premium cost lies. Protectli/Qotom also have direct stores on Aliexpress where the price is slightly cheaper if you’re willing to wait for the appliance to be shipped from China. My suggestion is to compare the front/back ports and specs of different appliances, you may find a cheaper one from another rebrand store. Btw, Topton, KingNovy, etc are also rebrands; they also purchase the barebone board from the ODM and the chassis from another ODM. Many times you’ll be able to find appliances that use a different chassis but can be almost certain the board inside is the same by cross checking the ports and specs.

As I mentioned before, my dead appliance had a N2930 which has a very low PassMark score, and using pre-i210 NICs, but even that was overkill for my network. I imagine the N5095/N5105 variants of the Topton box would be more than sufficient as those CPUs aren’t much slower than the N6005. In terms of heat, all these CPUs are 15W class (the Core models) and can be passively cooled no problem. The Jasper Lake Atom ones are sub-10W so even lower power usage. When I get my Topton I’ll see if I can repaste the CPU though with higher quality thermal paste just to make sure it’s making good contact with the chassis. The i5/i7 appliances are probably very overkill for your network, which appears to be quite simple/flat compared to my network (and my network is already flat).
I am definitely interested to hear your experience with that N6005 device and how it performs. At this point, that is probably the one I am looking at the most. As I said, I would prefer to get something more commercially supportable or domestic, but that does not seem to be in the cards. The price on some of those devices like the Netgate's are very high for their hardware specs.

As for my network, I know that all of my stuff is now old and a bit thrown together. It has served its purpose for years and still works fairly well. I do think its time to "upgrade and modernize". So that's why I am looking at pfSense and a new Wifi solution, like Ubiquiti. I can do all of that myself whereas I would need to get a cabling person to come test/fix the cable runs in my house. I will do it and I know it could be the culprit behind the speeds I think are too slow, but I will probably do that after I upgrade my equipment. I can buy and install the equipment anytime I want versus trying to find a cable person to do a proper test/fix my cabling.
 

djtech2k

New Member
May 18, 2022
10
3
3
This may be the root cause of your problem. Most apps and services use pinhole port punching nowadays with no user intervention so double NAT shouldn't pose an issue except where port forwards are required. If it were me, I'd first resolve the physical Ethernet drops to ensure the drops are terminated correctly (and thus are capable of running at the full speed of the cable spec/your equipment). Secondly, your WiFi units will perform worse if there's mix-and-matching going on, even with the same brand. My guess is your lower spec ASUS routers are RT-N10/RT-N12 or something like that. These are pretty crappy and aside from low WiFi performance, they shouldn't have an issue running at 100 Mbps as a "switch" though.



As mentioned, even the old RT-AC68U shouldn't have an issue even with 1 Gbps ISP ingress. If your ISP equipment has a bridge mode I'd definitely use that to remove any double NAT situation however, or at least enable IP pass through mode, which is sort of like a fake bridge mode. Running your own router in the form of pfSense would not solve any drop termination issues though if that is causing the bad hardwired link speeds.



NetGate doesn't manufacture any of its own equipment. They purchase from an ODM. I can't recall which NetGate appliance atm, but I remember the ODM version of a few models was floating around on Aliexpress a while back. Protectli/Qotom similarly also purchase and resell from ODMs based in Shenzhen. The convenience factor of Protectli/Qotom is that they have stock available on Amazon to get it faster than waiting for something to get shipped from Shenzhen/China. That's where the premium cost lies. Protectli/Qotom also have direct stores on Aliexpress where the price is slightly cheaper if you’re willing to wait for the appliance to be shipped from China. My suggestion is to compare the front/back ports and specs of different appliances, you may find a cheaper one from another rebrand store. Btw, Topton, KingNovy, etc are also rebrands; they also purchase the barebone board from the ODM and the chassis from another ODM. Many times you’ll be able to find appliances that use a different chassis but can be almost certain the board inside is the same by cross checking the ports and specs.

As I mentioned before, my dead appliance had a N2930 which has a very low PassMark score, and using pre-i210 NICs, but even that was overkill for my network. I imagine the N5095/N5105 variants of the Topton box would be more than sufficient as those CPUs aren’t much slower than the N6005. In terms of heat, all these CPUs are 15W class (the Core models) and can be passively cooled no problem. The Jasper Lake Atom ones are sub-10W so even lower power usage. When I get my Topton I’ll see if I can repaste the CPU though with higher quality thermal paste just to make sure it’s making good contact with the chassis. The i5/i7 appliances are probably very overkill for your network, which appears to be quite simple/flat compared to my network (and my network is already flat).
Just curious if you have setup your device and/or tested it yet.