seeking: cheap opnsense/pfsense hardware recommendation

[poningru]

Hi folks
I have two switches (SX6036 and ICX7450) with 40gb qsfp+ ports that I'd like to use for connecting to the router.
My current router that I purchased before I got the switches with sfp/qsfp ports only has RJ45 that can handle 2.5gb (this cwwk box).
I could go down the path of purchasing an QSFP+ -> SFP+ adapter and then an sfp+ copper transceiver that can handle 2.5gb (which is the probably the cheapest option).
But I want to eventually mlag and ha the routers with dual wan for maximum redundancy (I may start hosting some infrastructure for a few local non-profits).
So looking for a new box that:

• has, at least, an x4 or, preferably, x8 pcie slot for a connectx-3 pro
• has enough processing power to handle pppoe for opnsense (C3000 series or N100, but open to other procs in that level of performance)
• has existing RJ45 nics that can connect to isp equipment
• has low-ish power utilization (idles < 15ish watts and doesn't spike more than 50ish watts under heavy load)
• is cheapish (total budget of around $150)
  • Connectx-3 card: ~$15
  • appliance/motherboard: ~$100
  • rest for ram/ssd

I already have a bunch of equipment i.e 1u server rack chassis from old supermicro, so if it's just a mobo I can definitely make it work.
Options I have explored:

• this other cwwk mobo
  • too costly but if it can be found for in the $100 range on ali* / ebay I would bite
• Various N100 motherboards
  • Most do not have an x8 pcie slot, others are too costly
• Various tiny hardware from ebay
  • Cant find any that fit these requirements
  • This is where I'm hoping yall can help me out
• other N100 SBC
  • Radxa x4
    • Only has an x4 M.2 pcie, which I've thought of using with this adapter
    • a bit too frankensteinish, though I can probably stuff it all into a 1u chassis to make it work
  • Odroid-H4
    • similar issues to the radxa x4

What do yall think? What would you recommend in my situation?
-Eldo

 

[nexox]

The N100 only has 9 PCIe lanes, but most of those can be configured as USB 3.0 or SATAIII, and most boards are going to use more than one lane for those. I haven't dug into the documentation but the way the diagram is laid out makes it seem like it can't aggregate those lanes into an x8 port even if the other ports were omitted. So the N100 (and related processors) won't do 40G for you.

The C3000 series has the PCIe lanes you need but I've pretty much never seen one in your price range, I think you're looking at more like a 3rd/4th gen Intel mobile/embedded CPU on a MiniITX board, and you'll have to look for a while to get a good price on one. This auction is over but it would probably suit your needs: Kontron KTQM87/mITX Motherboard, Intel i7 4700EQ, 16Gb DDR3 RAM, Mini ITX, NAS | eBay

Edit: I have no idea how much CPU pfsense requires, could be you can't find anything viable in your price and power budget.

 

[Hrast]

With the BSD based firewalls, you're going to need faster single threaded performance since the WAN connection is pppoe. You'd have to snipe auctions on eBay to get down to the dollar amount you want to spend.

 

[kapone]

I'm assuming the 40g for the router is because of the SX6036...not because your WAN is 40g..

(As a data point, it takes 8 cores of ~3.5GHz at ~50-60% to saturate a 40g pipe..)

If your router is essentially a firewall...i.e. routing between int/ext networks, and not doing L3 routing, your requirements become much simpler.

Edit: As another data point...I have a 2gb FIOS symmetric connection...which is generally under-subscribed, so more like 2.5gbps, and I can easily do full speed with a couple of packages (including Adblock) with an Ivy Bridge era E3-1270v2 (quad core 3.5ghz).

Edit 2: And it was running on an el-cheapo Gigabyte motherboard (left top, I was using an i5 at the time I think. I've changed motherboards since then, but still el-cheapo.). I think the whole thing costed me ~$60 a few years ago. It might be more now with ...you know...inflation.

 

[poningru]

All great comments! thanks everyone.
Couple of points of clarification, I am definitely not restricting myself to an x8 pcie slot in the mobo, since I dont have a wan that comes anywhere close to 40gb (I have 1gb through quantum fiber).
The x8 is really a best case scenario. Honestly, looking for a pcie 3.0 x4 as the minimum (enough for 10gb duplex).
Performance perspective:
I definitely am not doing any crazy routing, the performance is only needed for the freebsd pppoe client.
Unfortunately that pppoe is killer, with single threaded performance needing to be in the C3000 range i.e my old c2000 supermicro was not good enough.

 

[homeserver78]

I'm not entirely clear on your requirements, but if one 1 GbE NIC is enough, plus the PCIe slot, then you could look at used small form factor office PCs with Intel Gen8 or Gen9 CPUs on Ebay.

Dell OptiPlex 3070 SFF
Dell OptiPlex 5070 SFF
Lenovo ThinkCentre M720s
Lenovo ThinkCentre M920s
Fujitsu Esprimo D738

etc...

 

[poningru]

Thanks for everyone's responses. I ended up going with a FWA-ASP1012
See my writeup