A client called me at 11pm because their "NAS" had been silently corrupting backups for six weeks. The culprit wasn't ZFS, wasn't the drives, and wasn't the filesystem. It was a USB 3.0 enclosure with a UAS controller that reset itself under sustained load, dropped the pool offline, and re-imported it without complaint. They found out only when a restore failed during an actual incident. Forty terabytes of "backups" that were never tested, on a transport layer nobody should trust with a zpool.
That story matters here because the ZimaBlade is exactly the kind of board people buy to do everything at once — NAS, router, DNS, containers — on a single x86 SBC with a real PCIe slot. Done right, it's a beautiful little combo box. Done the way most forum posts suggest, it's a single point of failure with a cheerful front panel.
This guide is for sysadmins and security engineers who already know their way around zpool, iptables/nft, and a hypervisor, and want a build that won't embarrass them in six months. By the end you'll have a Proxmox host with PCIe passthrough, a ZFS NAS layer with sanoid snapshots, an OPNsense router VM on its own NIC, VLAN segmentation that doesn't loop, and a backup and monitoring story that actually proves itself.
:::note[TL;DR]
- The ZimaBlade's single PCIe lane is real but electrically constrained — verify your board revision before buying a quad-NIC or HBA.
- Run Proxmox VE as the host, OPNsense as a VM, and the NAS as an LXC with a passed-through SATA controller. Never put WAN and LAN on the same bridge.
- Use
ashift=12always, prefer a PCIe SATA controller (ASM1166/JMB585) with external power over USB for any ZFS pool. - Backups must be off-box, immutable, and restore-tested. Untested backup is not a backup. :::
Prerequisites
- A ZimaBlade board (verify revision and PCIe electrical width before purchase), 16GB RAM minimum, a small NVMe boot drive.
- A PCIe NIC (Intel i210 or i226-v) for the router role, and optionally a PCIe SATA controller for storage.
- A USB stick with the Proxmox VE ISO (grab the current release from the official site — versions move).
- Console access (HDMI + USB keyboard or serial) for first boot.
- A second machine to run
ssh,zfs, andprometheustooling from.
Why the ZimaBlade Is a Weirdly Good Fit (And Where It Isn't)
This section exists because half the internet treats the ZimaBlade as either a Raspberry Pi killer or a datacenter replacement. It's neither. It's an x86 SBC with one PCIe lane, and that lane is what makes the NAS+router combo viable at all.
What the ZimaBlade Actually Is
The board ships in configurations based on Intel Celeron N-series silicon (N3450/J4125-class parts depending on SKU — check the vendor spec sheet for the exact model you buy). The critical detail is the PCIe slot: physically x4, but on some board revisions it's electrically wired as x1. That distinction is the difference between "a quad-NIC works fine" and "a quad-NIC negotiates down and drops links under load."
Before you buy anything, confirm what you actually have:
# Confirm the board revision and slot topology
sudo dmidecode -t baseboard | grep -E "Manufacturer|Product|Version"
sudo lspci -vvv | grep -A2 "PCI bridge" | head -20
⚠️ TRUNCATED VERSION
This is an abbreviated cross-post. Full article (all config files, architecture diagrams, images): valtersit.com
🛠️ Partner Tools for Developers
ValtersIT curates partner deals for developers and sysadmins — VPS hosting, security tools, monitoring platforms and dev productivity gear. No filler, no affiliate spam.
Top comments (0)