Intel-based, 4-port firewall/router for less than $200

NOTE:-  This article was originally written mid 2019, but was never posted (it seems that I received a non-maskable interrupt in mid sentence and never got back to it).  Prices quoted are probably no longer valid, but I note that the systems themselves are still available from the supplier linked-to below.


As noted a couple of months back in the Odd Bargains post, I’ve been experimenting with some low-cost Celeron-based systems (in addition to the original Z8350, Atom-based unit, which started me along this particular track) as cheap, complete servers for our home network.  The main advantages for me are good OS support for most (but definitely not all) peripherals, RTC and battery as standard and they all come complete with a case and power-supply included in the up-front price.  They are a lot cheaper to run too, as these low-end processors were originally intended for laptops and tablets rather than full blown PCs.  Santa Claus only delivers for free at ChristmasWhile there’s no denying that the CPU performance is generally nothing to get too excited about, they (the quad-core units, especially) still work remarkably well as 24/7 infrastructure servers for services such as DNS, NTP, DHCP, low volume web servers and reverse proxies.  Most ,but not all,  come with a GbE port and are quite capable of handling significant amounts of traffic (…watch out  for the low-end “ACE PC” branded models though, as they only have a 100Mb port), but all GbE chipsets are not created equal and my tests with a cheap, external USB-3 to GbE dongle (as a super-budget firewall) were a resounding failure (the internal port on the Celeron box could handle the traffic, but the dongle would give up the ghost after 2 or 3 hours).

I found along the way that there are quite a few, virtually identical systems in this price range which have completely different chipsets.  Most of the very low cost machines come with Realtek chips, which research on the ‘net shows to be less than ideal for a firewall (the symptoms reported are similar to my own experience with the USB-3 dongle).  This isn’t to say that the Realtek chips are to blame (there are lots of other variables in the mix), but it is fairly common to see posts recommending Intel chipsets for long term reliability under heavy load.  So, after playing around with a couple of systems that I actually have and taking into account reviews and research, I eventually came down to the choice of a J3160 based system with four, Intel-based GbE ports (the J3160 because it’s a quad-core chip with slightly better performance than the Z8350 and (importantly) with AES-NI hardware cryptography support and four ports because I need to provide for a couple of “guest” networks, firewalled off from the main, home network).

I found a reputable looking supplier on Alibaba who had a lot of good feedback and decent prices (they sell under the names of “Yanling”, “Minisys” and “iWill”).  The model I chose was their Nuc-C3L4.  In addition to the four (Intel) GbE ports, it also comes with dual-HDMI, 2x USB-3.0 and an RS232 console port.  The cost for the bare-bones unit is was $142.60, but that doesn’t include shipping (which was an additional $20 for my location).  This vendor does accept PayPal, but only from a limited range of countries (and mine wasn’t one of them).  Depending upon where and how you’re shopping, you can probably get 4GB of memory and a 64GB eMMC card for an additional $30, or so.  And yes, because I have used this supplier and had a good experience with them and their products, I do recommend them.  Communications with them (in English) were easy, fast and friendly.  NUC-C3L4 unboxedTheir shipping was also fast and their packing is excellent (the boxes are sturdy and the units are completely surrounded by a custom, expanded polystyrene foam cushion …which may not be very environmentally friendly, but certainly is effective).  The power supply, mains lead and included VESA mounting plate are separated from the system itself by a cardboard divider and all of the individual parts (including the system) are enclosed in their own plastic bags to keep moisture at bay.  Once out of the bag, the unit proved to be very black, very shiny and of all metal construction (unlike the Beelink AP35 which I wrote about a couple of weeks back).  Offset screw holes prevent misalignmentIt looks very nicely made and well put together and it’s obvious that someone put more than a couple of minutes of thought into this very compact design (for instance, the bottom of the unit has ventilation slots and it is secured to the body with four, asymmetrically offset screws, so that it’s actually impossible to attach it in a way which would block those slots).

I ordered memory and an mSATA SSD module from Amazon here in Japan and actually got a pretty good deal.  If you do buy one of these units, it’s important that you only use the low-voltage (1.35v) variants of the DDR3 SODIMM, though; this system won’t work with higher voltage rated memory.

Here’s where I hit a very small speed-bump in the road to getting it all working.  It turns out that the motherboard slots are not identical.  You have a 50/50 chance of getting it right when installing the mSATA  …and I got it 100% wrong.

Nope, not this way!
Nope, not this way!
The right way round (R/H slot)
This way!!

As you can see, the mSATA module needs to be plugged into  the right-hand socket to be correctly recognized by the system.

Take another look at that “This way!!” photograph again.  The first point of note is the RTC battery (the yellow blob in the bottom, left-hand corner).  This system comes with an RTC and battery, which means any Unix-based OS works right out of the box; just tell the OS what timezone you’re in and you’re done.  Notice also the row of RJ45 sockets at the L/H side.  If you click on the image to get the full-sized version (it will open in a new tab), you can easily read the MAC address assigned to each port.  It’s probably worthwhile making a note of those (they’re sequential) while you have the bottom off, to help with identification later.

You can also see there’s  a SATA port available on the motherboard, but with this particular model there’s no space available to fit an internal drive.

Here’s a partial dmesg output from the machine once FreeBSD was loaded, showing the CPU features for the J3160:-

Copyright (c) 1992-2018 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 12.0-RELEASE-p4 b0ff15badd(RELENG_2_5) GENERIC amd64
FreeBSD clang version 6.0.1 (tags/RELEASE_601/final) (based on LLVM 6.0.1)
VT(vga): resolution 640×480
CPU: Intel(R) Celeron(R) CPU J3160 @ 1.60GHz (1600.05-MHz K8-class CPU)
Origin=”GenuineIntel” Id=0x406c4 Family=0x6 Model=0x4c Stepping=4
Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA, CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
Features2=0x43d8e3bf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3, CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,TSCDLT,AESNI,RDRAND>
AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
AMD Features2=0x101<LAHF,Prefetch>
Structured Extended Features=0x2282<TSCADJ,SMEP,ERMS,NFPUSG>
Structured Extended Features3=0xc000000<IBPB,STIBP>
VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
TSC: P-state invariant, performance statistics
real memory = 4294967296 (4096 MB)
avail memory = 4002127872 (3816 MB)
Event timer “LAPIC” quality 600
ACPI APIC Table:
WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
FreeBSD/SMP: 1 package(s) x 4 core(s)

Close to the end of the “Features2” line, you’ll see “AESNI” included.  These are Intel’s “Advanced Encryption Standard – New Instructions” which enable faster, hardware-assisted  encryption and decryption.  Although this technology is now available on some other processors (including ARM), older Intel processors don’t have it (for instance, the predecessor to this mini-pc system had a Celeron J1900 processor, which doesn’t have AES-NI), so a J3160 is worth the extra few dollars if you’re planning on a VPN server, for instance.

Last words

I actually got two of these systems, one for my own use (to replace an ancient firewall box) and one for a remote site.  They’ve now been running for almost exactly a year (since I began this article in early August, 2019) and have been totally reliable during that time.  I did think that the heat-sink was running a little bit on the hot side when I first installed them, but the “touch test” is deceptive and even during the mid-summer heat, the processors barely register 50°C.

The systems handle the traffic we pull through them without any problem and can handle multiple firewalled VLANs, encrypted VPN traffic and multiple physical networks with ease (as well as handling the normal associated processes — NAT, DHCP, DNS, NTP, etc).  I’d like to emphasize what good value these little systems are.  Not only is the initial purchase price very low, but the lack of fans and the 6W (avg TDP) processor mean the power requirements (and hence the monthly electricity bill) are low, too.  I was also very impressed with the quality of the (all metal) case, the general design and workmanship, as well as the packing and delivery from the vendor.  They may not be as cheap as a Raspberry Pi, but the quality of the case, included PSU, cables and accessories, as well as the RTC (and battery) and four GbE ports more than make up for that.  You won’t be running a 20TB database with 200 concurrent users on one of these machines, but for moderately light 24/7 operations for a good sized household or small business, I don’t thing you can go far wrong.

 

Advertisement

Mini-PC Bargain of the Day – €28.26

An Intel-based mini-pc (not even an Atom, but a fairly decent quad-core Celeron) with a case and power supply for less than the price of a Raspberry Pi.  Can it be real?

[Update 11th March]  —  Looks as though these (assuming there ever was more than one) have sold out.  😦    Scroll down for some other, not quite as cheap, but still available mini-pc bargains.                                 —      …and the answer is, probably not!   Check the delivery cost very carefully before clicking the order button.  As far as I can tell, this seller is hoping to charge you €999.00 for express delivery of the first item and €80.00 for each additional item.  It’s not clear to me whether that is the default, or whether you can have it shipped “normal delivery” for €4.99; perhaps someone more familiar with on-line shopping in French can comment on that? Reader “raspi” has confirmed that delivery in France is €4.99 (see the comments section, below), so it does look as though this is a bargain after all (but you should still check delivery costs and final price before confirming your order).

It looks like the Europeans get the best deal of the day (again), with CDiscout.com currently advertising a J3455 (quad core Celeron) with 4GB of main memory and 64GB of eMMC for a measly €28.26 (it might be a misprint, but they do say quite plainly “€190 Savings”).

Unfortunately, as I’ve mentioned before, Cdiscount only sell/deliver to a small number of western European countries, so the rest of us are out of luck, but if you’re in France, Spain, Germany or Belgium …get them while you can (and let us know in the comments if you manage to snag one of these at the advertised price).  [IMPORTANT – If you didn’t read the update at the top of the page, go back and read it now — verify the shipping cost before you buy!!]

AMAZON J3455

At a somewhat more realistic price, Amazon.com is currently advertising a J3455-based, Coofun branded, mini-pc with a very respectable 6GB of memory and a 128GB M.2 SSD for $170.  What appear to be identical units but with a different name are currently selling for $189.99.  Amazon U.S. will also ship these units to selected countries outside of the U.S. for a very reasonable price (but you might end up having to pay a stiffer bill for postage back to the U.S. if you need to return it for any reason).

Silence is golden — Although the adverts are usually vaguely worded, you can safely assume that most of these thin, Celeron-based systems have a laptop-style fan hidden away somewhere inside (generally the earlier generation, Atom-based mini-pcs didn’t).  The Coofun advertisment above very straightforwardly displays a photo of the heatsink and fan unit, so there’s no guesswork involved.

AMAZON N3150/J3160 BAREBONES

Currently (11th March 2020), most Amazon regions (including the U.S.) are advertising an N3150 or J3160 (virtually identical) based fanless model with 4 x USB3, 2 x USB2, 2 x HDMI and 2 x GbE.  Note that this is the barebones price (no memory, no SSD/HDD).  The price seems to be pretty much the same for Amazon US, Japan and UK at roughly $135 with free shipping:-

It seems that you’ll be shipped whichever CPU is at hand when your order is received (in other words, you can’t choose).  It’s still very attractive, though; this is a Celeron machine at the current Atom-Z8350 price.  From personal experience with similar machines, you can expect this beastie to run fairly hot; not hot enough to burn you, but hot enough to be uncomfortable to the touch.

 

As usual, these are not “monetized” links and I have no relationship at all with CDiscount.com (because they won’t sell or deliver to me).  I am an occasional customer of Amazon.com, but I haven’t ever bought a “Coofun” branded computer (from them, or anyone else), so please do treat this as a simple pointer and not a recommendation. [ END OF THE SMALL PRINT ]

The Odd Bargain

Long term readers will know that I occasionally wander off subject (the ESP8266 and related hardware and software) by quite a way, but usually within the bounds of the  more general subject of “technology”.  One of the consistently popular pages on the site over the past couple of years has been the story of the tiny Z8350 fanless system which I bought a while ago to replace a power-hungry infrastructure server on my home network.  Despite a very rocky start, that little machine turned out to be one of my better buys in recent years and has encouraged me to try some of the other, low-cost systems appearing on the market (mostly with a lot less success than the original Z83).

Anyway, in the course of these experiments, I’ve been finding new outlets and even better deals on more of these “mini PCs” (as they have come to be called) and have been updating the original Z83 page with these odd bargains, as I find them.  For instance:-


Update May 6th 2019 —  !!EUROPE ONLY!! —  A very similar box (Z8350 but with 4GB/64GB and VGA/HDMI video connectors) is now selling for €69.99 (~$78) at Cdiscount (France).   If you’re not in Europe and don’t have a plug-adapter to hand, you can still get an updated 64GB eMMC version with dual video outputs (one VGA, one HDMI) for $99.99 (plus shipping).


(The first one has recently dropped to €65.99, or about $74 US).


Update July 13th 2019  —  !!EUROPE ONLY!!  —  …and the cheapest yet, 4GB/64GB with HDMI and VGA for just €47.95 (about $54) from CDiscount.  Read the small print carefully!


Update Aug 6th 2019 —  As Z8350 afficionados will know, the “Z85” version of this popular little box is generally regarded as the “big brother” of the version described in the body of this article, as it comes with an added VGA port and (usually) 4GB of RAM and a 64GB eMMC.  Well you can currently get the Z85 from this seller on Aliexpress in the 2GB/32GB configuration (definitely –not– recommended for Windows 10) for just $78.16 including free shipping (or $86.19 for the 4GB/64GB version).


I’ve become fascinated recently by the emergence of even more capable systems in roughly the same price range, which are more substantially built (usually with aluminium cases with integrated heat sinks) and slightly more powerful processors.  They’re still not the sort of machine where you’d run a company database or even use for serious gaming, but they are solid little workhorses which, importantly, just sip power and are eminently suitable for 24/7 operations.

One of the common processors used to power these systems is the Celeron J3160, a stablemate of the Atom Z8350 used in the mini-PC systems referenced above.  Both were  introduced at the same time and have remarkably similar specs, with the J3160 having very slightly better general performance, better memory bus throughput and an improved on-board GPU.  Because these chips are no longer leading-edge, the systems using them are now going for very reasonable, or sometimes even “bargain basement” prices.  Here’s the best bargain I’ve come across this week (so far):-

Picture courtesy of Venoen/AliExpressThe VENOEN store on AliExpress is currently offering a J3160 based, barebones system with dual (Realtek) GbE ports, dual HDMI ports, a single RS232 COM port, one internal mini PCI-E (mSATA) slot, one internal mini half-height PCI-E, one internal DDR3L SIMM slot, two USB-3.0 ports and four USB-2.0 ports — for $96.11.  There’s also a normal SATA connector on the motherboard and (apparently) space in the case for a 2.5″ drive (although in a fanless system, it would make sense to limit that to an SSD).

To select the J3160 model at that price, click on “No RAM, No HD, No WiFi” and “2-LAN, 1-COM, J3160”  (careful, there’s an “N3160” button right next to it).  Shipping is free (for my geographical region, anyway).


Update June 25th 2019 —  !!EUROPE ONLY!! —  Another one of those deals for people in central Europe, available from CDiscount.com.  This is a bare-bones J3160 system from Hystou which comes (as far as I can tell) in a plastic case, with no external heat sink.  It is advertised as fanless and otherwise looks pretty much identical to the system above (although it is rather difficult to confirm, because of the lack of specs on the CDiscount page).  It is currently on sale at €69.99 (about $78.50).



†  —  Disclaimer #1 – I don’t own either of these specific models, but I do have a couple of very similar, fanless J3160 systems (review coming soon).

‡  —  Disclaimer #2 – I have never used this specific AliExpress store, or CDiscount, so there is no implied recommendation for either seller.

£  —  Disclaimer #3 – This blog is not monetized in any way.  I do not receive free products to review nor do I get any recompense for “clicks”.  Any products reviewed here are purchased at my own expense and you will find (honest and sometime unflattering) comments on the performance of the suppliers in the reviews.