HN Explorer

Ask HN: Can I safely run a made-in-China Single Board Computer as my firewall?

6 points by chatmasta ↗ HN
I want to run a single board computer as my firewall (Internet -> Modem -> SBC -> Router). I bought a Nano Pi R4S because its hardware specs seem perfect for this use case. By default it runs on an insecure fork of OpenWRT called FriendlyWRT, but it's possible to run OpenWRT mainline on it, as well as DietPi.

Assuming I successfully flash a mainline kernel onto the device, how can I trust it's still not doing something nefarious? Is it possible to "secure boot" without a trusted compute module? Or at the very least, can I verify the running kernel is the one I expect to be running?

Some other ideas I had:

- Buy a device that isn't made in China. Unfortunately the options are slim, if I want a passively-cooled dual gigabit device with multiple cores and a few GB of RAM. But there are some appealing options, like H3+ from ODroid (South Korea) and STAR64 from Pine64 (which is RISC-V and also out-of-stock). I also considered some rootable Mikrotik devices (Europe), but they don't seem powerful enough to run WireGuard efficiently.

- Monitor outgoing traffic from the SBC by adding a switch between it and the modem, with port mirroring to a monitoring device. This wouldn't eliminate risk but it would at least give me some peace of mind.

Is anyone running a setup like this? How do you stay secure?

It's crazy how hard it is to find a dual nic, passively cooled single board computer that's manufactured in a trustworthy country. There are some options that look appealing at first glance, like Orange Pi, Banana Pi, Visionfive2... but when you look more closely, things are so sketchy; there are three different Orange Pi websites, one at .org, .net and .com... all with different links in their footer! Even Visionfive2 is "open hardware," but the first step is downloading some blob from Baidu drive.

14 comments

[ 3.1 ms ] story [ 23.4 ms ] thread
boulanger75
Raspberry pi fabriqué en GB
chatmasta
Yeah, I guess that's an option. I don't know if I have a compelling reason for avoiding it, other than the high price and the fact that it requires an extra module (likely not manufactured in GB) to add the dual gigabit. And I guess I just assumed the performance will be worse than something like the NanoPi.
LinuxBender
passively cooled single board computer that's manufactured in a trustworthy country.

Not cheap but I use Protectli firewalls [1]. They have the option to be reloaded with either the Coreboot or AMI firmware. They have 2 to 6 NIC's depending on the model. They are passively cooled but have fast processors so that people can run VPN's at wire speed. They are basically a mini-PC optimized to be used as Firewalls and Network-to-Network VPN's. The NIC's are Intel.

[1] - https://protectli.com/solutions/firewall/

chatmasta
Oh cool, those do look nice, thanks! I didn't find this company in the hours I spent researching this yesterday.

They look similar in configuration and price to Fitlet [0]. Personally, $300 is more than I'd like to spend, but perhaps that's the price for a trustworthy and sufficiently powerful setup.

[0] https://fit-iot.com/web/products/fitlet3/

aborsy
I thought Protectli boxes are cheaper mini PCs from AliExpress (Qotom and similar boxes). Protectli sets them up (flashes the firmware in the case of coreboot, and installs the OS), and adds support.

But otherwise boxes are pretty good.

kjs3
I picked up a Protectli 4-port box (FW4C) recently. So far it's excellent. I did however think/assume it was made in China.
[deleted]
(comment deleted)
Throwawayhahzoh
Maybe something from https://www.pcengines.ch/ in Switzerland? Made in Taiwan for what that's worth, using AMD embedded CPUs.
chatmasta
Wow, that's perfect! The apu4d4 [0] is exactly what I want, and only $168! That's basically the same configuration and price as a NanoPi r6s. And they have over 500 in stock?! Almost seems to good to be true...

Thank you for making your first HN comment to share this link :)

[0] https://www.pcengines.ch/apu4d4.htm

Throwawayhahzoh
You're welcome.

You asked a very good question, I've been hearing very good things about PC Engines for years (except of course the now common supply chain problems), and I'd have bought my own from them except I'd already invested the Mini-ITX ecosystem for these sorts of machines long ago.

chatmasta
I ordered one :) I'm hoping their inventory counts were accurate and the supply chain issues have been smoothed out, but I don't mind waiting for quality if necessary.
aborsy
Look into models reviewed in project tinymicromini from ServeTheHome on YouTube.

Is there credible evidence that products from China are not safe?

If anything, they are under scrutiny at this point.

snvzz
>and STAR64 from Pine64 (which is RISC-V and also out-of-stock).

I wholeheartedly understand your interest in using the industry standard RISC-V rather than a legacy ISA.

But, why not VisionFive2, which uses the same SoC, has been available for longer, and is in stock?

Otherwise, if you are not in a hurry, there's LM4A[0], with a router form factor option.

0. https://sipeed.com/licheepi4a