Protectli Vault Pro VP2410 Review

The Protectli Vault Pro VP2410 is a small form-factor network appliance with a strong emphasis towards building your own OPNsense or pfSense Router & Firewall.

This particular model offers a solid barebone specification with moderate upgrade options and supports Coreboot Open Source firmware.

Currently the Protectli Vault Pro VP2410 is available on Amazon and direct to consumer from the Protectli website starting at $429.00 USD — this does not include a memory module, a normality for barebone network appliances of this nature.

Crucial 4GB DDR4-2600 SO-DIMM modules can be found online for as low as $19, conversely use memory you have on-hand, or choose to add a module when placing an order with Protectli.

For those researching hardware on HowTo build your own OPNsense or pfSense Router & Firewall, chances are you've read comments suggesting cheaper OEM alternatives scattered across wholesale sites located in China. Cost always seems to be a focal point of discussion so let's address the elephant in the room.

Products from these overseas wholesale sites often list inconsistent specs or model identifiers, an exorbitant shipping fee (e.g $90) is typically separated to mask the perceivable low price point, delivery may take weeks to arrive along with import duties and product documentation or support is non-existent. But yes, potentially you could save some money if you're okay with all this.   

Protectli may sell at a slight premium, but they've taken the guess work out of finding the right product. Their products are clearly defined, made-to-order options are available including factory flash of Coreboot, fulfillment is done within the USA, Europe or Globally from Amazon and includes free shipping. It goes beyond just hardware though, Protectli has created a knowledge-base of HowTo articles covering a variety of installation and troubleshooting topics in association with validation testing of popular Open Source software on their devices. This is all backed by a 1 year warranty and 6 month extension if you register, the included US-based technical support is also available if you hit a snag. Let's leave the considerations at that.

Contents of the retail box includes everything to get started, a Vault Pro VP2410, 12V/3.33A power supply, AC power cord, VESA mounting bracket, two SATA cables, USB-A to Micro-USB serial cable, accessory pack (screws & hex standoffs) and quick instruction card.

The VP2410 outer housing is gunmetal grey in colour, constructed entirely of aluminum alloy the overall weight is 737g (1.6lbs) with dimensions of 5.7"W x 5"L x 2"H. Surprisingly the chassis is rather hefty leaving no doubts on durability.

Thick aluminum fins run across the topside dissipating heat — essentially the housing acts as a giant heatsink, since there are no internal moving parts this passive cooling also yields silent operation.

Facing frontward starting on the left side is a power button with illuminated status LED (blue light), an HDMI port, two USB 3.2 Gen 1 Type-A ports (blue), a DisplayPort, one USB-C 3.2 port, hard reset pinhole, and Micro USB COM port labeled console.

You may have noticed I skipped over the wireless icons on each side. Well those are simply plastic grommets covering the coaxial connector holes for external WiFi/LTE antennas. I didn't add the optional 802.11ac/a/b/g/n WiFi Kit to our build featured in this review, however, according to Protectli the WiFi slot on the VP2410 is an M.2 2230 form factor module with PCIe communication. As such it can support the newer 802.11ac modules that operate in both the 2.4GHz and 5GHz bands, but is also dependent on Operating System so be sure to read their compatibility guide before ordering.

In short, FreeBSD doesn't support the module so if you're if planning to use OPNsense or pfSense then skip the WiFi Kit and utilize a proper external access point for wireless connectivity.

Shifting to the backside, again another antenna placeholder, disk activity LED (yellow light), power LED (green light), four Intel I210/211 Gigabit Ethernet ports (RJ-45), power input 12V DC (5.5mm x 2.5mm barrel type connector) and the fourth antenna placeholder.

All designations are clearly labeled on both front and rear faceplates for easy visual identification.

Taking a look at the underside we have rubber feet to provide stability on flat surfaces, or use the included VESA mounting bracket to affix the unit to a monitor or wall.

Here is where you'll access the internal hardware connectors, simply remove the four bottom screws and cover. I should also mention once the cover has been removed you'll find an inward facing mounting bracket for a 2.5" SSD (shown above).

Opening up the enclosure we get a better look at the Printed Circuit Board (PCB) and available connectors. On-board is 8GB of eMMC storage, towards the top right is a single SATA connector for a 2.5" SSD, an M.2 2230-E socket for WiFi, another socket supporting M.2 2280 SATA SSD with a maximum capacity of 2TB (NVMe unsupported), a 4-pin fan header, small speaker for boot chimes and lets not forget the DDR4-2400 SO-DIMM slot supporting up to 16GB of memory.

Reverse side of the PCB you'll find an mPCIe socket for LTE Modem and the Intel Celeron Processor J4125 (Gemini Lake Generation). The J4125 is a 64-Bit processor with base frequency of 2.00 GHz, burst of 2.70 GHz, 4 cores, 4 threads, 4M Cache and Thermal Design Power (TDP) of 10W.

Integrated into the J4125 processor is Intel UHD Graphics 600, operating at a base frequency of 250 MHz, bursting up to 750 MHz with Max video memory of 8GB supporting 4k @ 60Hz.

Additionally, the processor supports Virtualization Technology (VT-x) and Virtualization Technology for Directed I/O (VT-d) for those interested in running Kernel-based Virtual Machine (KVM), also AES New Instructions (AES-NI) provides cryptographic acceleration and known to dramatically increase throughput along with decrease system load with VPN solutions that utilize AES.

Ordering directly from the Protectli website allows for broader customization of your build. In the case of the Vault Pro VP2410, choose between 4GB, 8GB or 16GB of DDR4 memory, fifteen different SSD storage options, addition of a Trusted Platform Module, WiFi Module or 4G LTE Modem, power cable type and even BIOS installed (more on this later).

The device arrives fully assembled ready to use — unless of course you declined to purchase memory and opt to add your own. With the exception of memory, the aforementioned are considered upgrades or future-proofing rather than requirements.

Software

The Protectli Vault Pro VP2410 has several use cases, be it a Router & Firewall, light usage Virtualization Platform, Linux Desktop or home Linux Server.

Whatever you have planned just be mindful that installation on the 8GB eMMC could potentially be a limiting factor depending on choice of Operating System. Take Ubuntu for example, even a minimal install of Ubuntu Desktop 20.04.4 LTS requires 8.6GB and will fail, however, you could install Ubuntu Server 20.04.4 LTS with 3.1GB of usable storage leftover.

OPNsense or pfSense CE (community edition) will also successfully install on 8GB eMMC, a fresh installation of OPNsense with nothing configured will consume 1.5GB of that 8GB eMMC storage but once you start enabling services, adding plugins, rules, VLANs, logging, etcetera, more storage will be required. In fact, as per documentation a reasonable specification is 40GB SSD, whereas the recommended specification is 120GB SSD.

We can't possibly cover all scenarios here, so let's assume customers purchasing the VP2410 are likely seeking the full potential of a baremetal OPNsense/pfSense or lightweight Linux server installation. Given the low cost of SSD you can easily avoid any storage related limitations without making compromise on function by simply adding 32GB+ SSD at time of purchase. If your requirements are an absolute minimum, perhaps a lower-end model such as the Protectli FW2B 2-port for $259 would serve you better.

Coreboot firmware is supported on the VP2410. The Protectli Coreboot 4.13 image was purpose built to offer better performance on this particular hardware and though it still contains proprietary binary blobs, Coreboot is highly recommend versus the alternative AMI BIOS.

As previously mentioned, when ordering directly from Protectli you'll have an option to select a preferred BIOS. Don't worry if you forget or change your mind, they've also developed a BIOS flash utility named Flashli which allows users to easily swap between an AMI BIOS & Coreboot literally within 5 minutes. The tool automatically identifies the platform and presents correct BIOS options — be aware flashing does have associated risks, so I leave this as an exercise to the user to read the documentation.

Performance

Evaluating VP2410 performance was done by first examining the real-world user experience of OPNsense and then Ubuntu Server 20.04.4 for hardware benchmarking using GeekBench 5. Prior to starting I experimented switching between Coreboot 4.13 and AMI (GLK4L 3.10) BIOS but ultimately settled on Coreboot for the duration of testing.

I discovered a minor issue with the Coreboot 4.13 image that may affect installation media. USB 2.0 drives do not initialize unless you wait 5 seconds before entering the boot menu, but USB 3.0 drives will initialize immediately. Protectli has acknowledged the issue and is working towards a resolution.

OPNsense version 22.1.2 was installed to a 120GB M.2 SSD with 4GB DDR4-2666 of system memory. A modest home network configuration was imported, this entailed segmentation with multiple VLANs, 20+ rules, DHCPv4, Unbound DNS, WireGuard VPN and AdGuard-Home from a community repository.

System resources had plenty of headroom, both CPU and memory barely broke a sweat under concurrent LAN & VPN mixed loads, though I did manage to peak CPU usage to 24% while testing throughput. My Internet connection is FTTH (Fiber-To-The-Home) 1Gbps/250Mbps, throughput testing was ran against a hosted iPerf3 server from a Linux Desktop PC connected to a switch. The PPPoE connection resulted in throughput of 929Mbps Down and 259Mbps Up, very close to the actual maximum throughput on Gigabit Ethernet of 940Mbps.

Out of pure inquisitiveness I tried to squeeze some extra performance by enabling PowerD and modifying system tunables, this resulted in a 1Mbps gain with lesser sustained CPU usage, but also a higher peak of 48% and increased core temps — further optimization is required, but the system defaults are acceptable too.

Initially I planned to compare PPPoE vs. Bridged connection as PPPoE encapsulation uses a single CPU core (at least with FreeBSD) and users with Gigabit Internet service often question device performance. But after seeing the initial PPPoE results I didn't feel a need to test Bridged as the VP2410 has proven perfectly capable of achieving Gig speed.

Under mixed loads, the internal thermal sensor on all four CPU temps peaked at 38.0C (100.4F), with chassis external temp of 33.2C (93.9F). Power consumption was recorded at: Off 1.0W, Average 6.7W, Maximum 10.2W.

Benchmarks where ran using GeekBench 5 under Ubuntu Server 20.04.4 (5.4 Kernel) installed to the on-board 8GB eMMC with 4GB DDR4-2666 of system memory to establish minimum performance you can expect. I also ran against two other installations, 8GB eMMC with 16GB DDR4-2666 of system memory and then 120GB SSD with 16GB DDR4-2666 of system memory to see variation in hardware configurations.

Geekbench 5 scores are calibrated against a baseline score of 1,000 (which is the score of a Dell Precision 3430 with a Core i3-8100 processor). Higher scores are better, with double the score indicating double the performance. The workloads are divided into three subsections: Crypto, Integer and Floating Point. A complete description of the individual Geekbench 5 CPU workloads can be found on the Geekbench website.

Below is a visual representation of the GeekBench 5 results performed on the minimal hardware configuration.