Which box for which office: a buyer's guide to Weft hardware

Weft does not sell hardware. Each office runs the Weft agent on a machine you choose, as long as it runs Ubuntu 24.04 LTS on x86-64 or ARM64. That is freedom, and it is also a question: which machine? This guide answers it by office size, then looks at one brand that turns up constantly on Amazon UK, ANDAQI.

What the box does in an office

The Weft box sits between the internet line and the office network. Count its ports by job:

• Internet lines. One port per line. Weft runs a tunnel over each and moves traffic to the other within a second if one fails, so a second line wants a second port (see two internet lines, one office).
• The office network. One port to the switch. Staff, guests and phones can all travel on that one cable as separate VLANs (see one cable, every network).
• An existing router or firewall, if you are keeping one and handing a network to Weft on its own port.
• A spare, because the day you need one is the day you cannot get to the office.

So a small office needs three ports, and an office with two lines and an existing firewall needs four or five. Six gives room to grow.

How much CPU

Everything between offices is encrypted with WireGuard, so the processor sets the ceiling. Published measurements give a rough guide:

For nearly every office on ordinary broadband or a gigabit line, an N100 or N150 is enough with room to spare. A J4125 will just about keep up with a gigabit line.

Measured: the box in our own office

One of our sites is a 2019-era mini PC with an AMD Ryzen 5 3501U, four cores and eight threads, running Weft in production behind a 500 Mbit/s line. We measured its WireGuard capacity on 2 October 2026 by joining two isolated network namespaces on the box with a WireGuard tunnel and running iperf3 through it for 30 seconds: 1.90 Gbit/s with one stream and 1.85 Gbit/s with four. Both ends of the tunnel ran on the one processor, so it was encrypting and decrypting at once; as one end of a real link it has a little more in hand.

That is nearly four times what the line can carry. For this office the internet line is the limit, not the box, which is the position you want to be in.

A look at ANDAQI

ANDAQI sells a long list of small fanless "firewall appliance" PCs on Amazon UK. Two things are worth knowing before buying one:

• They appear to be HUNSN boxes under another name. The andaqi.com address forwards to hunsn.com, and the Amazon listings describe the products by HUNSN model names (RS34, RJ46 and so on). HUNSN in turn uses boards found under several other brands, as ServeTheHome noted.
• Model numbers move. The same model code has been listed with different processors. Buy by the processor and port list on the page in front of you, not by the model number.

The good news is the parts. The models worth considering use Intel N100 or N150 processors and Intel i226-V 2.5G network ports, which Linux supports out of the box.

Which one for which office

Prices are as listed on Amazon UK on 2 October 2026. "Barebone" means without memory or storage; add one SODIMM of 8 GB and a branded NVMe drive.

For the largest offices we would be cautious. ANDAQI publishes no BIOS or firmware updates, the boxes have one power supply and no remote management, and most UK listings have few reviews. At that size a vendor that publishes its firmware is worth the extra money.

Skip the boxes with SFP+ ports and an N150 if you are buying them for 10G: the processor cannot encrypt anywhere near 10 Gbit/s. And none of these come with Wi-Fi, so if you want the box to be the office access point as well, you will need to fit a card that supports access-point mode.

One setting to change: the i226-V network ports

The i226-V has a known problem on Linux: with its power saving on, the link can drop or the whole machine can freeze. The widely used fix is to turn PCIe power saving off (background). Before you run Weft's install command on a box with these ports:

1. Edit /etc/default/grub and add pcie_aspm=off to the GRUB_CMDLINE_LINUX_DEFAULT line.
2. Run sudo update-grub and reboot.
3. Check the ports' firmware with ethtool -i followed by the port name. Older firmware is more prone to the problem; ANDAQI does not publish updates for it.

What we will do next

We will buy one six-port N150 box, install Ubuntu 24.04 and Weft on it, and run it with two lines and VLANs under sustained load. When we have, this post will be updated with what we found, good or bad.