Fujitsu Futro S920 Thin Client as opnsense firewall

frauhottelmann

New Member
Dec 11, 2020
4
9
3
Build’s Name: My Router ;)
Operating System: opnsense
System: Fujitsu Futro S920
CPU: AMD G Series GX-415GA (1,5 GHz Quad Core)
Drives: 64 GB M-Sata SSD
RAM: 2x2 GB
Add-in Cards: Fujitsu D3045-A11 GS1 Quad Port Nic (Intel i350-T4) va PCIE riser
Power Supply: 40 W

Usage Profile: Firewall

Other information:

I thought I'd write something about the Fujitsu Futro S920. The other favourite thin client HP T620 Plus hasn't been very available in Germany. So I had to look for something else instead. I did have an Edgerouter X with OpenWrt in use before, but I wanted something more.

This has the same CPU as the T620 Plus, just with 1.5 GHz instead of 2.0. It is the GX-415GA. These also came with either the dual core GX-222GC or the more powerful GX-424CC quad core with 2.4 GHz. The GX-415GA seems to be the most common though.

Opnsense installations is straight forward.

1) Exterior

It is a nice little box (52 mm x 195 mm x 250 mm / 2,05 inch x 7,68 inch x 9,84 inch without the feet).
IMG_20201202_215945.jpgIMG_20201202_215934.jpg
You get two USB 3.0 and audio ports on the front (there is an option for a smart card reader). As usual with these corporate boxes there is a multitude of port options on the back. The Ethernet port blank next to the 4 port nic is for the PoE option. Mine came with the feet, but you don't need them. They can be mounted for vertical or horizontal use.

2) Interior
cpu.jpg
The CPU is passively cooled (in my case it hovers around 50° C / 122 ° F in a small cupboard).

ram.jpg
There are two DDR3 SO-DIMM slots. These come in a variety of configurations. Mine came with 2 GB and I added another 2 GB.

msata.jpg
For storage there is a M-SATA slot. Mine came with 2 GB and eLinux which is probably very common as these have been used to display RDP sessions. There are versions with Windows though. I upgraded to 64 GB just because it was the best price to storage ratio at the bottom of the price range.

sata.jpgsata power.jpg
There is also a SATA port, but it is in the most unusual place on the motherboard :D There is no way to mount a drive though. There is a system extension component holder, but I am not sure if there is room for a SATA drive. The component holder is used for the smart card reader and the speaker (yes, you can add an additional speaker :D ). I also don't know the pin out of the SATA power port.

mpcie.jpg
Between the CPU and the PCIE slot is a Mini PCIE slot. One could add a wifi card here or one of those obscure ethernet adapters. Some of the models do come with a wifi card.

pcie bay.jpg
Unfortunately I got the version without a PCIE riser. There is a separate extension available (part number
C26361-K528-C16). So I added another riser. Some of these can come with a PoE add in card (plugs into the pins above the PCIE slot) or even a AMD graphics card (in this case congratulations, you got the riser for free).

riser.jpgtoo long.jpg 293px
The Delock 16x riser is the correct hight (they call it 1U) but it is too long. I had to cut it down a bit :D

3) The Bill (everything with shipping)

Futro S92032€ (I was very lucky, the usually go for about 70€ plus shipping)
2 GB RAM5 €
64 GB SSD19.79 €
Delock Riser Card11 €
Fujitsu Quad Port Nic30 €
Overall97.79 €
 

frauhottelmann

New Member
Dec 11, 2020
4
9
3
Nice build, @frauhottelmann ! :)
I was wondering that the DeLock Riser fits without any problems.
The original Fujitsu riser looks like a bit heigher.

I ordered a Kalea-riser (https://www.amazon.de/gp/product/B018KEM1GI/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1) - i hope the riser will fit.

How's the performance with active IPS / DPI ?
Hi @h0schi,
the height of the riser is perfect, but it was too long :D The one you ordered looks good. I am not doing any IPS/DPI right now. I can test if you like, but I need some pointers on how to test it. I am not dowing anything special and I can saturate my 500 MBit down link.
 

frauhottelmann

New Member
Dec 11, 2020
4
9
3
It's difficult to say. I don't really have a reliable benchmark endpoint to test my Download speeds. I have a 500/25 connection via cable modem (in bridge mode).

EDIT: I'll probably redo these test with a better speestest server.
EDIT: I reran all the test with nperf.com against the 10GBit-Vodafone-Berlin-IPV6 server. Speed is taking big hit with IPS!

DownUpUpdated
No shaping or anything491,824,15yes
With shaping484,924,15yes
Disabled Hardware Offload (no shaping)491,524,77yes
Just Intrusion Detection (no shaping)473,625,00yes
Intrusion Detection with IPS (disabled hardware offload, no shaping)241,024,87yes
 
Last edited:
  • Like
Reactions: h0schi

h0schi

New Member
Oct 24, 2020
29
12
3
Germany
I knew that IPS is hungry, but 50 % of the whole bandwight is heavy :oops:
How high was the CPU-load during these tests ?

I also ordered a HP T620, this thin-client got a 500 Mhz faster CPU (AMD GX-420CA), but the results should be similar to your benchmark.

Thx for your tests.
If you bechmark it again, please let me know :)
 

frauhottelmann

New Member
Dec 11, 2020
4
9
3
I knew that IPS is hungry, but 50 % of the whole bandwight is heavy :oops:
How high was the CPU-load during these tests ?

I also ordered a HP T620, this thin-client got a 500 Mhz faster CPU (AMD GX-420CA), but the results should be similar to your benchmark.

Thx for your tests.
If you bechmark it again, please let me know :)
I have updated the numbers again.

Yours should run faster with all four cores running at higher speeds. But damn IPS ist hitting it hard
But I can't complain. The price was so low
 
  • Like
Reactions: h0schi

h0schi

New Member
Oct 24, 2020
29
12
3
Germany
The results are better now :)
This thin clients with AMD GX-CPU / platforms are very efficient and cheap.
I will change to OPNsense and will leave the Unifi-universe.

I can not understand how a Unifi UDM-Pro with a Quad ARM Cortex-A57 (1.7 GHz) CPU can handle an IPS-throughput of 3,5 GB/s ?! :D
This appliance seems to be running a modified suricata IPS-engine.
 

newabc

Active Member
Jan 20, 2019
256
100
43
I can not understand how a Unifi UDM-Pro with a Quad ARM Cortex-A57 (1.7 GHz) CPU can handle an IPS-throughput of 3,5 GB/s ?! :D
This appliance seems to be running a modified suricata IPS-engine.
Its spec sheet said it was tested by iperf(v2? v3?), so each time the machine faces a same traffic pattern which triggers a same rule from a single direction.
 

newabc

Active Member
Jan 20, 2019
256
100
43
I knew it is hard to get something with low price like 2nd-handed Wyse 5070 extended or HP T730 in Europe.
Or the Qotom boxes from aliexpress? (The Qotom barebones usually cost totally around $200 with shipping to US.)
 

Goossens

New Member
May 2, 2020
12
5
3
Nice build, @frauhottelmann ! :)
I was wondering that the DeLock Riser fits without any problems.
The original Fujitsu riser looks like a bit heigher.

I ordered a Kalea-riser (https://www.amazon.de/gp/product/B018KEM1GI/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1) - i hope the riser will fit.

How's the performance with active IPS / DPI ?
I bought this riser for the S920, but it's too short. However, the product specifications show the exact same hight? @frauhottelmann What's the exact hight of your riser from the bottom to the center of the PCIe slot?
 

Samir

Post Liker and Deal Hunter Extraordinaire!
Jul 21, 2017
2,309
911
113
47
HSV and SFO
If you guys are looking for the genuine riser, you can purchase one of these outfitted with the riser and gpu, sell the gpu, keep the riser and sell the unit for cheap (or keep as a spare), and come out ahead:

On a side note, these are very easily restorable to a windows thin client as all the images are available and the windows activates--this includes win10. :)
 
  • Like
Reactions: Markess

roqueeee

New Member
Oct 26, 2021
2
1
3
Just chiming in to share my experience with the S920.
I bought two of them used last year for a really good price.

The first thing I noticed was the exceptional build quality. It appears as if these weren't engineered down to a price point but rather for longevity.

I've had the 4x1,5GHz variant running OPNsense 24/7 with an Intel i350-t4 for about a year now. No issues whatsoever.

The installation was a bit frustrating though. I disabled CSM in the bios to run a uefi only system (it's 2021 lol) and it wouldn't boot OPNsense from the internal mSATA drive (booting from usb was not a problem). So I had to go in and manually create a boot entry with a live install on a stick. Maybe it's the uefi implementation or a compatibility issue with the Transcend drive I'm using, don't know.

I actually went ahead and bought the original riser from a Fujitsu spare parts supplier for around 30 Euros. At the time I was in the market for a APU2 and figured I'd still come in cheaper going with the S920 and have more processing power, more ram, and better nics. Also there's the option to change to fiber or 10gig in the future.

I would totally recommend this thing for home / small business use on a budget. Samir's link looks like a total steal for that price. Shipping to Europe is expensive though (around 40 Euros).
 
  • Like
Reactions: Samir

Samir

Post Liker and Deal Hunter Extraordinaire!
Jul 21, 2017
2,309
911
113
47
HSV and SFO
The first thing I noticed was the exceptional build quality. It appears as if these weren't engineered down to a price point but rather for longevity.
This is what I noticed as well. I have thin clients from Dell, HP, and Lenovo and the build quality of the Fujitsu is better than all of them (Lenovo being second, but Lenovo is the only brand where I had one fail too, so dunno what that means). And when I read 'Made in Germany' on them, it was clear why these were made 'just better'. :)

As a thin client, it's quite fast because of the additional built-in gpu. I haven't done a full production test yet, but for my use case (RDP) it seems as these will literally be twice as fast as the Wyse GX-420CA based thin client I just recently upgraded to from my 415CA based one.

I didn't purchase mine from the seller I linked to, but I think the guy I got these from on reddit originally did. He was trying to use one of the for pfsense and hadn't done anything with the other one. I upgraded both to 16GB of ram and loaded the original win10 image from Fujitsu's site and they were back to factory stock. And windows activates when you manually tell it to activate so license is tied to the board. :) There was a small coa sticker which you can see in the image in the ebay link so I think those could do the same if you wanted to restore them.

I'm actually surprised the seller hasn't fully restored them because a working win10 based thin client with a gpu/slot would double the sales prices. I have even toyed with the idea of buying the lot and restoring them and reselling them, but I don't have time to do that.

Some notes on the power that I gathered from my friend's site parkytowers--these will take either 19v or 20v adapters and according to the motherboard spec sheet and technical manual, even 12v should work as it bypasses the voltage converter on the board. I personally haven't tried anything other than 19v since that's all I have lying around.

Couldn't be happier with my two. :)
 

Markess

Well-Known Member
May 19, 2018
923
566
93
Ugh. I've been trying to avoid the Great Deals forum as much as possible, simply because I keep buying things that I see and think, "oh that's a really good price for (fill in the blank)". Unfortunately, I don't always have a need for a (fill in the blank). But, do I think about whether or not I have a need? No. No, I don't. I never seem to get past "oh that's a really good price for (fill in the blank)," before I'm off to Ebay clicking "Buy".

Now, I can't even look at this "Builds" sub-forum without people like @Samir posting deals there too. Thanks @Samir :mad:

Not sure if the seller will accept my offer (suddenly there's a lot of offers pending..STH Effect), but I'll probably have to find a use for an S920 now too. Sheesh
 
Last edited:
  • Like
  • Haha
Reactions: Samir and unmesh

Stephan

Well-Known Member
Apr 21, 2017
477
287
63
Germany
Paid EUR 180.- for a bare PCengines APU4D4 board this week, for a Wifi/LTE backup-router I am building. Up 50.- from a year ago and because of i210/i211 ethernet chip shortage and rising DRAM prices, the board is out of stock everywhere already, basically. Unless Mr Dornier resorts to the grey market, we are looking at leadtimes for those chips of a year or more.

This Fujitsu seems like an alternative. Things still going for the APU: Only 5 watts idle power draw, smaller, ECC RAM (verified working), three PCIe sockets for Wifi+LTE+mSATA modules out of the box, a switchable double SIM card holder for LTE. In the end I went for the APU4D4 because I've been using the PCengines Alix series for 15 years and have always been impressed by the stability of the platform. But the price... painful.
 
  • Like
Reactions: Samir

unmesh

Active Member
Apr 17, 2017
121
39
28
63
Ugh. I've been trying to avoid the Great Deals forum as much as possible, simply because I keep buying things that I see and think, "oh that's a really good price for (fill in the blank)". Unfortunately, I don't always have a need for a (fill in the blank). But, do I think about whether or not I have a need? No. No, I don't. I never seem to get past "oh that's a really good price for (fill in the blank)," before I'm off to Ebay clicking "Buy".

Now, I can't even look at this "Builds" sub-forum without people like @Samir posting deals there too. Thanks @Samir :mad:

Not sure if the seller will accept my offer (suddenly there's a lot of offers pending..STH Effect), but I'll probably have to find a use for an S920 now too. Sheesh
I seem to be able to exercise self-control for the most part but it is a struggle :cool:
 
  • Like
Reactions: Samir