All-in-one homeserver, advisable?



  • I see a lot of people here recommend others to run dedicated firewalls and not multipurpose servers. I don't understand why that is the case.

    I am using an old netbook (has enough CPU power to handle everything. Talking about a small network) as a pfsense router/firewall. I want to add a local Asterisk server (for intercom purposes) and a public PHP/Apache server for torrentflux-b4rt.

    Ideally I would've used a couple of VMs and isolated everything, but that'll probably eat up too much power. My netbook isn't capable of running VMs. I don't have a server atm, I'll have to use my workstation instead.


  • LAYER 8 Global Moderator

    Then do so - but pfsense is not going to be a good choice, its designed to be a router/firewall - not a asterisk server, or a web server to or torrent box, etc.

    If you want you can surely install that on the freebsd that pfsense runs on - but it has been highly customized to be a router/firewall only.

    If you want to run an all in one box that also does other stuff.. Look more to something like http://www.clearfoundation.com/Software/overview.html ClearOS or http://www.zentyal.org/ or http://www.amahi.org/

    As to not able to run VMs?  How is that - anything can run vms..  VirtualBox will run on its just fine I would assume or Vmware player/workstation etc.. etc..



  • @johnpoz:

    Then do so - but pfsense is not going to be a good choice, its designed to be a router/firewall - not a asterisk server, or a web server to or torrent box, etc.

    If you want you can surely install that on the freebsd that pfsense runs on - but it has been highly customized to be a router/firewall only.

    If you want to run an all in one box that also does other stuff.. Look more to something like http://www.clearfoundation.com/Software/overview.html ClearOS or http://www.zentyal.org/ or http://www.amahi.org/

    As to not able to run VMs?  How is that - anything can run vms..  VirtualBox will run on its just fine I would assume or Vmware player/workstation etc.. etc..

    I'll consider those options. For now everything that I needed is available under pfsense packages. And pfsense seems to be extremely easy to configure. It feels like it'll "just work"

    I can't run VMs because my netbook is one of those 32 bit Atoms that wouldn't even be able to handle gigabit routing.
    The CPU doesn't support virtualization and is very slow. It can't even perform decent enough for a single user, I doubt it is going to be able to handle the overhead of the VM OSes.


  • LAYER 8 Netgate

    Another home server worth a look is FreeNAS.  It will probably meet all your storage needs and you can install jails, etc, for other applications.  And it's FreeBSD like pfSense.  :)



  • Sure - A collection of VMs behind a pfsense VM is a perfectly reasonable setup.

    Assuming you have to memory and cpu for it.


  • LAYER 8 Global Moderator

    What is the actual cpu?  I think you would be surprised really..  esxi prob even run on it, etc.



  • @Derelict: I don't use Nas. I might need to because of tf-b4rt. I'm interested in the jails feature particularly. Any reason pfsense can't do that?

    @johnpoz: Like I said my CPU doesn't support virtualisation and is 32 bit. ESXi doesn't support it.

    It's an Intel Atom N270 with 1 Gb Ram.
    The netbook is Acer Aspire One ZG5.


  • LAYER 8 Global Moderator

    Well then use virtualbox or kvm, or QEMU or OpenVZ, etc..  There are plenty of options for 32 bit cpu.

    Or spend a couple of bucks and get a box you can run VMs on - total investment for my N40L box was like $300, that was with bumping ram to 8gb and extra nics.



  • Don't run all that crap on an atom…



  • @johnpoz:

    Well then use virtualbox or kvm, or QEMU or OpenVZ, etc..  There are plenty of options for 32 bit cpu.

    Or spend a couple of bucks and get a box you can run VMs on - total investment for my N40L box was like $300, that was with bumping ram to 8gb and extra nics.

    @kejianshi:

    Don't run all that crap on an atom…

    The CPU is capable of running a couple of server applications that are going to be idle most of the time. VMs on the other hand, I doubt.

    I have a box that can run VMs, it uses a lot more power. 2.5W TDP on that Atom vs 80W TDP on the server. The server also has peripherals for other VMs (like a 60W GPU). The other VMs don't need high availability as compared to pfsense, asterisk and tf-b4rt.
    I am adamant on using the netbook because it is capable of running everything I need, I don't have to set up a new system… and because the netbook pretty much can't be used for anything else.

    ClearOS, amahi etc seem like the best option. I guess I'll give that a shot. Thanks for the help :)


  • LAYER 8 Global Moderator

    "VMs on the other hand, I doubt."

    How much do you think a linux distro running apache needs exactly?  99% of the time its not doing anything?  Are you actively going to be doing torrents on this??  I never understand why anyone does this out of their house or even their own connection any more.. Why not throw it on a box in a DC with actually real type connection.. I have a seedbox in the NL that is like 8$ a month with 800GB of storage and gig connection..  Why should I power up anything in my house, use my bandwidth, be it old hardware or not for that kind of pricing?

    Then if there is something on there I want local - I can max out my download pipe for a couple of minutes and there you go..



  • @johnpoz:

    "VMs on the other hand, I doubt."

    How much do you think a linux distro running apache needs exactly?  99% of the time its not doing anything?  Are you actively going to be doing torrents on this??  I never understand why anyone does this out of their house or even their own connection any more.. Why not throw it on a box in a DC with actually real type connection.. I have a seedbox in the NL that is like 8$ a month with 800GB of storage and gig connection..  Why should I power up anything in my house, use my bandwidth, be it old hardware or not for that kind of pricing?

    Then if there is something on there I want local - I can max out my download pipe for a couple of minutes and there you go..

    I need torrentflux to handle my downloads. Bandwidth is expensive where I live, so one has to deal with overnight downloads on a regular basis.


  • Netgate Administrator

    I'd be surprised if there wasn't some virtualisation solution that would work for you. The overhead isn't that much for many cases.
    What sort of bandwidth are we talking about here? Are you running packages or VPNs? It could be you're approaching the limits of what your Atom can do anyway but if not then try running as a VM.

    Steve



  • @stephenw10:

    I'd be surprised if there wasn't some virtualisation solution that would work for you. The overhead isn't that much for many cases.
    What sort of bandwidth are we talking about here? Are you running packages or VPNs? It could be you're approaching the limits of what your Atom can do anyway but if not then try running as a VM.

    Steve

    WAN1: down: 2mbps up: 512kbps (ADSL)
    WAN2: down: 7.2mbps (Mobile)
    WAN3: down: 7.2mbps (Mobile)
    LAN: Wifi n / 100mbps LAN.

    WAN1 is limited to 20 GB data transfer, after which it becomes 512mbps d/l. WAN1 is unreliable. After 5 GB of download WAN2 and WAN3 become unusable.

    CPU usage on my Atom with pfsense and Asterisk is under 7%. I have 3 phones and <15 network devices (closer to 4 on average.)


  • Netgate Administrator

    So your maximum throughput is <20Mbps, assuming you're load balancing the three WANs. Even the slowest Atom would have no problems with that as you've seen. If you run Snort or VPNs though that won't be the case.
    If you have the time try running as a VM. At the very least any performance results you get would be interesting.

    Steve



  • @stephenw10:

    So your maximum throughput is <20Mbps, assuming you're load balancing the three WANs. Even the slowest Atom would have no problems with that as you've seen. If you run Snort or VPNs though that won't be the case.
    If you have the time try running as a VM. At the very least any performance results you get would be interesting.

    Steve

    My only choice here is to try virtualbox. My hardware doesn't support any type 1 hypervisor.

    Again the ideal thing would be for each server to run in its own VM. That is 3 VMs, or at least 2: one for pfsense and one for Apache/Asterisk.
    I don't think running Apache/Asterisk on the VM host would be smart. I'll get myself a lightweight linux os host and try to do this then.


  • LAYER 8 Global Moderator

    @shebang1234:

    I don't think running Apache/Asterisk on the VM host would be smart. I'll get myself a lightweight linux os host and try to do this then.

    Why??

    CPU usage on my Atom with pfsense and Asterisk is under 7%. I have 3 phones and <15 network devices (closer to 4 on average.)

    So this is doing NOTHING so why do you think you can not break it out to its own VM??  Your apache is not going to be a site like amazon now is it ;)  So how much do you think it would draw??



  • @johnpoz:

    @shebang1234:

    I don't think running Apache/Asterisk on the VM host would be smart. I'll get myself a lightweight linux os host and try to do this then.

    Why??

    CPU usage on my Atom with pfsense and Asterisk is under 7%. I have 3 phones and <15 network devices (closer to 4 on average.)

    So this is doing NOTHING so why do you think you can not break it out to its own VM??  Your apache is not going to be a site like amazon now is it ;)  So how much do you think it would draw??

    What I meant was that I'll have to run 2 VMs at least because Apache and Asterisk on a host that is running a VM with pfsense in it would be a potential security threat.

    <rant>Quite honestly, maybe I am just biased, I can't imagine running three different OSes on that machine. I understand that virtualisation can give you near native performance now, I just don't think it can come anywhere close without 64-bit instructions, Vt-x and Vt-d.
    I am saying this from previous experiences. I have a hard time keeping the machine responsive with just one OS on it.</rant>

    That said, I AM going to try running everything on vbox anyway. If everything works, great! otherwise I'll figure out a different solution.


  • LAYER 8 Global Moderator

    here is my copy of 32bit ubuntu running on my esxi box – if its sitting there idle, its not going to be pulling any cpu, etc.

    your other 2 vms are not going to be doing much of anything anyway - so just having the os installed and up an running is not really much overhead, etc.




  • I'd agree that an n2700 is fully capable of doing nothing when several VMs are loaded.

    The problem is when all those VMs suddenly have something they should be doing at same time.

    Thats when you will be hurting.

    When I provision a system, I provision it with the idea of all the VMs working 100% under a full load.

    I don't give any consideration to how well they work when idle.


  • LAYER 8 Global Moderator

    Agreed he should be sized while loaded - but he has

    "I have 3 phones and <15 network devices (closer to 4 on average.)"  He is not serving up to the 100k users a website..  Pretty sure that cpu is going to set there idle.. With a few cycles here and there when he loads up a page via apache or a call comes in..

    It sure is not going to be pushing packets with a 2mbps/512Kb connection ;)





  • Looks better.



  • So I did get a virtualbox to run on that machine with Ubuntu server 14.04 LTS. Apache/Asterisk VM was impossible to setup through virtualbox (it failed trying to configure the CD.) Managed to transfer a configured appliance and got everything running.

    pfsense works just fine. Right now, the VM usage on host is 15% in top (effectively just 7.5%.) Although even small tasks spike the usage to 100%.
    This is the same for the asterisk/tf VM. Something like package configuration make the CPU usage go crazy. And apart from that, passing through USB mobile broadband dongles seems to be such a pain (hasn't worked yet.)

    The only problems I am facing are, ZFS complaining of low memory on startup (potential problem.) High average loads (where ubuntu just refuses to give me load data at boot time.) and high CPU usage of the asterisk VM even on idle (around 40% I don't know if it'll scale well under load.)

    What are the problems I am likely to face if I move apache and asterisk to the ubuntu host? I'll only open ports to apache.

    Possible solutions that I thought of were to move apache to an OpenVZ container. Perhaps set up VPN access to apache on the VM host.

    Apologies in advance. I realize that I am going offtopic now. I appreciate the help anyway.

    PS: wcrowder: Used servers are a little hard to find where I live. ebay has few option. Other websites have used servers being sold in cities where there are more IT related companies. … and I am a college student, I'd need to save money for a few months before I could buy something worth $100. T_T
    That said, I have back up options. An E3-1230v3 that sits idle (or is switched off) most of the time, and a C2D E4300 that's just lying somewhere doing nothing. I am just trying to find a use for this weak machine.


  • LAYER 8 Global Moderator

    "(it failed trying to configure the CD.)"

    What??  Why would apache or Asterisk need a CD??

    As to ZFS - that can be completely ignored not even used..



  • @johnpoz:

    "(it failed trying to configure the CD.)"

    What??  Why would apache or Asterisk need a CD??

    As to ZFS - that can be completely ignored not even used..

    I couldn't install Ubuntu. It gave me apt-cdrom errors and the set up crashed. I had to make an appliance and then use it there.

    Setting up mobile broadband is giving me a headache. For some reason everything works fine for some time, and then my dongles disconnect because they aren't getting echo responses over ppp. After which the dongles refuse to connect. I don't know if it is because of the USB passthrough or just because pfsense doesn't support my modem.



  • Sure its not powering down the USB ports when you haven't touched the machine for a while?



  • @kejianshi:

    Sure its not powering down the USB ports when you haven't touched the machine for a while?

    Oh my God. Thank you! That worked. I wouldn't have thought that Ubuntu was powering the device down in less than a minute! It's been running for 7/8 minutes now.

    EDIT: Scratch that. It failed eventually, just took a little longer than before.

    Here's the log

    
    Sep 27 15:11:22	ppp: [opt1_link0] LCP: no reply to 4 echo request(s)
    Sep 27 15:11:32	ppp: [opt1_link0] LCP: no reply to 5 echo request(s)
    Sep 27 15:11:32	ppp: [opt1_link0] LCP: peer not responding to echo requests
    Sep 27 15:11:32	ppp: [opt1_link0] LCP: state change Opened --> Stopping
    Sep 27 15:11:32	ppp: [opt1_link0] Link: Leave bundle "opt1"
    Sep 27 15:11:32	ppp: [opt1] Bundle: Status update: up 0 links, total bandwidth 9600 bps
    Sep 27 15:11:32	ppp: [opt1] IPCP: Close event
    Sep 27 15:11:32	ppp: [opt1] IPCP: state change Opened --> Closing
    Sep 27 15:11:32	ppp: [opt1] IPCP: SendTerminateReq #6
    Sep 27 15:11:32	ppp: [opt1] IPCP: LayerDown
    Sep 27 15:11:34	ppp: [opt1] IFACE: Down event
    Sep 27 15:11:34	ppp: [opt1] IFACE: Rename interface ppp1 to ppp1
    Sep 27 15:11:34	ppp: [opt1] IPV6CP: Close event
    Sep 27 15:11:34	ppp: [opt1] IPV6CP: state change Stopped --> Closed
    Sep 27 15:11:34	ppp: [opt1] IPCP: Down event
    Sep 27 15:11:34	ppp: [opt1] IPCP: LayerFinish
    Sep 27 15:11:34	ppp: [opt1] Bundle: No NCPs left. Closing links...
    Sep 27 15:11:34	ppp: [opt1] IPCP: state change Closing --> Initial
    Sep 27 15:11:34	ppp: [opt1] IPV6CP: Down event
    Sep 27 15:11:34	ppp: [opt1] IPV6CP: state change Closed --> Initial
    Sep 27 15:11:34	ppp: [opt1_link0] LCP: SendTerminateReq #2
    Sep 27 15:11:34	ppp: [opt1_link0] LCP: LayerDown
    Sep 27 15:11:36	ppp: [opt1_link0] LCP: SendTerminateReq #3
    Sep 27 15:11:38	ppp: [opt1_link0] LCP: state change Stopping --> Stopped
    Sep 27 15:11:38	ppp: [opt1_link0] LCP: LayerFinish
    Sep 27 15:19:07	ppp: Multi-link PPP daemon for FreeBSD
    Sep 27 15:19:07	ppp:
    Sep 27 15:19:07	ppp: process 90236 started, version 5.7 (root@pf2_1_1_i386.pfsense.org 08:21 15-Aug-2014)
    Sep 27 15:19:07	ppp: [opt1_link0] Link: DOWN event
    Sep 27 15:19:07	ppp: [opt1_link0] LCP: Down event
    Sep 27 15:19:07	ppp: [opt1_link0] LCP: state change Stopped --> Starting
    Sep 27 15:19:07	ppp: [opt1_link0] LCP: LayerStart
    Sep 27 15:19:07	ppp: [opt1_link0] Link: reconnection attempt 1 in 3 seconds
    Sep 27 15:19:07	ppp: caught fatal signal term
    Sep 27 15:19:07	ppp: [opt1] IFACE: Close event
    Sep 27 15:19:07	ppp: [opt1] IPCP: Close event
    Sep 27 15:19:07	ppp: [opt1] IPV6CP: Close event
    Sep 27 15:19:07	ppp: waiting for process 10039 to die...
    Sep 27 15:19:08	ppp: waiting for process 10039 to die...
    Sep 27 15:19:09	ppp: [opt1] Bundle: Shutdown
    Sep 27 15:19:09	ppp: [opt1_link0] Link: Shutdown
    Sep 27 15:19:09	ppp: process 10039 terminated
    Sep 27 15:19:09	ppp: web: web is not running
    Sep 27 15:19:09	ppp: [opt1] Bundle: Interface ng1 created
    Sep 27 15:19:09	ppp: [opt1_link0] Link: OPEN event
    Sep 27 15:19:09	ppp: [opt1_link0] LCP: Open event
    Sep 27 15:19:09	ppp: [opt1_link0] LCP: state change Initial --> Starting
    Sep 27 15:19:09	ppp: [opt1_link0] LCP: LayerStart
    Sep 27 15:19:23	ppp: [opt1_link0] CHAT: The modem is not responding to "AT" at ModemCmd: label.
    Sep 27 15:19:23	ppp: [opt1_link0] MODEM: chat script failed
    
    


  • Are those plugged directly into the computer?  Could you try it with a powered usb hub?

    (running low on ideas)



  • @kejianshi:

    Are those plugged directly into the computer?  Could you try it with a powered usb hub?

    (running low on ideas)

    Don't have access to one right now. And I don't think that could be the problem (the dongle LED wouldn't be ON if it was powered down, right?) Anyway, I tried all the resources I found on setting the autosuspend mode off, nothing has worked so far. I checked the uptime the last time it failed, and that was about 16 minutes. The problem I am facing is similar to https://forum.pfsense.org/index.php?topic=45157.0
    The dongle disconnects after sometime and it becomes impossible to reconnect it later (even removing and reinserting doesn't work.) When this happens, one of the PHP processes starts taking 40% CPU usage and must be killed manually for the system to work. It's just unreliable from that point onwards; I NEED to restart it to make the mobile internet or anything related to pfsense work.

    At the moment, I am using pfsense (64 bit) on VMware Workstation on a Windows 8.1 host and everything seems to be working perfectly. The link has been up for 40ish minutes and hasn't failed. I can remove the dongle as I wish, disconnect and reconnect without reboots.
    Could it just be that the dongle doesn't work well with 32 bit pfsense? Maybe I should test 32 bit pfsense on VMware or perhaps just give up on this :/



  • It could be that the port just isn't pushing enough power on its on.  I've experienced that many times with usb devices.


  • Netgate Administrator

    I would suspect some issue with the USB pass through to the VM. It's probably timing out somewhere. Maybe to save resources it only represents the USB device when it sees call to it. There could be many reasons. The USB dongle and pfSense really aren't designed/tested to operate in this way so you may be up against a insolvable issue.

    Steve



  • I fixed the problem by disabling ACPI and APM but that still didn't allow me to disconnect and reconnect the dongles. Frustrated from that and the extraordinarily high idle load values (>1 on Ubuntu and 0.7 in pfsense,) I decided not to go ahead with this. Moreover my temperatures seemed to be monotonically increasing in an air conditioned room.
    I am getting better resource utilization under VMware workstation (it idles at 1% usage.) For now this works.

    As far as the netbook is concerned. I just cannot run the firewall and server on it simultaneously if I want isolation. Perhaps a chrooted environment / jail was my best option; I don't have the patience to deal with that for now. Maybe I should have just stuck with not trying to isolate it anyway. The netbook might be repurposed as a media server / HTPC later.

    Note: I tried to get ESXi 3.5 to work on it (last version that supported 32 bit machines) but it threw a PSOD before I could install it.



  • Well - I didn't see that coming. (-;

    I'd try to find a abuse celeron dual core laptop with some missing keys cracked screen, bad battery etc that is useless to the unimaginative person who owns it…  Grab it and install Your things there.  Actually - There are probably i7 laptops like this by now that people  will almost pay you to take off their hands.



  • @kejianshi:

    Well - I didn't see that coming. (-;

    I'd try to find a abuse celeron dual core laptop with some missing keys cracked screen, bad battery etc that is useless to the unimaginative person who owns it…  Grab it and install Your things there.  Actually - There are probably i7 laptops like this by now that people  will almost pay you to take off their hands.

    Hard to find them online :S I found dual core servers for around 200 USD on ebay. I have a laptop sitting around with a 32 processor and Vt-x and a C2D E4300 desktop as alternatives.

    I might keep the netbook as a dedicated pfsense firewall. The other servers can reside in the workstation, they don't really need high availability. If I could somehow disable the LEDs in fans and power / HDD LEDs, I might be able to sleep in the same room! The power footprint may not be as high as I am imagining, I should really just measure it.



  • Using my workstation as a router/firewall was becoming cumbersome, with all those lights and stuff. I ended up moving it back to my netbook, only this time I used jails. Apparently the main features of jails are performance and security: http://www.bsdnow.tv/tutorials/jails so it seemed like the perfect choice for me.

    Everything works perfectly now. My load values are actually lower than 1.5 now! And temperatures actually decrease when the machine is idle and/or air conditioned.

    I would've liked to put the jails in a DMZ but that just can't be done I guess. There is no way to add NICs and the VLAN feature on my ADSL router seems buggy. I really should get some new networking hardware.


  • Netgate Administrator

    Interesting. So what are you running in the jails and what is hosting, FreeBSD?

    Steve



  • @stephenw10:

    Interesting. So what are you running in the jails and what is hosting, FreeBSD?

    Steve

    Host is pfsense and the jails run FreeBSD. I don't think an alternate setup is possible. I believe pfsense can't run in a jail, and jails cant run anything but FreeBSD.
    I have a guest with asterisk, and another with apache/transmission/samba.


Log in to reply