@Wylbur said in Q: Hardware to run PfSense....:

So far I have watchdog behaving when Snort stops and restarts itself.

Very, very bad idea to configure Service Watchdog to monitor either of the two IDS/IPS packages available for pfSense. I'm the volunteer package maintainer (meaning the developer) for both packages, so I speak with definitive knowledge 🙂.

Service Watchdog does not know how to correctly monitor the IDS/IPS packages, especially on multiple interfaces. It will sometimes needlessly issue a restart command when the IDS/IPS package is in the middle of automatically restarting itself. That will lead to multiple instances running on the same interface. I've coined those as "zombie" instances as they will continue to alert and block, but will not respond at all to any configuration changes made in the GUI. The only way to regain control is to manually kill the zombie instances.

TLDR: do not use Service Watchdog to monitor the IDS/IPS packages.

@w0w

It’s definitely not MY personal requirements, this affect EACH pfSense user. More (in case office/small/middle company in US/Europe ) or less (web surfer from Tanzania, techno-geek at home network or DevOps at home).

But making decision based on wrong testing strategy and wrong instruments -> wrong way and certainly wasting time and effort.
Agree?

Before in this thread You wrote:

——
RACK and BBR will mostly have an effect running on endpoints, like streaming servers or tunnel endpoints. Since pfSense is a firewall there are not so many situations when BBR or RACK will give any benefit,
——
TCP congestion control is managed by endpoints (sever and/or client e.g. web browser and web server), so anything not placed on the firewall is not using cognestion control, like newreno or any other.
Endpoint means that firewall iself is an endpoint, then congestion control is applied, otherwise all other traffic is just passed to upstream/downstream interface.
——-

I friendly pointing You that this is not correct and by saying “TCP congestion control is managed by endpoints” You show that You not deeply understanding how exactly QUIC (and so-called HTTP/3) working and how overall CC strategy, BSD/NIX TCP stack parameters, NICs parameters, ISPs switches on aggregate levels, ISPs routers (with sophisticated routing policies, shapers and limiters) on core level routers impact on packets flow back and forth between external users and Your application’s server.

And now You make that decision based on … ordinary SpeedTest ? Really wrong way to comparing CCs!

P.S.
Do You know that small (but important) example: Your server’s ~72Mb/s with 1ms ping -> after 1% PL (packet loss) on a user’s “last mile” BECOME ~54Mb/s with 4ms ping ~> after +100ms RTT added by “fat magistral” BECOME 5,7Mb/s with 104ms ping.

Only 1% of PL and +100 RTT make Your “magic server’s 72Mb/s” to “5,7Mb/s” !

Imagine, what happened with 2-3% PL and 80-120 RTT ?

This all about YOU NEED MAKE PROFESSIONAL-GRADE MEASUREMENTS WITH RIGHT TOOLS !

Already on .internal.

The 8200 has 4 SIM slots. It can hold two cellular modems and have each use dual SIMs. 😉

The only modems I know work are the older Sierra devices: EM7305/7355/7455. Those are easily available used but many (most even) are rebranded OEM that may require a firmware reflash or at least re-configuring in a Windows device.
The Huawei ME906s-158 will also work and that works with the cellular package to give you additional data. I use that here in a 6100. That's the euro spec version.

Steve

Good to know that the old installers are still available, at least for now. This new policy however still raises some concerns.
In our network we can't easily attach device to it. It has to register with the radius server and it has to use a proxy. Which is why we typically setup and configure a new firewall before we install it in our network.

I'm curious to see how pfSense will evolve from this.

TAC Lite is for the life of the device. You can always contact support support for help reinstalling etc.

The support widget was created before that and the backend code (currently) assumes 1 year from purchase as the base support level. That should get updated soon but it's only cosmetic, if confusing!

Steve

@stephenw10

Thank you!

@ninho-gomes said in Ethernet USB:

@johnpoz disse em Ethernet USB:

O roteador @ninho-gomes em um stick é quando você usa a mesma interface para várias redes, ou seja, seu wan e lan via vlans. Você precisaria de um switch capaz de vlan para fazer isso.

Outra opção é se você puder substituir o cartão nic no mini por, digamos, um nic de 2 ou 4 portas.

Entendido. Vlan é uma boa saída.

Sorry, I replied in Portuguese
Understood. Vlan is a good way out.

@planedrop @johnpoz Very nice! Thank you. Running through the install now.

@stephenw10
lol oh for sure !

@SDGPeteBatin Hmm, I would have expected an email to automatically create a ticket response. Let me me confirm that though, it's not something I ever do!