Fujitsu Futro S920 Thin Client as opnsense firewall
- Thread starter frauhottelmann
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
Thanks for the summary about the S920/S930.
I am about to replace my APU1D4 running OPNsense by a S930 and have two thoughts/questions, maybe you can help me:
a) I can either put a 10 GBit card or the Intel Quad 1 GBit card inside. Which one would you choose? I think even the CPU can't handle 10 GBit, maybe it can reach 5, which would be already more than 4x 1 GBit. What do you think?
b) How big should the Riser card be? Is it worth buying the original (around 30 Euros) or "as small as possible" from a retailer for 10 Euros?
Thanks for your experience and feedback.
Sidenote: I am not running IDS/IPS at the moment, but would like to do so maybe in the future.
I am about to replace my APU1D4 running OPNsense by a S930 and have two thoughts/questions, maybe you can help me:
a) I can either put a 10 GBit card or the Intel Quad 1 GBit card inside. Which one would you choose? I think even the CPU can't handle 10 GBit, maybe it can reach 5, which would be already more than 4x 1 GBit. What do you think?
b) How big should the Riser card be? Is it worth buying the original (around 30 Euros) or "as small as possible" from a retailer for 10 Euros?
Thanks for your experience and feedback.
Sidenote: I am not running IDS/IPS at the moment, but would like to do so maybe in the future.
Huge warning: Do not attempt to update the bios in Windows PE. I got a bsod midway and the box was temporarily bricked (but fixing it only took 45 minutes!) I read the board manuals beforehand and knew there was a recovery feature so I guessed how it worked. You can find Fujitsu downloads here by plugging in model numbers and hitting the "OS Independent" tab:
https://support.ts.fujitsu.com/IndexDownload.asp?lng=en&OpenTab=
Bricked bios recovery guide:
1. ID the board in your S920. Mine was a D3313-E1x. It's easy to tell if the box is in working condition but otherwise there's an S920 pdf that explains the different board variants. The boards have different components.
https://support.ts.fujitsu.com/indexdownload.asp?Softwareguid=ebc493fd-3eac-44a0-894f-8af8404735a4
2. Download "BIOS Update - Admin Pack for D3313-xyz" and unpack
3. In the same bios tab there's a link to a FreeDOS USB creation tool for Windows:
https://support.ts.fujitsu.com/Inde...wareGUID=4C7EAC35-E4B9-4EB2-B51D-C7AB265A9690
4. Plug in a flash drive you don't care about and provision it with the FreeDOS tool
5. Copy paste the unpacked bios files as-is onto the flash drive
6. Pop open the case on your S920. It's only two screws and it's not completely obvious how it comes apart but it shouldn't be too hard. The part that slides out is connected to the front panel.
7. Your board should have a recovery pinout labeled "RCV" like this, where X should be where the jumpers were located when I opened the box:
9. Your flash drive should light up and the speaker should make a bunch of weird noises. There are multiple tones, do not do anything until the tones change and start repeating.
10. Rearrange recovery jumpers to stock position
11. Reset machine and enjoy your long-winded bios update! Remember to change your power-on settings and decrease APU shared memory to 32 MB.
Note: The latest bios is currently V4.6.5.4 R1.16.0 and it is probably important so do consider flashing it:
- Microcode updates added.
- Memory module frequency limited to maximum
supported speed (1600MHz).
Here's some OPNSense performance off the top of my head with this hardware. Tests all done with NIC accelerations kept enabled except for IPS.
GX-424CC @ 2.4 GHz
4GB DDR3
Dell I350-T4 (T34F4) variant flashed with latest Intel firmware
(don't even ask me how I did this I don't remember I probably flashed it in Linux. claims to support SR-IOV)
Originally came with an AMD FirePro on original riser. This riser variant has a metal support bar that runs down the middle.
Onboard ethernet is some kind of Realtek, have not tried using it yet
Power adapter: Some Lenovo thing I had that happened to fit the specs
(ADP-65YB D, 20V 3.25A 65W, Lenovo P/N 36200337)
iperf3 Loopback (?): 3.43 GB/s
WAN with/without traffic shaping: Enough to saturate 1 gbit
WAN with IPS: 400 MB/s (Suricata seems extremely buggy with this hardware anyways just don't bother)
iperf3 inter-NIC on i350-t4: 400-500 MB/s
(laptop gbit on OptX to firewall on OptY, need to retest with 2 different machines later)
Basically it's fast enough for most homes, a little slow for enthusiasts and I'm happy with my ~$55 box and $50 quad NIC.
P.S Anyone know how to undervolt this CPU on BSD? I was able to take off 100 millivolts in Linux across all pstates. The software reported at one or two watts of savings, would love to have that. I see there's a BSD tool for manipulating MSRs but that's way over my head.
P.P.S My S920 was assembled in Germany (!) and the D3313s are industrial boards made by Kontron. I'm sad I only bought a single one. The quality speaks for itself.
P.P.P.S mSata SSD on mine reports about 3 years of power-on hours despite the unit looking completely spotless. I think these came from healthcare.
https://support.ts.fujitsu.com/IndexDownload.asp?lng=en&OpenTab=
Bricked bios recovery guide:
1. ID the board in your S920. Mine was a D3313-E1x. It's easy to tell if the box is in working condition but otherwise there's an S920 pdf that explains the different board variants. The boards have different components.
https://support.ts.fujitsu.com/indexdownload.asp?Softwareguid=ebc493fd-3eac-44a0-894f-8af8404735a4
2. Download "BIOS Update - Admin Pack for D3313-xyz" and unpack
3. In the same bios tab there's a link to a FreeDOS USB creation tool for Windows:
https://support.ts.fujitsu.com/Inde...wareGUID=4C7EAC35-E4B9-4EB2-B51D-C7AB265A9690
4. Plug in a flash drive you don't care about and provision it with the FreeDOS tool
5. Copy paste the unpacked bios files as-is onto the flash drive
6. Pop open the case on your S920. It's only two screws and it's not completely obvious how it comes apart but it shouldn't be too hard. The part that slides out is connected to the front panel.
7. Your board should have a recovery pinout labeled "RCV" like this, where X should be where the jumpers were located when I opened the box:
arrange the jumpers like this
8. Plug your flash drive into the front USB and turn on the S920
9. Your flash drive should light up and the speaker should make a bunch of weird noises. There are multiple tones, do not do anything until the tones change and start repeating.
10. Rearrange recovery jumpers to stock position
11. Reset machine and enjoy your long-winded bios update! Remember to change your power-on settings and decrease APU shared memory to 32 MB.
Note: The latest bios is currently V4.6.5.4 R1.16.0 and it is probably important so do consider flashing it:
- Microcode updates added.
- Memory module frequency limited to maximum
supported speed (1600MHz).
Here's some OPNSense performance off the top of my head with this hardware. Tests all done with NIC accelerations kept enabled except for IPS.
GX-424CC @ 2.4 GHz
4GB DDR3
Dell I350-T4 (T34F4) variant flashed with latest Intel firmware
(don't even ask me how I did this I don't remember I probably flashed it in Linux. claims to support SR-IOV)
Originally came with an AMD FirePro on original riser. This riser variant has a metal support bar that runs down the middle.
Onboard ethernet is some kind of Realtek, have not tried using it yet
Power adapter: Some Lenovo thing I had that happened to fit the specs
(ADP-65YB D, 20V 3.25A 65W, Lenovo P/N 36200337)
iperf3 Loopback (?): 3.43 GB/s
WAN with/without traffic shaping: Enough to saturate 1 gbit
WAN with IPS: 400 MB/s (Suricata seems extremely buggy with this hardware anyways just don't bother)
iperf3 inter-NIC on i350-t4: 400-500 MB/s
(laptop gbit on OptX to firewall on OptY, need to retest with 2 different machines later)
Basically it's fast enough for most homes, a little slow for enthusiasts and I'm happy with my ~$55 box and $50 quad NIC.
P.S Anyone know how to undervolt this CPU on BSD? I was able to take off 100 millivolts in Linux across all pstates. The software reported at one or two watts of savings, would love to have that. I see there's a BSD tool for manipulating MSRs but that's way over my head.
P.P.S My S920 was assembled in Germany (!) and the D3313s are industrial boards made by Kontron. I'm sad I only bought a single one. The quality speaks for itself.
P.P.P.S mSata SSD on mine reports about 3 years of power-on hours despite the unit looking completely spotless. I think these came from healthcare.
Last edited:
Thank you for the update! I recently connected mine to an epdu and as I'm using it right now (as a thin client), it's using 12.3w according to the epdu. (It's currently got about 20 rdp sessions running and using about 6gb out of 16gb of ram running the factory win10 iot build.)
Anyone have too much free time and want to test Windows undervolting? I mentioned getting -100mV in Linux a few posts up.
In the past I used amdmsrtweaker to tweak CPUs in Windows. Looks like that might still work if you turn off virtualization and core security according to a thread I can't link.
I'm using the S920 as a router right now so I can't test anything in Windows. But I welcome people to try.
Edit: Also found ancient ancient abandonware called pumastatectl if anyone wants to mess around with that.
In the past I used amdmsrtweaker to tweak CPUs in Windows. Looks like that might still work if you turn off virtualization and core security according to a thread I can't link.
I'm using the S920 as a router right now so I can't test anything in Windows. But I welcome people to try.
Edit: Also found ancient ancient abandonware called pumastatectl if anyone wants to mess around with that.
As cheap as these are, you should pick up a spare and restore it and go to town.
I've considered picking up a third myself.Edit: Well scratch that--there's not a single one available in the US anymore.
I compiled the FreshPorts BSD port of amdmsrtweaker, ran "kldload cpuctl" and tried running it.
Edit: I know, I should've bought like 3-5 of them while they were still $55 shipped. Their off-bay website has 25 of them in stock for $100 each. Price is alright I guess.
If it doesn't work in BSD it probably doesn't work in Windows.
Edit: I know, I should've bought like 3-5 of them while they were still $55 shipped. Their off-bay website has 25 of them in stock for $100 each. Price is alright I guess.
What cpus is that supposed to support?I compiled the FreshPorts BSD port of amdmsrtweaker, ran "kldload cpuctl" and tried running it.
If it doesn't work in BSD it probably doesn't work in Windows.
Edit: I know, I should've bought like 3-5 of them while they were still $55 shipped. Their off-bay website has 25 of them in stock for $100 each. Price is alright I guess.
Link to off-bay website?
Not sure, it's quite old software to be honest. I vaguely recall using it for Phenom II and FX-8350.
Fujitsu Futuro S920 TCS Thin Client | AMD GX-424CC @ 2.4GHz | 4GB RAM | 32GB HDD • TechRenew
Used Fujitsu Futuro S920 Thin Client for sale. Good condition, ships quickly. Click to view details and related products from TechRenew.
techrenew.com
I wasn't able to get any shipping options to show up so these might be reserved, nonexistent or pickup only.
Last edited:
I still have some 2-Port Intel NICs. From what I've read so far I need some riser cable to use the PCI extension in the case?It'll be fine with your slow speeds. Probably don't even need any hardware upgrades, just use the single onboard Realtek and hook it up to a managed switch.
The vpn or speed in general will be limited by the CPU only, right? What do you think is the upper limit? 100mbit/s? It's a bit far-fetched but I still hope to be able to upgrade my connection someday
Edit: Any idea how it compares to a HP N54L? Got an unused one in the shelve.
Edit 2: Okay, according to Passmark, the N54L is even worse.
Last edited:
Pretty much. I can get at least 200 MB/s forcing a USB2 ethernet connected client over OpenVPN. I don't have all of my hardware moved yet so unfortunately I can only do hilariously dodgy tests or recall the ones I did months ago. But Wireguard-kmod was about 700 MB/s over LAN iirc. This is with the significantly faster 2.4 GHz GX-424CC in my S920.
You do need a riser if it's one of the cheaper S920s. I looked up the listing you're probably talking about and the back panel is blocked off so you probably need one.
Problem with that cheaper S920 is it'll probably cost 3-4x its value to get miscellaneous parts for it.
You do need a riser if it's one of the cheaper S920s. I looked up the listing you're probably talking about and the back panel is blocked off so you probably need one.
Problem with that cheaper S920 is it'll probably cost 3-4x its value to get miscellaneous parts for it.
It's the Fujitsu Futro S920 ThinClient AMD 1.50GHz 2GB 1,9GB SSD ohne Netzteil ohne Fuß | eBay I'm talking about. Glad you reminded me, because that'll add 6€-20€ (depending if x1 or x8/x16 is needed) for the riser card/cable and 15-20€ for a power supply. Still sounds like a good deal if I can get it to 100mbit/s-200mbit/s WireGuard throughput, or am I mistaken here? Note: I got a spare 4GB DDR3-SODIMM module and a 2 port Intel NIC lying around, so I wouldn't need to buy those.
Offers seem scarce in general currently. The S920s in stock (in Germany) are all with the GX-415GA SoC. Other alternatives I looked at,
like the Wyse 5070 or HP T730, cost over 200€. Older Core-i desktops are cheap and easier to get, but they consume a lot more power.
I'm open for other recommendations (like where to ask for advise in my own thread since I don't want to hijack OP's thread any longer, sorry about that.)
Last edited:
Some interesting tidbits from dmidecode and SMART of my box. It also describes the recovery jumpers, pretty much what I already wrote about earlier. So the pinout would be something like:
1 2
3 4
5 6
RCV
The SSD serial starts with the year 2017, could be a coincidence. Does correspond to the 3 years of power-on hours. So these boxes are only 5 years old and you can probably expect at least 5 more years of lifespan out of them. The DVI port supports digital/analog. It seems like the system expects a max of 8GB memory, but Samir's pointed out they take a lot more so I don't know if that's just a suggestion.
1 2
3 4
5 6
RCV
The SSD serial starts with the year 2017, could be a coincidence. Does correspond to the 3 years of power-on hours. So these boxes are only 5 years old and you can probably expect at least 5 more years of lifespan out of them. The DVI port supports digital/analog. It seems like the system expects a max of 8GB memory, but Samir's pointed out they take a lot more so I don't know if that's just a suggestion.
Last edited:
FYI, in case anyone is still interested in buying these:
Seller accepted a best offer of $30 from me. They include the riser and a AMD W series GPU
Fujitsu TCS AMD GX-424CC SOC 2.4Ghz 32GB HDD 4GB RAM | eBay
GX-424CC SOC. with our products or service -- in fact, the vast majority of problems can be handled without even opening a case. Item is in used condition and may have scratches/marks or stickers/sticker residue.
www.ebay.com
Seller accepted a best offer of $30 from me. They include the riser and a AMD W series GPU
Nice! I was looking for these lately and couldn't find any.FYI, in case anyone is still interested in buying these:
Fujitsu TCS AMD GX-424CC SOC 2.4Ghz 32GB HDD 4GB RAM | eBay
GX-424CC SOC. with our products or service -- in fact, the vast majority of problems can be handled without even opening a case. Item is in used condition and may have scratches/marks or stickers/sticker residue.www.ebay.com
Seller accepted a best offer of $30 from me. They include the riser and a AMD W series GPU
The description says 8GB of ram, so is it 4 or 8? Also, for yours was it $30 shipped or was shipping extra?
In my experience, thin clients in general can easily run for a decade or longer (my neoware units are almost on their second decade), and these are definitely built to a higher standard (das Germany for you!), so I would fully expect one of these to last nearly 20 years running 24x7.
As far as memory, they will easily run 32GB (2x16GB) as I have 16GB (2x8GB) in one of mine and the other has 32GB running one of the factory w10 iot images (forgot which one). Once you shut off defender and ms cloud updates they can have uptimes in months as a regular w10 iot thin client. With pfsense I would expect uptimes in years. Solid little units! And for power supply, I posted a link to a pair of Dell ones I got for $11 or $13 shipped and they work perfect.