Buyer’s Guide

Finding the right hardware that fits your needs is one of the most commonly asked questions we get. There are several models of the Protectli Vault which can be easily differentiated by number of ports, CPU and price. In addition, all Vaults can be customized for RAM and storage.

This buyer’s guide will examine the variables of network design, traffic, performance and Vault configurations to serve as a general guide to select the proper Vault.

One of the main variables is the Operating System (OS) and application that is installed on the Vault. In the coming sections we will use pfSense® CE configured as a firewall and router as the baseline configuration. Where applicable, we will reference differences in performance to a Vault running VMWare ESXi or Ubuntu for example.

1. Use Case

The most important consideration for choosing your hardware is what application it will be used for. The Protectli Vault can be used in a number of different applications. Customers have deployed Vaults as Windows Clients, roll-your-own Linux desktops, hypervisors, and of course firewalls.

Thinking about the requirements for your use case will help to narrow your choice when it comes to picking your Vault.

Our recommendation: Simple client machines will work great on our smaller 2-port Vaults, while you may want to consider a 4-port or 6-port for firewall or hypervisor applications.

2. Ports

The number of ethernet ports you need depends on your application. Firewalls can be configured on as little as a single physical port, but for simplicity and throughput, consider that you may want multiple physical ports to segment traffic for multiple networks (i.e. a ‘secure’ network, an ‘IoT’ network, a ‘guest’ network, etc).

For hypervisor applications, consider that a physical port can be ‘passed through’ to an individual virtual machine so multiple virtual machines may need more physical ports.

The Vault is currently available in 2-Port, 4-Port, and 6-Port variations.

Our recommendation: It is smart to think about future-proofing your Vault from the start, so consider a model with more Ethernet ports to stay flexible if your needs change.

2-Port Vault

4-Port Vault

6-Port Vault

Note: Every Vault supports virtual LAN networking (802.1q) as long as the software installed also supports the use of VLANs. Every Vault’s network ports are gigabit PCIe connected to the CPU.

3. Memory

For firewall applications, the number of connections, commonly called a “state,” refers to the TCP/IP connections between clients that traverse network segments. As an example, if a user has a PC and browses out to the Internet, there will typically be multiple “connections” between the browser and the web site. It is not unusual to have 20 or more connections just from a single visit to a web site due to various content, advertisements, etc. On a firewall, each connection has two “states”. One for entering the firewall through the WAN port and one for exiting the WAN port. More states and therefore more clients will require more memory. As per OPNsense documentation:

…each state table entry requires about 1 kB (kilobytes) of RAM. The average state table, filled with 1000 entries will occupy about ~1 MB (megabytes)…

For hypervisor applications, memory comes at a premium as memory generally needs to be statically allocated to each VM (it usually cannot be shared between multiple VM’s like CPU resources can). Memory needs are going to be dictated by the type of VM’s that you are running.

Our recommendation: Many common home or small business firewall applications only require 4GB of RAM. Requirements for every operating system are different. If you expect a larger amount of connections, configure more RAM for your Vault accordingly. For hypervisor applications, consider a Vault that has 2 memory slots (like the FW6 series) so that you can plan for future expansion.

4. Storage

Most firewall applications require little storage space. OPNsense and pfSense easily fit on drives as small as 8GB. Further, many firewall applications run in memory and only use storage for booting and logging.

Hypervisor applications will typically need more storage than a firewall application. This will depend on which hypervisor is used (and whether thin provisioning is supported), as well as how many virtual machines are implemented and for what purpose.

Our recommendation: We typically recomend a 32GB drive for most firewall applications and from 500GB to 1TB or more for hypervisor applications. Note that for hypervisor applications, the FW6 Series supports the simultaneous use of both an mSATA AND 2.5″ SATA drive for high data storage use.

5. Throughput Requirements

Every Vault’s Ethernet ports are PCIe connected to the CPU and can run at 1 Gbps (hardware connection speed).

Firewall

As a firewall, every Vault has tested at full wire speed (~940Mbps) between ports using iperf as a synthetic load. As such, for basic routing applications any Vault is capable of gigabit throughput. However, in most firewall application, additional services will be turned on that consume CPU and thus may reduce throughput. These include modest services such as DHCP and DNS or heavy CPU users such as VPN or Deep Packet Inspection (DPI).

Our recommendation: With a modest throughput of up to ~300 Mbps, you can run many firewall applications in ‘basic’ routing and firewall mode on any of our 2-Port or 4-Port port models. With increased throughput (especially gigabit service) or if implementing VPN, DPI, IPS/IDS, SNORT, Sensei, or other firewall add-ons, we recommend a Vault with a performant CPU such as an FW6Br2.

Note: For sample VPN throughput tests we have performed to show baselined performance across all models, check out our OpenVPN and IPSEC VPN tests.

Hypervisor

For hypervisor applications, the Vault’s multiple gigabit ports are ideal for dedicated physical connections passed through to individual VM’s.

Our recommendation: In most circumstances, using a Vault as a hypervisor means that the user will want to run multiple operating systems, requiring CPU, memory, and network connections. As such, we recommend either the FW6A, FW6Br2, FW6D or FW6E.

6. AES-NI

AES-NI is a feature included with many common Intel CPU’s which helps offload cryptographic functions to dedicated hardware within the CPU. AES-NI is particularly useful for accelerating Virtual Private Networks (VPN).

AES-NI is built into the CPU on all Protectli Vaults.

Our recommendation: If you plan on running a VPN or other encryption related operations, we always recommend going with a unit with AES-NI built in hardware support for encryption that allows them to maintain high performance with VPNs.

7. Workload and Hardware Requirements by OS

The OS you choose to run can greatly affect the performance requirements of the Vault. Some customers use the Vault to run a basic firewall, while others use it as a hypervisor. Therefore, hardware requirements vary widely. Here are a few examples of usage that typically require a stronger CPU.

Routing all network traffic through a VPN requires higher CPU clock speeds, especially at higher throughput
Running add-on packages like pfBlocker (pfSense), SNORT (pfSense), or Sensei (OPNsense)
Using the Vault to run a hypervisor, and/or having other software running on the same device.

Here are hardware recommendations for common OS’s:

OPNsense and pfSense

#footable_121016 { font-family: inherit; font-size: 14px; }

All Protectli Vaults can be configured to meet the recommended requirements to run OPNsense and pfSense.