I got the Protectli Vault Pro VP2420-4 Port last year October, too soon to upgrade. But after I saw your virtualization video I am tempted to give it a shot :) - thank you for videos
It’s a higher end box so it definitely costs more, but this box is powerful enough to replace my old Ryzen 7 1700 Proxmox server with 1/4th the power consumption at idle.
You might need a more powerful system than the Protectli I featured in the video depending your needs for IDS/IPS, etc. Perhaps the Minisforum MS-01. Also running bare metal or PCIe passthrough even with the Protectli allows you to get closer to 10Gbps (unless you are using IDS/IPS). What I have been doing on my own network is avoid routing large amounts of network traffic through the firewall across VLANs. Instead, I have been multi-homing my systems so I can access my NAS or other storage backends on each of the VLANs where I need the fast data transfers (all of those systems have multiple network interfaces which makes this possible). Besides reducing the workload of the firewall, it also simplifies firewall rules on the OPNsense firewall since you do not need to create rules to access systems which live on the same networks/VLANs.
@@homenetworkguy Thanks, Have no plans to use IPS/IDS, Just want 10Gbps with NAT for a typical home setup Router: 1x 10G for WAN 1x 10G for Switch Switch: 1x 10G for Uplink 4~6x 1G links for end user devices. Netflow is a bonus but not a must, just to check top talkers. That's all. Thinking of Minisforum MS-01 or VP6670. My ISP will provide the SFP : Huawei OptiXstar S800E XGS-PON SFP+ ONU(SC/APC)
I just found your video while looking into buying a protectli. What a lot of people forget is yes it's expensive, but I would rather pick something like protectli in the EU, then order one from Ali Express (no I'm not talking about it comes from China so must be bad). More in the sense of yes it's cheaper on the website, speaking for the EU here ofcourse, but then comes along additional VAT, import duties and in the end that 600 euro device is as expensive with warranty no idea because it comes from ali express and if it breaks you can sent it back to the US or China.
Nice! Yeah I have mentioned a few of those reasons why one might buy a Protectli over some box on Aliexpress. Shipping/VAT, customer support, coreboot, and high quality chassis (especially the Vault Pro and the new V-series) are the main benefits.
@@homenetworkguy Indeed, I skimmed the other reply's and people just replying with "too expensive", yeah it's a device with 10G.. what did they expect :) I ordered a 6650 like an hour ago.
Nice! Yeah, I’ve seen other 10G boxes be at least $600-700 barebones but loaded up it was pushing $900-1100 for a non-Protectli box. It’s possible to save a little bit of money with other boxes but there’s other factors to consider as you mentioned. An added bonus with the VP6650 is that it looks really awesome! Haha.
Awesome video, I was wondering might you compare the Protectli to 45homelabs home workstation when it comes out or the 15L server? I know they are slightly different products, but I thought their use cases are close enough to warrant a comparison
Thanks! I’d love to check out the 45Homelabs products, but I don’t have any in my possession currently. All I would be able to do without physically having one is compare the spec sheets. I’m thankful when I have the opportunity to test out the hardware and try different scenarios to see what I can do with them.
@@homenetworkguy Hey so I was curious could we use the usb type c 3.2 to connect to multibay enclosure and run it in raid and get decent useable speed? Sabrent has a DAS 10 bay. I thought that would be a good way to increase the stoarge to use for a NAS setup to the protectli 6650. My plan is to get the protectli 6650 and I am going to be running promox and I wanted to have an ability to run a nas setup additionally with my other projects. I was just wondering in your opinion using something like sabrent 10 bay in raid 60 is a viable option? Or better to go with a 45homelabs setup
@@Badabingbang Using DAS may work with the VP6650 just fine but I haven’t tested that scenario to know of any gotchas. I’m not sure how reliable performance/stability of using a USB interface vs SATA/NVMe. It may be just fine. The 45Homelabs is very nice if you want a rack mount system that supports up to 15 drives. That’s if you’re really serious about storing a lot of data on a lot of drives. They have a nice custom backplane that might help with performance (and stability) compared to using a cheap SATA port replication PCIe cards. I kinda have FOMO over the 45Homelabs system. I could see myself needing something more serious like that as I make more video content because my storage needs will increase fairly quickly over time.
What does protectli exactly do except rebrand Aliexpress minipcs? Do they supply nice and steady firmware upgrades? Oooh... coreboot :) Thanks for the video though, I'm a fan
Thanks! Coreboot and customer support (especially in areas where they have a local presence). It takes a 1-3 weeks to get items shipped from AliExpress to the US (in general). Also, they have a nice quality chassis too. It feels substantial (in a good way). Some of the cheap boxes don’t dissipate heat as well so you might end up sticking fans on top. I know some users do that with the Protectli’s as well, but I haven’t found the need for that even in my slightly warmer than room temperature server closet.
It would be interesting to compare the performance since it is a little more expensive (you can max out the RAM at 64 GB and get a lot more storage on the VP6650 for a bit less then the DEC850). Of course you get 1 year of business support included in the price. I still think the Decisio hardware is beautifully engineering and aesthetically pleasing. I don't have any of the Decisio hardware for comparison purposes, but it seems like nice quality hardware.
Do you return the hardware after the review? If not, that is considered compensation. It is a paid review, that doesn't mean it is biased in any way, but most people believe that they must receive money for it to be considered compensation, however, goods and or services are also compensation as well.
I have not. I often state they sent me the unit to review without mentioning compensation. I’m still new at this so I probably misstate this sometimes. I always try to remember to check the paid promotion box on the video. I will try to be more aware of how I state this in the future videos. When I do “reviews” I prefer to do walkthrough style videos rather than a formal review to show what you get and how to set it up or what you can do with it. I may mention some things I like and don’t like but I leave it as an exercise to the viewer if they like the hardware or not. I have a follow up video coming up that’s a guide on how to do some things with the hardware.
Are you able to measure the idle power consumption when running Proxmox and how much it increases per 2.5g/sfp+ port you connect? Thank you. Protectli lists 12W idle in their datasheet.
On my written version, I have more info but I didn’t get that detailed to test per port but with a couple of interfaces plugged in and 1 SATA and 1 NVMe drive it idles between 20-22 Watts. I could test per port wattage.
@@homenetworkguy That's a bit higher than I hoped compared to what Protectli listed themselves. Of course you do get the two sfp+ ports and a performant cpu but it might make two cheaper, lower wattage devices for a separate home Proxmox server/router and NAS more interesting instead of combining everything in one.
Yeah exactly. To validate your point, I have a Protectli VP2410 and a VP2420 that I use for a dedicated Home Assistant box and a dedicated Proxmox Backup Server box. Both boxes combined idles at the same wattage as the VP6650. On the other hand, I’m running an older Ryzen 7 1700 system as my main Proxmox server which idles around 80 Watts. The VP6650 is faster at single threaded performance and is only barely slower overall due to less thread count, but it consumes 1/4th the power! From that perspective, the VP6650 is still a huge difference in power consumption. Since it has higher speed interfaces, I could easily replace my larger 4U Proxmox server with this tiny box and not skip a beat. It actually would likely be faster due to the higher single thread performance even though it might not be able to run quite as many VMs/CTs on the same machine.
Are you able to test if it is possible to passthrough the sata controller for the two sata connectors using VT-D to a VM in Proxmox (while keeping the NVME drive for Proxmox itself)? This could allow running TrueNas as a VM with native access to the drives. Thank you.
@@homenetworkguy That would be great! If you'd have the time of course. I'd also be curious if it would be possible with the lower end VP2420 that you own to VT-D passthrough the controller for the sata or m.2 sata connector. It might be the same controller for both. Of course it would be less ideal as in that case you'd lose the redundant 2nd drive for a ZFS pool.
For the VP2420, it shows up when I list the hardware as a single SATA controller. Not sure if you can pass through just one port. I haven't tried that yet and I can't easily test it on that box because I'm using it as my backup server. I know sometimes you can passthrough individual interfaces.
I have a symmetrical 1 Gbps internet connection, but I'd like to have 10 Gbps LAN for the NAS I already have, plus the bigger badder NAS I'm planning to build and a proxmox server I'm planning to setup. Do the SFP+ ports even help in that situation, assuming that either way the appliance is connected to a switch with 10 Gbps connections to the devices that need 10 Gbps LAN? Also, what are your thoughts on putting say Opnsense on this versus putting Proxmox on this and virtualizing open sense? That's a lot of money if the only thing it's going to do is route, but having bare metal opnsense would mean it wouldn't knock my internet out everytime I need to update Proxmox >_>
It is a bit overkill for just OPNsense. I’m going to use it to virtualize OPNsense and other things such as my network controllers, VMs, etc. I’m going to create a cluster to prevent issues with taking Proxmox down.
@@homenetworkguy Hi! I have a question... I have 1Gbps up/1Gbps down optical fiber. Which model of protectors should I choose (as bare metal)? And does it make sense to run Zenarmor/Suricata if the throughput drops drastically anyway?
Even the Protectli VP2410 with 1G interfaces can handle Zenarmor and Suricata without impacting performance too much (unless you run both at the same time). The VP2420 can handle nearly the full 2.5G throughput with Zenarmor but Suricata performance is less than 1G but higher than the VP2410. homenetworkguy.com/review/protectli-vp2410/#zenarmor-enabled homenetworkguy.com/review/protectli-vp2420/#zenarmor-enabled
Too many video cuts that’s not spliced good. Some technical aspects weren’t explained correctly like the purpose of using intel nic chipset and not realtech or other nic manufacturers with services and hardware offloading vs software offsets. I would’ve really like to see why buying this over netgate made sense.
Sorry about that. I didn’t really intend to compare the difference between other brands. That is a good point about Intel vs Realtek for pfSense/OPNsense. I’m hoping to improve as I make more videos.
It is expensive. Most mini-PC boxes that have 10G interfaces start at least in the $500-600 range (often times bare bones). The average home user doesn’t need a box like this but there are home networking/homelab enthusiasts who may want a box like this. You could replace an entire virtualization server with this system which only uses a fraction of the power. I’ve considered doing that with my Proxmox server: it uses 1/4th of the power when idling. (20 Watts versus 80 Watts) and it has better single threaded performance than my old Proxmox server too.
What was your RSS setting "net.inet.rss.bits = #"? Maybe that can help utilize more of your available cores. (I've never used OPNsense, so I don't know if that would help)
I tried setting it to 3 which is 8 cores but when I ran the netstat -Q command it showed 12 threads. It did help performance in a few areas but didn’t utilize the overall CPU as much. It’s like it spread it across more cores but nothing fully utilized the entire core. I think it’s the nature of how not many of the services take full advantage of multithreading. The OPNsense documentation already states that re-injecting packets to network stack is a single threaded operation with netmap: docs.opnsense.org/troubleshooting/performance.html
@@homenetworkguy Thanks for posting the video and responding. I wonder if those idle cores kick in if all the NIC's are saturated simultaneously. I'm scoping out upgrading firewall/switch for my next system, but this one looks a bit overkill for my needs.
Yeah I’m not sure. I could tried both 2.5G and 10G iperf3 tests at the same time to try to saturate more of the interfaces. iperf is good for throughput testing but it might be as good of a measure for testing different types of network traffic (to simulate real world conditions). This box is powerful enough that you could make a good case for using it as a virtualization server.
I got the Protectli Vault Pro VP2420-4 Port last year October, too soon to upgrade. But after I saw your virtualization video I am tempted to give it a shot :) - thank you for videos
Nice! I hope all goes well!
Thanks for the video! Hello from Aus!
You’re welcome!
Worth every penny... yes please!
It’s a higher end box so it definitely costs more, but this box is powerful enough to replace my old Ryzen 7 1700 Proxmox server with 1/4th the power consumption at idle.
Thank you for the video, Do you have any hardware recommendation that can sustain 10Gbps(WAN and LAN Port) with NAT and Netflow?
You might need a more powerful system than the Protectli I featured in the video depending your needs for IDS/IPS, etc. Perhaps the Minisforum MS-01. Also running bare metal or PCIe passthrough even with the Protectli allows you to get closer to 10Gbps (unless you are using IDS/IPS).
What I have been doing on my own network is avoid routing large amounts of network traffic through the firewall across VLANs. Instead, I have been multi-homing my systems so I can access my NAS or other storage backends on each of the VLANs where I need the fast data transfers (all of those systems have multiple network interfaces which makes this possible). Besides reducing the workload of the firewall, it also simplifies firewall rules on the OPNsense firewall since you do not need to create rules to access systems which live on the same networks/VLANs.
@@homenetworkguy Thanks, Have no plans to use IPS/IDS, Just want 10Gbps with NAT for a typical home setup
Router:
1x 10G for WAN
1x 10G for Switch
Switch:
1x 10G for Uplink
4~6x 1G links for end user devices.
Netflow is a bonus but not a must, just to check top talkers. That's all.
Thinking of Minisforum MS-01 or VP6670.
My ISP will provide the SFP : Huawei OptiXstar S800E XGS-PON SFP+ ONU(SC/APC)
I just found your video while looking into buying a protectli.
What a lot of people forget is yes it's expensive, but I would rather pick something like protectli in the EU, then order one from Ali Express (no I'm not talking about it comes from China so must be bad). More in the sense of yes it's cheaper on the website, speaking for the EU here ofcourse, but then comes along additional VAT, import duties and in the end that 600 euro device is as expensive with warranty no idea because it comes from ali express and if it breaks you can sent it back to the US or China.
Nice! Yeah I have mentioned a few of those reasons why one might buy a Protectli over some box on Aliexpress. Shipping/VAT, customer support, coreboot, and high quality chassis (especially the Vault Pro and the new V-series) are the main benefits.
@@homenetworkguy Indeed, I skimmed the other reply's and people just replying with "too expensive", yeah it's a device with 10G.. what did they expect :) I ordered a 6650 like an hour ago.
Nice! Yeah, I’ve seen other 10G boxes be at least $600-700 barebones but loaded up it was pushing $900-1100 for a non-Protectli box. It’s possible to save a little bit of money with other boxes but there’s other factors to consider as you mentioned. An added bonus with the VP6650 is that it looks really awesome! Haha.
Awesome video, I was wondering might you compare the Protectli to 45homelabs home workstation when it comes out or the 15L server? I know they are slightly different products, but I thought their use cases are close enough to warrant a comparison
Thanks! I’d love to check out the 45Homelabs products, but I don’t have any in my possession currently. All I would be able to do without physically having one is compare the spec sheets. I’m thankful when I have the opportunity to test out the hardware and try different scenarios to see what I can do with them.
@@homenetworkguy Hey so I was curious could we use the usb type c 3.2 to connect to multibay enclosure and run it in raid and get decent useable speed? Sabrent has a DAS 10 bay. I thought that would be a good way to increase the stoarge to use for a NAS setup to the protectli 6650. My plan is to get the protectli 6650 and I am going to be running promox and I wanted to have an ability to run a nas setup additionally with my other projects. I was just wondering in your opinion using something like sabrent 10 bay in raid 60 is a viable option? Or better to go with a 45homelabs setup
@@Badabingbang Using DAS may work with the VP6650 just fine but I haven’t tested that scenario to know of any gotchas. I’m not sure how reliable performance/stability of using a USB interface vs SATA/NVMe. It may be just fine. The 45Homelabs is very nice if you want a rack mount system that supports up to 15 drives. That’s if you’re really serious about storing a lot of data on a lot of drives. They have a nice custom backplane that might help with performance (and stability) compared to using a cheap SATA port replication PCIe cards. I kinda have FOMO over the 45Homelabs system. I could see myself needing something more serious like that as I make more video content because my storage needs will increase fairly quickly over time.
What does protectli exactly do except rebrand Aliexpress minipcs? Do they supply nice and steady firmware upgrades? Oooh... coreboot :) Thanks for the video though, I'm a fan
Thanks! Coreboot and customer support (especially in areas where they have a local presence). It takes a 1-3 weeks to get items shipped from AliExpress to the US (in general). Also, they have a nice quality chassis too. It feels substantial (in a good way). Some of the cheap boxes don’t dissipate heat as well so you might end up sticking fans on top. I know some users do that with the Protectli’s as well, but I haven’t found the need for that even in my slightly warmer than room temperature server closet.
Thx, it’s interresting to compare with decisio DEC850…
It would be interesting to compare the performance since it is a little more expensive (you can max out the RAM at 64 GB and get a lot more storage on the VP6650 for a bit less then the DEC850). Of course you get 1 year of business support included in the price. I still think the Decisio hardware is beautifully engineering and aesthetically pleasing. I don't have any of the Decisio hardware for comparison purposes, but it seems like nice quality hardware.
Do you return the hardware after the review? If not, that is considered compensation. It is a paid review, that doesn't mean it is biased in any way, but most people believe that they must receive money for it to be considered compensation, however, goods and or services are also compensation as well.
I have not. I often state they sent me the unit to review without mentioning compensation. I’m still new at this so I probably misstate this sometimes. I always try to remember to check the paid promotion box on the video. I will try to be more aware of how I state this in the future videos.
When I do “reviews” I prefer to do walkthrough style videos rather than a formal review to show what you get and how to set it up or what you can do with it. I may mention some things I like and don’t like but I leave it as an exercise to the viewer if they like the hardware or not.
I have a follow up video coming up that’s a guide on how to do some things with the hardware.
Are you able to measure the idle power consumption when running Proxmox and how much it increases per 2.5g/sfp+ port you connect? Thank you. Protectli lists 12W idle in their datasheet.
On my written version, I have more info but I didn’t get that detailed to test per port but with a couple of interfaces plugged in and 1 SATA and 1 NVMe drive it idles between 20-22 Watts. I could test per port wattage.
@@homenetworkguy That's a bit higher than I hoped compared to what Protectli listed themselves. Of course you do get the two sfp+ ports and a performant cpu but it might make two cheaper, lower wattage devices for a separate home Proxmox server/router and NAS more interesting instead of combining everything in one.
Yeah exactly. To validate your point, I have a Protectli VP2410 and a VP2420 that I use for a dedicated Home Assistant box and a dedicated Proxmox Backup Server box. Both boxes combined idles at the same wattage as the VP6650. On the other hand, I’m running an older Ryzen 7 1700 system as my main Proxmox server which idles around 80 Watts. The VP6650 is faster at single threaded performance and is only barely slower overall due to less thread count, but it consumes 1/4th the power! From that perspective, the VP6650 is still a huge difference in power consumption. Since it has higher speed interfaces, I could easily replace my larger 4U Proxmox server with this tiny box and not skip a beat. It actually would likely be faster due to the higher single thread performance even though it might not be able to run quite as many VMs/CTs on the same machine.
Are you able to test if it is possible to passthrough the sata controller for the two sata connectors using VT-D to a VM in Proxmox (while keeping the NVME drive for Proxmox itself)? This could allow running TrueNas as a VM with native access to the drives. Thank you.
I imagine it should be possible but I could test that out for you.
@@homenetworkguy That would be great! If you'd have the time of course. I'd also be curious if it would be possible with the lower end VP2420 that you own to VT-D passthrough the controller for the sata or m.2 sata connector. It might be the same controller for both. Of course it would be less ideal as in that case you'd lose the redundant 2nd drive for a ZFS pool.
For the VP2420, it shows up when I list the hardware as a single SATA controller. Not sure if you can pass through just one port. I haven't tried that yet and I can't easily test it on that box because I'm using it as my backup server. I know sometimes you can passthrough individual interfaces.
I have a symmetrical 1 Gbps internet connection, but I'd like to have 10 Gbps LAN for the NAS I already have, plus the bigger badder NAS I'm planning to build and a proxmox server I'm planning to setup. Do the SFP+ ports even help in that situation, assuming that either way the appliance is connected to a switch with 10 Gbps connections to the devices that need 10 Gbps LAN?
Also, what are your thoughts on putting say Opnsense on this versus putting Proxmox on this and virtualizing open sense? That's a lot of money if the only thing it's going to do is route, but having bare metal opnsense would mean it wouldn't knock my internet out everytime I need to update Proxmox >_>
It is a bit overkill for just OPNsense. I’m going to use it to virtualize OPNsense and other things such as my network controllers, VMs, etc. I’m going to create a cluster to prevent issues with taking Proxmox down.
@@homenetworkguy Hi! I have a question...
I have 1Gbps up/1Gbps down optical fiber. Which model of protectors should I choose (as bare metal)?
And does it make sense to run Zenarmor/Suricata if the throughput drops drastically anyway?
Even the Protectli VP2410 with 1G interfaces can handle Zenarmor and Suricata without impacting performance too much (unless you run both at the same time). The VP2420 can handle nearly the full 2.5G throughput with Zenarmor but Suricata performance is less than 1G but higher than the VP2410.
homenetworkguy.com/review/protectli-vp2410/#zenarmor-enabled
homenetworkguy.com/review/protectli-vp2420/#zenarmor-enabled
@@homenetworkguy thank you for your answer🙂
Too many video cuts that’s not spliced good. Some technical aspects weren’t explained correctly like the purpose of using intel nic chipset and not realtech or other nic manufacturers with services and hardware offloading vs software offsets. I would’ve really like to see why buying this over netgate made sense.
Sorry about that. I didn’t really intend to compare the difference between other brands. That is a good point about Intel vs Realtek for pfSense/OPNsense. I’m hoping to improve as I make more videos.
Your Amazon affiliate link goes to a Samsung SSD. ;-)
Really? I just checked all 3 of the links and they link to the proper products.
way too expensive....no thank you
It is expensive. Most mini-PC boxes that have 10G interfaces start at least in the $500-600 range (often times bare bones). The average home user doesn’t need a box like this but there are home networking/homelab enthusiasts who may want a box like this.
You could replace an entire virtualization server with this system which only uses a fraction of the power. I’ve considered doing that with my Proxmox server: it uses 1/4th of the power when idling. (20 Watts versus 80 Watts) and it has better single threaded performance than my old Proxmox server too.
What was your RSS setting "net.inet.rss.bits = #"? Maybe that can help utilize more of your available cores. (I've never used OPNsense, so I don't know if that would help)
I tried setting it to 3 which is 8 cores but when I ran the netstat -Q command it showed 12 threads. It did help performance in a few areas but didn’t utilize the overall CPU as much. It’s like it spread it across more cores but nothing fully utilized the entire core. I think it’s the nature of how not many of the services take full advantage of multithreading. The OPNsense documentation already states that re-injecting packets to network stack is a single threaded operation with netmap: docs.opnsense.org/troubleshooting/performance.html
@@homenetworkguy Thanks for posting the video and responding. I wonder if those idle cores kick in if all the NIC's are saturated simultaneously. I'm scoping out upgrading firewall/switch for my next system, but this one looks a bit overkill for my needs.
Yeah I’m not sure. I could tried both 2.5G and 10G iperf3 tests at the same time to try to saturate more of the interfaces. iperf is good for throughput testing but it might be as good of a measure for testing different types of network traffic (to simulate real world conditions). This box is powerful enough that you could make a good case for using it as a virtualization server.