Protectli Vault Pro VP2420-4 Port, Firewall Micro Appliance/Mini PC - Intel Celeron J6412, 2.5G Ports, DDR4 RAM, M.2 SSD Storage, AES-NI, Barebones

Great build quality. Might be overkill for just pfSense but I wanted to futureproof it a bit. At the moment running pfSense on the baremetal but might look to virtualise (Proxmox). pfSense is great, and before purchase I set up a virtual environment to test out it's features and mirror my existing ASUSWRT Merlin config. Restoring that config onto this was a simple matter - the restore prompts you to clarify which is your new WAN and LAN interfaces at that's it. So downtime was limited to 5-10 minutes which kept the family happy. So as I have a test environment that's why I didn't go for virtualising from the get-go Bought barebones and reused a stick of Corsair Vengeance memory and bought a 256Gb M.2 SATA (not NVMe) drive for £25. Cheaper than the official memory / disk. Four network interfaces means that setting up a real DMZ will be easy, or bridging the ports into the LAN in order to have additional LAN ports. It looks like you might be able to buy it slightly cleaper from Protectli's EU store, but ordering from Amazon gives easy returns, and no problem with shipping and import taxes. Recommended.

I did a quick scan of the bad reviews, which I shouldn't do because sometimes they annoy me. One person accidentally received the wrong version and assumed that everyone would have the same problem, and the other said "it's too complicated". I mean okay, maybe it's complicated for a lot of people. But that's not the hardware's fault. Blame the people on the internet telling people with no networking experience that they need to buy it. Anyway, rant over, let's get into it. I'm not an expert by any stretch, as a software engineer I have plenty of computer experience but my networking knowledge is limited. Buying this Vault is actually partly to help me learn. I ordered the "bare bones" version because I did a quick search and found that the extra items I need -- namely, an M.2 SATA drive (not NVMe) and one DDR4 SO-DIMM RAM stick, cost less than having them already installed in the more expensive versions. What I didn't realize is that Protectli's website offers the same "bare bones" version for $40 less. Oh well, I suppose getting it the day after ordering it was nice. Unfortunately that wasn't my only mistake. I found a pretty good deal on a 32GB Corsair Vengeance RAM stick, which I bought along with a 500GB Kingston M.2 SATA SSD. When I installed them both and the Vault refused to boot, I went to the website and found that Corsair Vengeance RAM is not compatible for some reason. So I checked the compatibility list (highly recommend doing BEFORE you buy the RAM) and ended up getting a 32GB DDR4 3200MHz stick by Crucial . When I installed this, the box fired right up. Quick note on SSD and RAM install: it couldn't be easier. Four screws on the bottom to remove, the bottom panel comes right off, you install the things, and put it back together. Takes 5 minutes. The chassis is all metal, nice and heavy, with a great textured finish and beveled edges. It looks and feels great. Initial setup was pretty simple. I chose pfSense for the installation, so I downloaded the image to a USB drive and plugged it in. For initial setup, I plugged a cheap monitor into the HDMI port and a keyboard into one of the USB ports. There's also a console port, which I set up later, this uses the included serial-to-USB cable to plug into another PC, and you need to install serial drivers and PuTTY or an equivalent application for serial communication on the other PC. In most cases I assume people will generally use the HDMI port for setup and then just use the web console from that point forward. Install was easy, tell it what you want the IP to be, define which ports you want to associate with each interface, etc. It just takes a minute. At that point, it's pretty much ready to go. Internet into the WAN port, and I chose to plug my laptop into the LAN port at first just to configure my chosen address reservations etc that I had set up on my previous router (a Netgear router/AP combo), and then removed the Netgear and put the Vault in its place. Then I switched the Netgear into AP-only mode and added it to my switch, and everything just worked. Of course, I broke things a bunch of times later as I was messing around with creating VLANs and whatnot, but that's me learning the hard way, nothing to do with the Vault. The hardware is great for running pfSense, there's plenty of power on tap. The quad core Celeron runs normally at 2.0 GHz and can ramp up to 2.6 GHZ when needed, although I haven't seen it do that. In fact, the CPU rarely jumps up above 2% utilization. The 32GB RAM I put in there is also probably more than I'll ever need, as that value also stays at about 2% utilization. The Vault runs warm to the touch, but not hot. pfSense reports hardware temperature, but apparently this box lacks the sensor for that since it reports 0.1C all the time. [UPDATE 2024-07-23: I'm just an idiot. There's a setting somewhere in pfSense that allows you to specify your processor family, and then if you enable the temperature sensors widget on the dashboard, you can see the core temperatures. The "Zone 0 temp" is still not reporting, but at least the CPU core temps are there.] Total usage on my 500GB SSD is currently sitting at around 820MB. So what's missing? Well, I guess that Zone 0 temp sensor would be nice. And it also would have been nice to have a display-capable USB-C port, since I have a portable monitor that supports it, and plugging into USB for power AND HDMI for the display is kind of clumsy. Both of these issues are incredibly minor though, and I doubt I'll need the screen connected very often now that the initial setup is complete, and I always have the console port anyway if I need it. One last thing I'd like to add, temperatures tend to stay cool (relatively speaking), as the four reporting core temps always seem to hover around 117F-119F (ambient temperature near the box is probably close to 80F, since the room is air conditioned to 77 but there's nearby switches that warm up the immediate surroundings a bit). Because I'm weird and also since I had a couple of spare case fans laying around, I took one and hooked it up to a 12v power supply with a rotary switch and laid it on top of the Vault's fins to pull air away from them, set at a little under 50% where there's no fan noise but it's moving a decent amount of air. This in turn reduced the core temperatures down to about 91F-94F. I mean yeah, I'm certainly using more electricity powering the fan for no real gain whatsoever, and the temperature was WELL within the normal operating temperature for that CPU, but for some off reason, CPU temps below 100F bring me joy.

Für eine Firewall in einem kleinen Firmennetzwerk mit knapp 30 Clienten habe ich nach einer bezahlbaren Lösung gesucht, und bin bei PFSense/Opensense hängen geblieben. Als Harware habe ich zunächst eine "günstige" Lösung bei einem bekannten Händler aus Fernost bestellt, leider ohne mich im Vorfeld ausreichend zu informieren. Das Problem ist, dass beinahe alle "günstigen" Modelle, unabhängig von der eingesetzten CPU, Temperaturprobleme haben und sehr heiß werden, bis fast zum CPU Limit. So auch das von mir erworbene Modell. Auf der Suche nach Alternativen bin ich auf die Firma Protectli aus Amerika gestoßen, die auch einen Sitz in DE hat. Protectli gehört, glaubt man dem Internet, zu den weltweit größten Herstellern von Firewall Hardware. Da es schnell gehen musste das hier bewertete Modell VP2420(Prime) bestellt. Lieferung über Amazon am nächsten Tag. Hat man etwas mehr Zeit kann man die Modelle auch auf der Protectli Seite nach eigenen Wünschen konfigurieren. Bis zum TPM Modul ist alles möglich. Installiert habe ich 32GB Arbeitsspeicher, M.2 SATA mit 512 GB und eine zusätzliche SATA SSD mit 2TB (nur um zu sehen was geht). Hier direkt ein kleiner Hinweis, 2,5 Zoll Laufwerke die etwas dicker sind als üblich wie z.B. eine 4TB Seagate Barracuda passen nicht in das Gehäuse. Die Verarbeitung des Gerätes ist makellos, der Lieferumfang entspricht allem was man braucht, es wurde an alles gedacht. Bei der Hardware darf man sich nicht täuschen lassen. Auch wenn sie nicht ganz aktuell ist (z.B. kein DDR5 oder NVME), ist sie für die gewählte Aufgabe mehr als performant genug. Installiert habe ich, zunächst als Test, Proxmox und PFSense in einer virtuellen Maschine. Diese Konstellation bleibt aber tatsächlich erhalten, da sie sauber läuft. Treibt man die Hardware ans Limit wird das Gehäuse maximal handwarm (CPU bis ca 45-50 Grad), obgleich der volle CPU Takt ansteht. Warum das bei Protectli geht und bei anderen Geräten nicht ist mir schleierhaft. Konfiguriert mit einem kleineren Paketfilter, IDS(Snort) sowie einem HTTP/HTTPS Proxy(Squid inkl. AV) wird die CPU (1 Socket 2 Core in der VM) unter PFSense im normalen Büroaltag auf bis zu 70% Spitze hoch getrieben (ohne Proxy gut 25% max), ehrlicherweise ist aber z.B. der AV hier eigentlich nicht wirklich erforderlich, er frisst ordentlich Leistung. Es werden sowohl OpenVPN als auch WireGuard Tunnel genutzt für die Einwahl in das Netz. Beide laufen stabil und performant, ich habe allerdings keinen Vergleich zu anderer Hardware an dieser Stelle. Ein weiterer Server 2019 in einer VM als (Secondary) DC änderte an der CPU Last so gut wie nichts, er hat aber auch nicht viel zu tun und dient nur als Backup. Unterm Strich hat Protectli mit dem vorliegenden Gerät ein rundes Paket geschnürt. Für den Aufgabenbereich mehr Leistung als benötigt, sauber verarbeitet und im Betrieb im besten Sinne des Wortes unauffällig. Der im Vergleich mit anderen Herstellern höhere Preis bei gleicher Hardware (CPU, NIC) ist aufgrund dessen was man bekommt mehr als gerechtfertigt. Ohne Frage ein 5* Produkt für mein Anwendungszenario.

Als opnsense appliance sehr gut. Das Aufsetzen ist sehr einfach. Stabiler Betrieb. Die Betriebstemperatur der CPU liegt zwischen 48C und 60C. Kleiner Tip; zweite SATA SSD einbauen und via Rescuezilla (auf einem USB-Stick) das System clonen.

This box is incredible, the amount of IO and options like SIM modem and WIFI for openWRT setups is amazing. And enough horsepower to run a hypervisor like proxmox and virtualize your router with room left over for other projects.