-
Notifications
You must be signed in to change notification settings - Fork 0
Router Hardware
There are several possible options for hardware routers
| Features | Protectli Vault (6 port) | EdgeRouter (Lite) |
|---|---|---|
| Processor | Intel, 2-6 cores | MIPS64, Dual Core |
| RAM | Up to 64GB | 512MB |
| Storage | Up to 32GB (or 1TB for virtualization) | 2GB |
| Hardware Acceleration | AES-NI | IPsec, NAT, GRE, and other offloading |
| OpenVPN | Depends on OS | Yes |
| IPsec | Depends on OS | Yes |
| Wireguard | Depends on OS | Yes (via package) |
| GRE | Depends on OS | Yes |
The EdgeRouter model, as well as some more powerful models, simply don't fit the bill even though their software is top-notch. The lack of RAM could be an issue when dealing with large route tables, and from experience offloading doesn't do enough to make up for the slow processor. The Protectli models are definitely powerful enough, and make a viable alternative to virtualizating the router. Being more generalized, AES-NI could accelerate OpenVPN and IPSec (though not Wireguard), making it also viable as a VPN concentrator.
Other models such as Cisco and Juniper multi-layer switches were considered, but in part due to a lack of familiarity with the entire Cisco ecosystem and in part because of a lack of versatility, such as being able to run multiple VPNs and routing daemons, I don't believe they would be a good choice.
Another possibility is to use PC hardware. The priorities for this would be (ideally listed) support for router OSs like pfSense or VyOS, fast processors to allow for high-bandwidth VPN connections (ideally hardware-accelerated), and enough memory for large routing tables. Virtualized routers may struggle to keep up with the performance requirements of routing, BGP, and VPN protocols like Wireguard (which does surprisingly well with multiple slow cores) and OpenVPN. Physical PC hardware suffers from the same requirements and limitations, the only advantage bare-metal might get over a virtualized router is if certain hardware acceleration features are not exposed to the VM. Note that using a VM might allow for more advanced software-defined networking, but it could also increase the complexity of exposing the VM to the outside world.
Given the above analysis, it seems that either a Protectli or virtualized solution would fit the bill nicely. If a Protectli device is able to meet the performance requirements of VPN solutions like Wireguard and OpenVPN, it is certainly worthwhile considering. On the other hand, virtualizing the router potentially allows for more advanced networking, including breaking out functionality like the VPN concentrator into another VM, and it makes hosting services behind the router easier. Even so, virtualizing the router could add unnecessary management and performance overhead and unforseen networking issues.