Hardware advice: Low-power 25 Gbps router

General questions
,
1

Hi everyone,
I’m planning a low-power (~20W idle) VyOS router for a 25G residential FTTH connection.

Would an Intel Core i3-12100 with a Mellanox ConnectX-4 Lx and 8GB RAM be good enough for a simple homelab setup running basic NAT and a stateful firewall (~40 rules), with no QoS or heavy VPN?

Thanks in advance

2

Unless you go for VPP then you want as fast cores as possible since a single TCP/UDP-stream will utilize a single core (otherwise you would have a nightmare of packets being forwarded out-of-order).

Other than that by 25Gbps do you mean simplex or duplex (so the CPU must be able to deal with 50Gbps in total) and do you mean 64 or 1500 byte packets or even IMIX?

What are your other options than i3-12100?

3

Forgot to mention…

Even if you dont go the VPP route dont forget to enable flowtables to get a speedboost.

Here are some interesting reads on this topic and VyOS:

4

To use flowtables you do something like:

  1. Add interfaces for the flowtable (eth1 being WAN and eth2 being LAN in this example (eth0 being MGMT so thats not part of the flowtable)):
set firewall flowtable PROD interface ‘eth1’
set firewall flowtable PROD interface ‘eth2’
set firewall flowtable PROD offload ‘software’
  1. For below you need to add allowed traffic in forward, in below example I have also disabled IPv6:
set firewall ipv4 forward filter default-action ‘drop’
set firewall ipv4 forward filter rule 10 action ‘offload’
set firewall ipv4 forward filter rule 10 offload-target ‘PROD’
set firewall ipv4 forward filter rule 10 state ‘established’
set firewall ipv4 forward filter rule 10 state ‘related’
set firewall ipv4 forward filter rule 20 action ‘accept’
set firewall ipv4 forward filter rule 20 state ‘established’
set firewall ipv4 forward filter rule 20 state ‘related’
set firewall ipv4 forward filter rule 999999 action ‘drop’
set firewall ipv4 input filter default-action ‘accept’
set firewall ipv4 output filter default-action ‘accept’
set firewall ipv4 prerouting raw default-action ‘accept’
set firewall ipv6 forward filter default-action ‘drop’
set firewall ipv6 input filter default-action ‘drop’
set firewall ipv6 output filter default-action ‘drop’
set firewall ipv6 prerouting raw default-action ‘drop’

As the story goes first packet of a flow will get allowed (not mentioned above as in you need to add which flows you wish to allow).

Then next time a packet is seen it will hit being established/related.

Then third time a packet is seen for this flow its being offloaded to the flowtable so I think not until packet number 4 arrives for a flow that will be completely offloaded to the flowtable and never hit the “slowpath”.

5

Yea, flowtables makes a real difference to performance. I’ve an old i3 thing I use as a router and it used to struggle to get linerate pppoe at 1G until I enabled flowtable offload.