@firemanwall said in Apple smc fan control:

If that is my only option, I too may have to repurpose one of my m93p's that's just collecting dust; I'm not a fan of running 70 degree idle temps where I was previously in the 40-50 range at 2.4 with manual fan control

That's why I gave up... couldn't stand seeing my mini heats up.

Ah, yeah the fact aq0 exists is good. 😀

It may not support the auto-link detection for assigning, not all NICs do.

Try running: ifconfig -vvvm aq0

That will show you what speed it's linked at and what it's reporting it's capable of.

Steve

@stephenw10 Thank you very much for your response, I will keep this in mind, much appreciated.

You wouldn't need to reverse engineer anything. That switch chip is already supported but numerous things including FreeBSD:
https://github.com/freebsd/freebsd-src/blob/master/sys/dev/etherswitch/e6000sw/e6000sw.c#L268

What is needed is a patched igb driver. That was/is used by Stormsheild/Netasq in their hardware running their FreeBSD based OS. That is why that switch driver exists in large part. Note we also contributed to it.
You can see a similar patch applied to OpenWRT to achieve the same thing. See:
https://forum.netgate.com/post/986595

Steve

The Lanner FW-7551SE is similar to this only in that uses the same SoC. Importantly it does not use a switch.
I would not assume anything else there applies here.

Steve

Try disabling any vlan hardware off-loading options. I'd start with VLAN_HWFILTER if it's enabled on that variant.

The driver 2.6. is now identical to what we build in 21.05.1 (or 21.09) so oy must be some hardware difference.

Steve

@stephenw10 said in Original Intel EXPI9404PTG2L20 EXPI9404PT PRO/1000 PT vs Fujitsu PRO/1000 PT Quad Port Gigabit Network Card PCI-E D2745-A11 low profile:

You are basically looking at this:
https://www.intel.co.uk/content/www/uk/en/products/compare.html?productIds=41280,20720

PCIe 1 vs 2

Some virtualisation support in the 82580.

But 82571 is an em(4) NIC but 82580 is an igb(4) muti-queue NIC. If you have multiple CPU cores that is going to load them far more efficiently.

I'd get the newer card given a choice.

Steve

Dear Steve!

Thank You so much for detailed answering.

I keep in memory about 82580 igb(4) multi-Queue, but anyway asking people’s with better knowledge. ;)

@halk8888 said in Watchguard Firebox M400/M500:

-Power consumption
-Noise
-Heat

My m400 (which was a display model I got for free.. so no hours on it when I got it)-

uses less power than any other machine on my network..
is quieter than even my primary switch which has a fan..
generates less heat than any other box on my network.

I like this box because-
I like the inline network interfaces and do use them all.. (I wish the Netgate 7100 had this configuration)
I have a need for the SFP slots.. (although I do wish they were SFP+)
It does full speed of my cable connection without breaking a sweat plus all my VPN's.

YMMV.

:)

Historically there have been some issues with raid controllers. YMMV.

But for me the most compelling reason is if you ever need to recover from a hardware failure you can move the drives into something else and they will boot without needing the exact same controller with the same firmware on it etc.

Steve

@stephenw10 yes, it is not an actual BMP parser, I just used ImageMagick's (known) offset when creating a 1bit bitmap.
something like

convert -pointsize 11 -size 128x64 -font "Arial" -background white -fill black label:"some text\nand some more text" -monochrome text.bmp

and then

perl /path/to/bmp2lcd text.bmp

should work

edit: another thing I noticed: the LCD needs local modem control lines (I can't imagine why, since only three wires are connected to it), like so:

stty -F/dev/ttyS1 clocal speed 115200

Not much in it if you have stable power IMO. If you might see power interruptions ZFS is far more robust, far less likely to suffer filesystem damage in the event of an outage.
If you can run RAM drives that removes that problem but isn't really suitable for packages like Snort or pfBlocker. Though it can work.

Steve

@daddygo I don't have any VLANs at all.

@jc1976 said in discrete ethernet adapter efficiency vs onboard nic:

LOL this is incredible stuff!

Aha, 😉

Just read it carefully and you'll see that it's logical and a really good description.
Experiment with the settings (not in production) the loader.conf.local file will be your good friend

+++edit:

this is just a sample schema, a lot of things in it are no longer relevant (bc. : FB12.2-STABLE).......

hw.pci.realloc_bars=1
net.inet6.ip6.auto_linklocal=0
net.isr.maxthreads=-1
net.isr.bindthreads=1
kern.ipc.nmbclusters=1000000
net.inet.tcp.tso=0
net.inet.tcp.lro=0
dev.igb.0.fc=0
dev.igb.1.fc=0
dev.igb.2.fc=0
dev.igb.3.fc=0
dev.igb.4.fc=0
dev.igb.5.fc=0
dev.igb.6.fc=0
dev.igb.7.fc=0
dev.igb.0.eee_disabled=1
dev.igb.1.eee_disabled=1
dev.igb.2.eee_disabled=1
dev.igb.3.eee_disabled=1
dev.igb.4.eee_disabled=1
dev.igb.5.eee_disabled=1
dev.igb.6.eee_disabled=1
dev.igb.7.eee_disabled=1
legal.intel_igb.license_ack=1
hw.igb.rx_process_limit=-1
hw.igb.tx_process_limit=-1
hw.igb.rxd=2048
hw.igb.txd=2048
hw.igb.max_interrupt_rate=128000
net.pf.states_hashsize=1048576
net.pf.source_nodes_hashsize=524288
net.inet.tcp.syncache.hashsize=2048
net.inet.tcp.syncache.bucketlimit=100
net.inet.tcp.syncache.cachelimit=65536

If you try to push the traffic at 4x the speed and encrypt it then, yes, you will need more CPU. 😉

100Mbps IPSec is not that hard to achieve (depending on traffic type, latency etc!). The 3100 will pass 300-350Mbps over IPSec as long as you're using an encryption supported by it's crypto hardware (AES-CBC).
Yeah I'm sure that HP would do it but you'd probably want to run pfSense virtualized to make more efficient use of the hardware with other things.

Steve

Yeah not a listed device in pfSense or FreeBSD even in the latest code. Some devices can be used using a generic driver if they report as a cdce device but you should see it appear as ue0.
Try connecting it and then checking the system log for the new entries it generates.

However it looks like it's probably unsupported. Try a different USB Ethernet device or just use one NIC and VLANs since USB Ethernet is better avoided anyway.

Steve

Exactly like the 2100 it doesn't have a modem built in. The SIM slot is required to use a modem in the m.2/mPCIe slot but does not indicate radio hardware is included.

Steve

Not as far as I know. You could open a feature request, I don't see one yet.

Installing the driver via the kmod pkg is not hard. Though I have nothing to test it with.

Steve

Got the answer I suspected from Spectrum. All the signal strengths check out fine and they can't replicate the issue in the 10min I was on the phone with them. But if it's of use to anyone searching on Qotom putting a dumb unmanaged switch between the spectrum modem and Qotom running PFSense seemed to completely resolve the issue.

Granted it's only been about 24hrs but I have not had a single packet drop since putting the switch in. I can live with the extra switch, lord knows I have enough of them floating around. Switching ISP is not an option as there is no serious competition. Maybe once AT&T fiber gets here.

@bingo600

Got a bit interested here ...

According to the Intel i350 reference design here (last entry / bottom):
Document: 323852
https://www.intel.com/content/www/us/en/products/details/ethernet/gigabit-controllers/i350-controllers/docs.html?s=Newest&p=2

Page 4 - SMBus interface
U7 (The i350 controller chip) , is connected directly to J42 (PCIE slot) , with just a couple of 10K pullup's.

So B5 & B6 aren't connected directly to a config eeprom , but to the i350.

On Page 7 - Support circuits.
We see that U7 (i350) has connection to a SPI Flash , and an SPI EEPROM.
I'd assume the SPI Flash holds Boot Code & Other stuff.

And according to - The i350 Datasheet - Page 12
Document : 333171
https://www.intel.com/content/www/us/en/products/details/ethernet/gigabit-controllers/i350-controllers/docs.html?s=Newest&p=2

The EEPROM holds the size of the SPI FLASH flashzise , and prob. other goodies.

So i assume that : What is read via the PCie SMBus , and confuses the bootcycle is residing in either the SPI EEPROM or the SPI FLASH that is connected to the i350.

And since it is the i350 that is responsible for SMBus communication, there's probably no "Easy fix" like lifting an I2C eeprom leg or two , in order to avoid unmasking PB5 & PB6.

Fun stuff ....

Hmm ... In the DS pg. 99 an OEM VPD area is described
1684f166-8b81-4b31-87b3-cefc42c961ac-image.png

Maybe setting the word at 0x2F to 0xFFFF , would skip the Dell OEM information , and stop confusing the PC ??

/Bingo

Probably not in pfSense, it looks like a driver issue.

Unless there is some other sysctl that can alter that behaviour. I don't see anything listed though.

Steve

Create the file /boot/loader.conf.local (if it doesn't exist) then add to it the line:

amdsmn_load="YES"

Steve

Run top -aSH at the command line and see what's using the CPU per core.

It might be stuck at a power saving CPU frequency or something similar.

Steve

@stephenw10 Thanks for the information. I tried that and it ended up making the performance worse, down into the low 700s on download. I tried a couple hacky things including trying to add someone elses BSD patch for muti-threaded PPPoE and that blew the whole thing up. I'm going to table this for the time being and I was able to improve the performance to ~890/930 by using OpenWRT with some tweaking. Thanks for all your help!

Yeah, cables have been changed actually, I know nothing lasts forever and sometimes is open box bad. However this is a first for me.

AND exactly as you described it.

Ah, that's probably OK then. The defaults we yuse are set hiadaptive for all three. It depends what the BIOS is reporting which is not reliable.
Powerd and apcupsd are not connected.

Steve

@setarcos you are right, I dont know if there is a way to check this in runtime. I check the release notes etc. e.g. freebsd 12.2 release notes (https://www.freebsd.org/releases/12.2R/relnotes/) say: „The ixl(4) driver has been updated to version 1.11.29. [r363876] (Sponsored by Intel Corporation)“. There should be a directory where you can see all packages and their versions in a specific distribution, not sure how it is called, I am also new to freebsd. It is also possible to update the driver to not use the one in the kernel, but use a newer version as an external module, but I am not doing that considering it is a less tested scenario. Also pay attention not all NVM update paths are tested same or supported, so you might need to do more than one updates (x to y, y to z, instead of x to z) to be on the safe side.

@mr-rosh try some options on ali express

https://www.aliexpress.com/popular/1u-network-firewall.html

@jimp said in How to set different certain screen resolution on FreeBSD and pfSense boot for VGA and COM Console output ?:

Serial ports have no resolution. That's up to your terminal. The default shell prompt already runs a little utility called resizewin which probes the terminal for its window size and sets the rows/columns appropriately without you having to do anything. It works fine with screen, PuTTY, SecureCRT, and most other serial clients I've used. I keep my terminal set to either screen or xterm though I'm not sure what the specific requirements for that are.

As for the video console, as I said, that depends on your hardware and its capabilities, if the drivers are available, etc. For a general solution for basic modes, see the posts in the other thread I linked, but that won't get you a high resolution console mode.

We aren't including tons of video drivers or X11 parts to drive graphical features because they don't belong on a firewall. They take up space, resources, add potential security problems, and are unnecessary in this role.

I agree with most of Your arguments about not to including tons of drivers.

But including VGA Resolution I,m asking in previous message (1600 x 1200 and 1280 x 1024) looks very reasonable because almost all of users have modern displays with a high size.

Well, glad you were able to get installed eventually. 😉

Ah, yes not much we can do then. At least that explains it.

Steve

@nickehallgren i've been using solarflare 10g network cards with pfsense. they work great. you can find them for cheap on ebay. Don't about EU though.

@nogbadthebad said in Hardware for 10-25 Gbit/s WAN/NAT:

A home user will never fully saturate a 25Gbps circuit.

Sounds like a home user that needs to try harder. 😉
All you need is 25 computers running speed test at the same time... A YouTube video idea was just born.

@attilay2k I have tried a few Linux based firewall distros on Raspberry Pi over the years just out of curiosity. I have rejected all of them because the log files are useless when a large number of entries appear stamped 1 Jan 1970.

The RPi does not have a battery backed Real Time Clock so it relies on syncing with a NTP source. However, quite often log entries are made before time sync has occurred. Yes you can add a RTCmodule to a Pi but this puts the cost up further.

My preference is to use repurposed thin client terminals. There are a number of low power consumption 64-bit intel based thin client terminals that have been produced by various brands. My favourites use 1.3Ghz intel Atom 3825 dual core CPU with AES-NI.

Used prices and models vary, but I often can buy one used and upgrade it with 32GB mSATA SSD, 4GB-8GB or RAM for less cost than a comparable RPi4. The RTC, AES-NI and SSD using ZFS make it far better than a RPi.

The only downside is the number of Ethernet interfaces, usually just one. Up until 2.4.5p1 I have successfully used them in 24/7 use cases with USB Ethernet. However, with 2.5.2 and 2.6.0 now with ure driver, reliability on USB Ethernet has gone. Fortunately, for all but a few I have reconfigured them to use VLANs with a VLAN capable switch.

You may find this link useful.