pfSense on Watchguard M370
-
@networkBob Nice finding, im also interested in 1 unit to use PfSense.
Is there a chance you could detail what hardware is inside the unit of the Picture?
CPU Type and model, Memory, NIC Chips, ETC. Thanks. -
Have a look here.
-
@stephenw10 Thanks
I already purchased 1 unit, from an etailer on a "difficult to pass" Price (28 bucks with shipping) , just waiting to receive it to make some test with some parts I have laying around.
I assume that any Skylake CPU showed in the hardware manual you have provided will work. Maybe upgrading the ram to a 8gb or more, perhaps (32gb Max) will be Overkill. The only downside of this unit is it doesn't have the expansion Port as M470 to M670 models. Would be great to find a PCI Express adapter to place this expansion on a drilled hole in the M370. But the cost of those expansion modules are skyrocket and I haven't find info on the Interface used.As soon as I receive the unit, I'll be posting my testing results and experiments.
Thanks to @networkBob for the info and picture.
Have a nice day.
-
@nicknitro said in pfSense on Watchguard M370:
28 bucks with shipping
Ha, yeah hard to pass that up!
I would expect most skylake CPUs to work but I'm not sure anyone has tested that... yet.
If you look at the NCA-4210 it lists a lot. The board here is marked NCB-4210 and is customised for Watchguard so it's hard to say exactly what might work.
Steve
-
@networkBob said in pfSense on Watchguard M370:
Hi everyone,
I recently bought a Watchguard M370 with the intention of repurposing the box to run pfSense. Just wanted to let the community know that pfSense can be easily installed on a Watchguard M370, via mSATA, and with all interfaces operational. Even the front panel soft power switch halts and boots pfSense, which is nice. And the fans are reasonably quiet, although the could be quieter. The BIOS is password protected, though, so I cannot make any BIOS adjustments to the fans. The motherboard is a Lanner NCB-WG4210. If anyone knows how to unlock this BIOS, please let me know. I already tried removing the battery, the CMOS reset jumper procedure, and all the AMI BIOS passwords that I could find. The BIOS only allows for 3 tries then requires a reboot.
Bob
I just got this model myself for the same purpose. Since this is my first pfSense setup, would you be willing to describe how you went about installing it on this model?
Is the selected pfSense (2.4.4-p3) download configuration correct?
Architecture: AMD64
Installer: USB Memstick
Console: SerialWould I simply replace the shipped mSATA SSD with my own, set up a console session (Cisco-compatible pinout?) from my laptop to the unit, plug in the USB drive containing the pfSense image, wait for the M370 to boot from the USB drive, then proceed?
Thanks!
-
Almost certainly a Cisco style console cable will work. They do work with other Lanner devices.
The first thing I would try is to just boot the memstick serial image from USB. It may or may not boot from USB by default.
If it does not you can always install pfSense to mSATA in some other device and swap it in.Steve
-
USB stick doesn't seem to be successful - how would I get the pfSense image onto the mSATA drive otherwise?
-
If I were doing this I would move the mSATA drive (or use a different mSATA drive) to a different device and install to it there then move it back.
Does it boot from USB if you remove the mSATA drive? In other words is it just booting from mSATA because of the boot priority?Steve
-
@stephenw10
I just see a BIOS password prompt when the USB drive alone is present. -
I managed to get the live CD image installed via VMWare USB passthrough to the mSATA adapter with a GPT partition scheme (should it be MBR instead?), then installed the drive in the M370. I heard a weird chime on boot and some disk activity.
Can't seem to use the console and can't reach 192.168.1.1 . Is there a way to verify the install?
-
Here's why I'm an idiot:
The installation was correct. I was plugged into the WAN port.
pfSense is good to go. Thanks, Steve.
-
If you install from a CD image you won't have the serial console enabled by default. You can do so (and set it as the primary console) from System > Advanced > Admin Access. You could do that in whatever you installed in before you swap the drive back.
Steve
-
This setup has been running smooth so far (minus my mistakes) and performance has been really good.
An 'instant-on' IPSec VPN running the highest level encryption at or beyond my Internet service speeds is super nice. Native iOS/MacOS support is a treat. I wish Windows 10 had native IPSec support - any chance for pfSense PPTP support? (I kid!)
I replaced the stock 40mm fans with three Noctua NF-A4x20 units. The fans' connectors weren't going to match up with those on the mainboard, so I used my flush cutters to remove their physical keying. It's whisper-quiet now and I've measured no meaningful increase in temperature.
Following a power outage and during my fan replacement testing, I learned that I made the mistake of originally installing pfSense with the UFS file system instead of ZFS. A few reboot loops later, recovery became simple enough to handle, but I'm still going to reinstall.
There's also a Core i3-6100T lying around that I'm eager to drop in to replace the included Celeron G3900. Higher clocks, lower TDP, more cache, and SMT can't hurt. Thinking and writing - is there a way to test VPN and overall performance before / after?
This has been a fun project. Thanks again for the help, Steve!
-
I usually use iperf3 for a basic throughput test. You would want to run it on a client at each end of the VPN, not on the firewall itself if possible though you can install it on pfSense. It only tests full size TCP so you see the biggest number you could get which is often not representative of real traffic but it will give you a good comparison between the two CPUs.
Steve
-
Just gonna leave this here:
[2.4.4-RELEASE][root@m470.stevew.lan]/root: ./WGXepc64 -l green Found Firebox M370/470/570/670. [2.4.4-RELEASE][root@m470.stevew.lan]/root: ./WGXepc64 -f Found Firebox M370/470/570/670. Current fanspeed is c, minimum fanspeed is a
https://github.com/stephenw10/WGXepc
Binary for anyone wanting to test. I've seen no problems but messing with the cooling system is potentially dangerous. You should test any new settings at full load etc.
Steve
-
Hi @stephenw10
This Works perfect, combined with ShellCMD on startup.
BTW
Im running M370 with installed Celeron G3900 and only changed mSATA 16g to mSATA120g that it was on my techstuff. Using it with 4Gb but i tested up to 16Gb with Crucial nonECC Memory.
The Thing is i tried a Xeon E3-1225 v5 that i bought for a server (The same listed for M570) and doesnt boot at all, maybe Motherboard or BIOS limitations.
Do you thing a i3 6100 non T model would work ?
Is there any Chance to Find the BIOS password?
Maybe unlock the BIOS as the one on M400 or X Series ?What do you think?
Regards.
-
Ah, good info! I would expect a 6100 i3 to work there. I just haven't seen one at a price I can justify.... yet.
Unlocking the BIOS is non-trivial. Finding the password is probably never going to happen.
Steve
-
I have a few M370 models 470, 570, 670, 10 g card
-
@nicknitro I have been trying to remove the BIOS password, but have not been successful.
I install the E3-1240 l V5, 4 * 10 g CARDS. -
Oh nice! Those 10G cards are still waaay outside my price range.
I do have one of the older Lanner style for the XTM800/1500 which works fine.
Steve
-
I removed your other thread, it has nothing to do with firewalling.
If you look 5 posts up though you will see that WGXepc can now detect and set the fan speed on that board. I don't have access to an M670 to test with but they are all the same board AFAIK so it should work. Give it a try.
Steve
-
@stephenw10 In my here is very cheap, 650 yuan; 100 dollars.
-
@stephenw10 BIOS password has been unable to clear, the research for many days.
4 * 10 g network card is very cheap, less than $100, China's 650 yuan. -
I haven't seen one for less than ยฃ1000 here. So I don't have one.
-
@stephenw10 This equipment is our China Taiwan production, all is very cheap in China.
-
@networkBob I buy is M670, has been looking for a BIOS password.
-
If it's just the fan issue try WGXepc. I only have an m470 to test with but it's reported working with the m370 also and I believe they are all the same board so included the description for all of them in the code.
Steve
-
@stephenw10 How do you do you have a way of regulating M470 fan speed, speed is too high, it's very noisy.
-
Yes, download WGXepc from here https://forum.netgate.com/post/861920 and run it. You should be able to set the fan speed and the arm/disarm LED.
I've never tested a 670 as I don't have one but we know it works on the 370 and 470 and they are the same as far as I know.Be sure to test it under load etc with whatever fan speed you choose as the CPU in the m670 has a higher TDP.
Steve
-
Hello to all. Thanks to all the shared info.
I got recently a WG M470 HA.
I'm lay down here cuz the WG people, told me a HA unit cannot be activated by itself, no standalone license. And depends on other units on same network.
That was a subtle way to say from those F was a waste of money and cannot use it.
In any case I can't trough out the money, so I was looking the way to install Pfsense on it.
Replace the mSata for a TSMicro 128G, keep the original one aside for the future if needed, and install a Kinston 480G SSD
Here come some questions, hopefully i will get some ideas.
1- Is required a SSD and the mSata? Or only would do the job?
2- If not required, can the SSD be used aside for with purpose? Considering the mSata will be principal.
3- Is my first time using a console conection to manage a firewall, the WG had come with his own cable, how do I use that? need a serial port Pc capable of, but then how do I connect with Windows to make the installation
4- I already put the flash pfsense into a USB 32G with Rufus, waiting to see how I clear the installation procedure in my head.
Thanks in advance for your support and help.
-
You can use just mSATA. pfSense does not support two drives in any inclusive way unless you set them up as a mirror which is probably not what you want.
The M470 will not boot from USB into the installer. The default BIOS settings do not allow is and it is password locked so you can't change that. You need to install pfSense to the mSATA drive in something else and then move it across.
Nothing special is required after that. If there were no igb NICs in your install device you will need to reassign WAN and LAN at the serial console at first boot.
Have fun!
Steve
-
@stephenw10 said in pfSense on Watchguard M370:
You can use just mSATA. pfSense does not support two drives in any inclusive way unless you set them up as a mirror which is probably not what you want.
The M470 will not boot from USB into the installer. The default BIOS settings do not allow is and it is password locked so you can't change that. You need to install pfSense to the mSATA drive in something else and then move it across.
Nothing special is required after that. If there were no igb NICs in your install device you will need to reassign WAN and LAN at the serial console at first boot.
Have fun!
Steve
Hi, thanks for your answer.
Question, since I having a hard time to get a mSata adapter. Can I use the SSD only? Meaning, I install the SSD in a PC, and then connect it to the sata port, without the mSata connected.
Lets see how lucky I'm am.
Regards.
-
I have never tried that but it may well work. I know others have done it on the M400 for example.
Steve
-
I want to confirm. Thanks for all your advice.
I been capable to install it without any problem.
ibg0 was WAN, ibg1 was a dhcp lan which allow me to connect to the router a finish the installation process.
Just a bit of netgating (googling forum) give me the params for the serial connection (baud rate 115200)
And Voila!...
But find out later on the console connection is not required for installation, just deploy the installation in the disk, and insert it.
Wait some time for the funny bip sounds and ready to connect.
Also thanks to another user above, used the right file system during installation.
I may assume in theory, the M470 and the M470 HA are same way, hardware appliance Pfsense capable (which was my main worry).
Keep informed.
Cheers...
-
The HA hardware is identical as far as know.
It's good to have console access available even if you don't need it...yet.
-
Hi Bob, can u explain hot to I can install pfSense on my M370? I buyed in error this machine "High Availability (HA) Device" and I cant activate it without another M370. I think with pfSense I will have full functionality.
Thanks a lot -
@stephenw10 said in pfSense on Watchguard M370:
reassign WAN and LAN at the serial console
Hello, how I cano do? I need serial cable? I have only m370 ha and pc.
Thanks a lot -
Yes you need a serial console cable. You might be able to do something with pre-defined interfaces but use the console is going to be easier.
There is (currently) no way to boot from USB so you need to install to mSATA in something else and then move the card into the M370.
Steve
-
@stephenw10 said in pfSense on Watchguard M370:
Yes you need a serial console cable.
Ok... I will try with this cable
I can install directly pfSense with console cable on Firebox or I must attache mSata drive on my pc and after installation move drive to Firebox?
Thanks a lot
-
You still need to install in something else as there is no way to make it boot USB, the BIOS is locked.
You could potentially write the install image to mSATA and add a SATA drive to install to. But that still means writing the image to mSATA in something else. You might as well install to it dircetly at that point.
One you install to it, in the other device, you may need to boot into pfSense to enable the serial console if it's not a serial device and then it will configured with the NICs in that device. If they (or it) are not igb the interfaces will need to be re-assigned at the console in the m370 when the drive is moved across.Steve