Installing RouterOS on WatchGuard Firebox x1250e – With Hardware Mods!
When I set out to find a budget 1u rack mounted Firewall to install RouterOS on, I discovered the WatchGuard Firebox.
I have zero experience using Watchguard products, but I found quite a bit of material on these units, and there is quite a following for this hardware platform and even some discussion on pfSense related websites, blogs and forums discussing various methods of modifying these Firebox units, including manipulating the bios, adding vga outputs, keyboard inputs, and hard disks, and more.
Getting down to business with the WatchGuard Firebox x1250e.
The unit that I ordered from Ebay arrived with a bad power supply, pictured to the right, which I had to order a replacement for, but once I had the replacement power supply installed, I quickly got the unit up and began testing it.
I wanted to check out the existing Watchguard OS before wiping it out, just out of curiosity, but unfortunately, I wasnt able to login to the web interface due to some custom configuration the previous owner had done, not even after performing a factory reset of it.
I followed the procedures on Watchguard’s website for a factory reset of the unit, but the damn thing still had somebodies configuration loading, presumably from a configuration somewhere on the cf card. I proceeded to begin attempting to install RouterOS.
So, you can load up Mikrotik’s Netinstall software from within Windows and install RouterOS directly to the stock 512mb CF card that ships with the Firebox x1250e. Thats exactly what I have done here, or you can use a larger CF card of your choosing, If you want to install on an SSD or a IDE/SATA disk you have that option as well, but you will need to purchase a few parts off ebay to do that, but Ill get to that later on in the article.
After successfully installing RouterOS onto the CF card with NetInstall
I then placed the CF card back into the Firebox x1250e. I turned it on, and I waited a bit, or more. The unit seemed to not be doing anything, I began to become concerned, It was taking forever to load, seemed to me something might be wrong, but then I observed that the hard disk LED indicator light on the front of the Firebox x1250e unit was pegged solid, and it would flicker occasionally, indicating to me that the magic was happening.
I decided to remain patient, and leave it alone, and Im glad that I did. After waiting about 10 minutes in total, and hearing a system beep at the end of each boot up, I concluded that it took about 2-4 reboots for RouterOS to configure itself before it was finished installing and setting up. ( It boots REALLY fast after completing the install as a matter of fact.)
RouterOS installed – Lets Configure It!
With RouterOS x86 finally installed on my unmodified Watchguard Firebox x1250e. It was time to begin configuring it. I proceeded to install the optional LCD software package which can be downloaded from RouterOS.com You will need to do this before the LCD will function at all. If you are reading this article I presume that you are already familiar with RouterOS and understand how to install and uninstall packages from within RouterOS. This tutorial is not going to go into detail on how to setup RouterOS unless it pertain specifically to the Firebox x1250e, there are plenty of other tutorials already available to show you how to setuo your RouterOS device.
And after installing the LCD package, you will discover that there is a selection of different LCD types from within the LCD Package menu. After trying all of the different options, the vitek-vc2025-2 was the option that worked for the x1250e unit that I had. It just worked, like a charm. Good job Mikrotik!
All 8 interfaces come up and link speeds are fully functional as expected. You are probably going to want to rename all of the interfaces from within RouterOS to match the numbering scheme on the ethernet ports marked on the front of the Firebox. This is easy to do, you can simply plug in a live network cable thats connected to some other device, and observe the connection status from within winbox to identify which port is connected.
The reason for doing this should become clear if you have gotten this far. RouterOS basically gets the numbering order backwards from whats labelled on the front of the unit, but again, its not a big deal because RouterOS lets you rename the interfaces.
Purchase a RouterOS License:
RouterOS x86/64 by default will only allow you to test the OS for 24 hours befoe locking you out, you will be required to purchase a license for a very reasonably price. After all, the Mikrotik software developers need to eat too!
Next, I purchased an x86 Level 4 RouterOS license from Roc-Noc and I am extremely happy with the outcome. And just a heads up to new customers, you will need to wait a while for RocNoc to email you your license, but dont worry, they will, and if you are impatient like me, just email them, a rep will send you your license relatively quickly.
So, I proceeded to setup Routeros as a basic router, Nothing too fancy. DHCP and Routing on a bridge, masquerade & dhcp client on eth0. (I loaded the config file from old my RouterOS device.) And finally I setup some firewall rules and scheduled the automatic DNS Ads and Malicious blacklist updates from Squidblacklist.org. I have also decided to order a replacedment LCD to upgrade the ugly yellow display.
Upgrades Arrive: Whats the Firebox x1250e Maximum Memory?
OK so somebody out there is probably wondering what memory to stick in this thing to max it out, and Ive got the dirt for you right here. I have tested several memory combinations in the x1250e and have some useful information. I placed two 2GB sticks of DDR2 PC-6400 in the Firebox x1250e to find out what the maximum memory is, and I have concluded that the maximum installable memory for the Firebox x1250e to be 2GB. The unit will post up and run with a single 2GB stick in either slot, but when you try to place both 2GB sticks of memory in at the same time, the unit simply wont post at all.
I recommend installing two 1GB sticks of PC-8500 to take advantage of the 533mhz FSB, especially if you will be upgrading to a 533mhz fsb cpu. I am actually quite satisfied with “only” 2gb of ram for now, for my own use as a gateway, Im not even consuming half of that yet.
Upgrading the Firebox x1250e CPU:
Now the 1.3ghz/400fsb Celeron that shipped with the unit is a Banias core processor, and maximum cpu you can install in this unit, is the Pentium M 780 2.26ghz/533FSB, which is a Dothan core. Which is well known for its overclockability, I tested a Pentium M 755 2ghz/400fsb in the Firebox x1250e and believe that you could easily overclock that to 2.66ghz by simply setting the FSB to 533 and doing a voltage pin mod, but for now, well keep this civilized. But, you will need to set the switches appropriately as indicated on the diagram to get your cpu at the right speed if you are also going to upgrade it.
So I installed the Pentium M 780 2.26ghz/2M/533. No speed demon by todays standards, but its certainly twice as much cpu power as the 1.3ghz Celeron that shipped with the unit and will effectively max the cpu out without any crazy overclocking. There is no faster cpu made for this hardware architecture without getting into some insane overclocking modifications.
So here are some pictures of the two dip stations on the motherboard that you will need to set. There are two sets of jumpers on the motherboard which must be switched. It is clearly indicated on the motherboard which dip switches must be flipped for a Dothan or a Banias core cpu and the second set of switches is for the front side bus speed.
This photograph above is particularly important because the bus speed adjustment jumpers are very easy to overlook, as they are placed between the memory, cpu and some capacitors, a really tight nook that makes it really easy to overlook them. But if you get it right, you will be greeted by the led indicator below. ( the led modification comes later on in the article )
PCI-E A Hidden Surprise:
The WGEM-500 motherboard in the Firebox x1250e has a 915/910GM chipset which indeed does support 400 and 533fsb according to Intel’s website. I hope this clarifies for anybody who is curious.
Some of you might agree, that its a bit interesting to see an older cpu architecture from this early era outfitted with a hybrid chipset like this on a motherboard with a Pentium M, with a PCI-E controller as well as slots, enabling future expansion. This is precisely how you will be able to install a modern SSD hard disk.
Hard Disk Options: CF Card IO Performance
The IO bandwidth of the CF card that ships with the Firebox x1250e is rather limiting, which isnt much of an issue if you are just using it as a router, until you begin working with large blacklists or other large data files, so one might imagine that the Firebox x1250e could perform quite a bit smoother using an SSD rather than a CF Card.
As illustrated in the photo below, I have installed the 1gb SATA SSD from an old Dell Optiplex SFF unit I had laying around, using a couple of adapters which are cheap and abundantly available on Ebay, as I have successfully done here.
Fortunately, there appears to be a normal looking 4x pci-e slot near the CF Card slot, within which, we should be able to have an SSD installed.
I have no doubt that the system would be more snappy, reliable, faster to boot, and especially our specific deployment, the x1250e would load blacklists considerably faster with an SSD installed.
I have ordered a PCI-E 4x ribbon cable and tested to confirm that it does indeed fit in the slot pictured above. See images below. I have ordered the SSD and the Adapter card pictured in my description here, I will update this blog post accordingly once the parts have arrived.
I suspect that I will need to consult with Mikrotik support to migrate my software license from the CF card installation to a new installation on the SSD once it is installed.
This is a bit trivial, but noteworthy none the less, an amusing script that produces a ‘Star Wars Imperial March’ jingle from the system speaker doesnt sound like it should on an actual Mikrotik Routerboard. It does play. But it doesnt sound quite right at all.
LCD has Arrived:
Ok so the replacement ‘5V 20×2 Character LCD Module’ has arrived.
Just got done soldering in the replacement LCD and I wasnt sure what to expect, but after a few seconds, as you can see it went well.
And a dark shot showing the glorious end product safely running in production under lock and key.
To be continued….
Want to filter unwanted websites with a WatchGuard Firebox or a RouterOS Device?
Subscribe and download all of our blacklists today.