Create a cheap DIY CFexpress Type B storage using an M.2 NVMe 2230 SSD drive

I recently found a way to save significantly on CFexpress Type B storage and wanted to share the details with you. While looking for storage for my new camera, I realized that CFexpress is essentially a repackaged NVMe SSD, despite the high retail price.

I successfully built a 2TB CFexpress Type B card for $314, compared to the $1,200+ retail cost (e.g. OWC Atlas Ultra 2.0TB), using the following components:

- Adapter: RIITOP CFexpress B to NVMe 2230 SSD Adapter

- SSD: Corsair MP600 Mini 2TB M.2 2230 NVMe PCIe x4 Gen4 SSD

For my Canon EOS R6 Mark III to recognize the drive, I initialized it using MBR partitioning (rather than GPT) and formatted it to exFAT. In benchmarks, the drive sustained over 1GB/sec read and write speeds, which easily exceeds the VPG-400 requirement of 400MB/sec.

I hope this DIY solution helps you get the storage you need at a much better price. Let me know if you have any questions!

Update firmware in Debian

To install available firmware updates in Debian, do the following:

sudo apt install fwupd

sudo fwupdmgr refresh

sudo fwupdmgr get-upgrades

sudo fwupdmgr update

Install Linux kernel headers in Debian

sudo apt install linux-headers-$(uname -r) 

Run Ollama with Open WebUI inside a Docker container and make them accessible from outside

docker run -d -p 11434:11434 -p 3000:8080 --gpus all -e OLLAMA_HOST=0.0.0.0 -e OLLAMA_FLASH_ATTENTION=1 -e OLLAMA_KEEP_ALIVE=-1 -e OLLAMA_KV_CACHE_TYPE=q4_0 -e OLLAMA_BASE_URLS=http://0.0.0.0:11434 -v /data/ollama/.ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always --pull always ghcr.io/open-webui/open-webui:ollama

Useful MCP servers for Claude Code

For web content scraping

claude mcp add playwright npx @playwright/mcp@latest

Speed-up XRDP on Debian

Edit /etc/xrdp/xrdp.ini

Locate tcp_send_buffer_bytes and change to:

tcp_send_buffer_bytes=4194304

sudo sysctl -w net.core.wmem_max=8388608

Create /etc/sysctl.d/xrdp.conf file and add the following:

net.core.wmem_max = 8388608

Upgrade to Windows 11 on unsupported hardware

1. Download Windows 11 ISO
2. Disable networking
3. Mount the ISO
4. Open a Command Prompt and run:
• X:\sources\setupprep.exe /product server

Check for SMART status on Debian

 Install smartmontools and use smartctl:

sudo smartctl --all /dev/xxx

Unable to turn on BitLocker Error: System cannot find the file specified

Rename C:\Windows\System32\Recovery\REAgent.xml to REAgent.old 

Reference: https://learn.microsoft.com/en-us/answers/questions/3185720/unable-to-turn-on-bit-locker-error-system-cannot-f

Scan and repair corrupt Windows system files

Using elevated command prompt:

Dism /Online /Cleanup-Image /ScanHealth

Dism /Online /Cleanup-Image /CheckHealth

Dism /Online /Cleanup-Image /RestoreHealth

sfc /scannow

chkdsk /f /r

References:

• https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image?view=windows-11
• https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14?view=windows-11

Adding a Samba user and setting the password

I almost always forget to add users to Samba group after enabling Samba. So here it is:

sudo smbpasswd -a <username>

Change service shutdown timeout in Debian

Make a change so that slow-non/responding services to terminate quickly during shutdown:

sudo nano /etc/systemd/system.conf

Uncomment and edit to:

DefaultTimeoutStopSec=5s

Reboot or reload with:

sudo systemctl daemon-reload

Change GRUB boot delay

sudo nano /etc/default/grub

sudo update-grub

Adding ufw rules using application profiles while restricting source network

Unfortunately, the ufw help doesn't provide an example for using application profiles while specifying the source network. Here's an example how "OpenSSH" profile can be used but restricting the source network to local:

sudo ufw allow from 192.168.0.0/24 to any app OpenSSH

Disable IPv6 in Debian Trixie

Edit /etc/hosts and remove the default IPv6 entries, including localhost, etc. If you don't do this, you may encounter weird errors down the road because some programs will try to bind to "localhost" and it ends up try using non-existing IPv6 address, etc.

Create the follow file:

sudo nano /etc/sysctl.d/90-disable_ipv6.conf

then add these lines and save:

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.default.disable_ipv6 = 1

Run:

sudo sysctl --system

Jumbo frame size setting in Windows

For network adapter drivers that require the "Jumbo Packet" value to be set for MTU, enter 9014. This is to accommodate 14 bytes of Ethernet header, which is then added to the 9000-byte packet. For example, Mellanox ConnectX-3 adapters require this value to function correctly.

To confirm testing of Jumbo frame between two nodes, use the ping command as follows:

For Windows:

ping <target> -f -l 8972

For Linux:

ping <target> -M do -s 8972

Upgrade to Debian 13 (trixie)

sudo apt update

sudo apt upgrade

sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list

sudo apt update

sudo apt upgrade

sudo reboot

Disable Proxmox firewall temporarily

When you mess up the Proxmox firewall setup and you can't access the server...

pve-firewall stop

This stops the firewall until next reboot or update of any packed what restart the pve-firwall.

If you like to disable it permanently , you can do this in the /etc/pve/firewall/cluster.fw

set enable: 1 to 0

Citation: https://forum.proxmox.com/threads/disable-firewall-from-command-line.29091/

Switching Debian boot mode between text and GUI

To boot into text mode:

sudo systemctl set-default multi-user.target

or to boot into GUI mode:

sudo systemctl set-default graphical.target

Reboot the system

Surprising OpenVPN and WireGuard result on Intel Alder Lake N100 pfSense Router

Introduction

I have been using OpenVPN on my home router for the last 10 years or so, and I finally got around to trying WireGuard tunneling. From what I heard, I was expecting WireGuard to be much faster, as I have seen a huge performance increase when I switched from OpenVPN to WireGuard on my Private Internet Access VPN.

To my surprise, as it turns out OpenVPN is still significantly faster (and better) on my Intel Alder Lake N100 router.

Benchmark

Here are the specs used for the benchmark:

• Intel N100 mini-PC with 8GB RAM 128GB NVMe Intel i226 Dual 2.5G LAN
• pfSense 2.7.2 amd64 (FreeBSD 14.0)
• AES-NI enabled, no QAT, Kernel PTI and MDS Mitigation disabled
• OpenVPN using AES-256-CGM
• pfSense-pkg-WireGuard 0.2.1
• 1Gbps symmetric fiber internet connection
• speedtest.net

and here's the result:

	Un-encrypted	OpenVPN	WireGuard
Ping	1ms	1ms	1ms
Latency (Down)	16ms	29ms	15ms
Latency (Up)	22ms	38ms	26ms
Download Speed	912.40Mbps	914.35Mbps	636.50Mbps
Download CPU usage	10%	10%	21%
Upload Speed	945.48Mbps	944.01Mbps	658.27Mbps
Upload CPU usage	63%	69%	89%

Explanation

OpenVPN relies on the underlying OpenSSL library, which provides hardware acceleration for AES instructions. Intel Alder Lake N100 processor is AES-NI enabled, and my pfSense dashboard showed that it's enabled. WireGuard on the other hand, uses ChaCha20-Poly1305 algorithm, which takes advantage of SIMD instructions, which exists on virtually all non-embedded CPUs.

So it appears that the AES hardware acceleration provides significant boost over using SIMD instructions, at least in Intel N100 processor.

Conclusion

For Intel N100 processor based pfSense routers, OpenVPN provides over 43% VPN throughput performance over WireGuard. In fact, the AES-NI acceleration is so effective such that it achieves near 100% ISP throughput with no additional CPU overhead (for 1Gbps connection).

What is really interesting, is that the WireGuard connection works at 50 to 68% lower latency than OpenVPN. As such, WireGuard may be better suited for activities such as gaming and remote desktop access.

In conclusion, for those using Intel Alder Lake N100 for a pfSense router, OpenVPN should be used if your primary goal is to obtain highest throughput with the clients. If your client application is more sensitive to network latency, WireGuard should be used instead.