Skip to content

1. Two computers in one box

For a long time before any of this began, a Sophos XG 330 sat in my network running OPNsense. Nothing about that was unusual. The XG 330 is one computer - an x86 board whose ports are ordinary network cards on its own bus - and FreeBSD has drivers for all of them. Install OPNsense, and every port is there.

The Sophos XG 330, running OPNsense

The XG 330, its display showing the WAN's round trip. The room around it is blurred, and so is the address on its display.

Install the same OPNsense on a Sophos XGS and it boots to a working firewall with no network interfaces at all. The console asks which port is the WAN, and offers nothing to choose from.

The two look like the same kind of machine. They are not.

The second computer

An XGS appliance is two computers in one case:

  • an x86 host - an AMD Ryzen Embedded on the XGS 136, a Ryzen V1780B on the XGS 3300 - which is where OPNsense runs; and
  • a coprocessor behind a PCIe link: a complete computer of its own, with its own processor cores, its own memory, its own storage and its own Linux. It owns every front port, the switch behind them, and a crypto engine.

The host sees the coprocessor as a single PCI device and nothing more. Everything a firewall needs - the ports - is on the far side of that device, and the only software that knows how to reach it is the vendor's, written for the vendor's own operating system and for Linux. FreeBSD has nothing.

What reaches the XGS 136's coprocessor from the host, and how

The question

So the question was never whether OPNsense runs on an XGS. It boots. The question was whether the host could be taught to speak to the coprocessor - with no documentation, from the outside - so that the ports, and then the fast path and the crypto engine behind them, would belong to an open firewall.

It took close to two years to answer, and very little of it went in a straight line. The chapters that follow are that road: the turns that worked, and the ones that did not.

Next: 2. The XGS 136 arrives

Discussion

The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.