Hardware

• 

  Official pfSense hardware board
  • ivor  

  1
  0
  Votes
  1
  Posts
  14831
  Views

  No one has replied

• N

  pfSense on Watchguard M370
  • networkBob  

  46
  0
  Votes
  46
  Posts
  1799
  Views

  H

  I want to confirm. Thanks for all your advice. I been capable to install it without any problem. ibg0 was WAN, ibg1 was a dhcp lan which allow me to connect to the router a finish the installation process. Just a bit of netgating (googling forum) give me the params for the serial connection (baud rate 115200) And Voila!... But find out later on the console connection is not required for installation, just deploy the installation in the disk, and insert it. Wait some time for the funny bip sounds and ready to connect. Also thanks to another user above, used the right file system during installation. I may assume in theory, the M470 and the M470 HA are same way, hardware appliance Pfsense capable (which was my main worry). Keep informed. Cheers...
• R

  D-Link DWM-222 LTE Dongle with 2.5
  • rmeskill  

  28
  0
  Votes
  28
  Posts
  142
  Views

  R

  I also just upgraded the firmware to 2.1.2 rev A1, available here and confirmed a couple things on my Windows machine. It does initially connect as a USB/CD folder, and when you launch the connection program it disconnects that, presumably making the mode change which we need to produce here. I've also tried running it through an unpowered USB hub, just to see if that somehow affected things, but it just comes up as 7.3 (with 7.2 being the hub itself) with no additional CDROM in /dev: [2.5.0-DEVELOPMENT][admin@pfSense.localdomain]/dev: ls acpi apm bpf0 cpuctl3 cuau2.init fd io label mixer1 null reroot stdout ttyu2 ttyv3 ttyv9 ugen1.1 ugen7.1 usbctl ada0 apmctl console ctty cuau2.lock fido kbd0 md0 mlx5ctl pass0 sequencer0 sysmouse ttyu2.init ttyv4 ttyva ugen2.1 ugen7.2 xpt0 ada0s1 atkbd0 consolectl cuau0 devctl full kbd1 mdctl music0 pci sndstat tcp_log ttyu2.lock ttyv5 ttyvb ugen3.1 ugen7.3 zero ada0s1a audit cpuctl0 cuau0.init devctl2 geom.ctl kbdmux0 mem netdump pf speaker ttyu0 ttyv0 ttyv6 ufsid ugen4.1 uinput ada0s1b auditpipe cpuctl1 cuau0.lock devstat hpet1 klog midistat netmap pts stderr ttyu0.init ttyv1 ttyv7 ufssuspend ugen5.1 urandom agpgart bpf cpuctl2 cuau2 dumpdev input kmem mixer0 nfslock random stdin ttyu0.lock ttyv2 ttyv8 ugen0.1 ugen6.1 usb [2.5.0-DEVELOPMENT][admin@pfSense.localdomain]/dev: usbconfig ugen1.1: <Intel UHCI root HUB> at usbus1, cfg=0 md=HOST spd=FULL (12Mbps) pwr=SAVE (0mA) ugen7.1: <Intel EHCI root HUB> at usbus7, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (0mA) ugen6.1: <Intel UHCI root HUB> at usbus6, cfg=0 md=HOST spd=FULL (12Mbps) pwr=SAVE (0mA) ugen5.1: <Intel UHCI root HUB> at usbus5, cfg=0 md=HOST spd=FULL (12Mbps) pwr=SAVE (0mA) ugen3.1: <Intel EHCI root HUB> at usbus3, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (0mA) ugen2.1: <Intel UHCI root HUB> at usbus2, cfg=0 md=HOST spd=FULL (12Mbps) pwr=SAVE (0mA) ugen0.1: <Intel UHCI root HUB> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=SAVE (0mA) ugen4.1: <Intel UHCI root HUB> at usbus4, cfg=0 md=HOST spd=FULL (12Mbps) pwr=SAVE (0mA) ugen7.2: <vendor 0x058f product 0x6254> at usbus7, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=SAVE (100mA) ugen7.3: <Mobile Connect Mobile Connect> at usbus7, cfg=255 md=HOST spd=HIGH (480Mbps) pwr=ON (500mA)
• 

  ARM Cortex vs Intel?
  intel arm cortex • • valnar  

  5
  0
  Votes
  5
  Posts
  147
  Views

  B

  @bigsy said in ARM Cortex vs Intel?: Crypto hardware support. It never appeared for the SG-1000. Appears to be "in development" for the SG-1100 but currently AES-128-CBC only. Available on the SG-3100 which, AFAIK, supports AES-256-CBC but not AES-GCM. So I have the 3100 and my openvpn tunnels list : Jun 5 07:20:47 openvpn 50515 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA What am I missing?
• D

  PC Engines apu2 experiences
  • dugeem  

  466
  0
  Votes
  466
  Posts
  83768
  Views

  D

  @Veldkornet "The only thing I did between having good iPerf results and slow ones was reboot the device. It's as if after a reboot, it forgot that hardware offload was enabled, and I just needed to set it again." so, enabling / disabling these functions will in any case require a restart! without it it makes no sense, thus, the test is not relevant either if the function is still active after a restart, this must be disabled with this way /boot/loader.conf.local hw.bce.tso_enable=0 or 1 hw.bce.lro_enable=0 or 1 ......... etc. edit: bce / igb / etc. test method after reboot: ifconfig igbX | grep CSUM X= 1 ,2, 3, 4, or........
• S

  Raspberry Pi 4 with 8GB of RAM!
  • SmokinMoJoe  

  7
  0
  Votes
  7
  Posts
  177
  Views

  S

  @akuma1x I would like one that does not have the Intel ME. I already have an AMD system that I am going to setup for pfSense that does not have any of the vPro backdoor OS running.
• M

  Best config money can buy
  • malabarka  

  12
  0
  Votes
  12
  Posts
  1610
  Views

  

  Spammer is my bet ;)
• N

  Netmap not supported for Intel X553 driver in pfSense 2.5.0
  • NRgia  

  31
  0
  Votes
  31
  Posts
  262
  Views

  N

  I got a very interesting response from Intel, after I asked if their latest release 3.3.10 supports X553 chipsets. To give this response as an real life case scenario, how can I track if the code from Intel's driver release 3.3.14, is included or will be included with FreeBSD upstream driver? Thank you
• T

  Official Realtek Driver Binary 1.95 For 2.4.4 Release
  • TheNarc  

  93
  7
  Votes
  93
  Posts
  11186
  Views

  

  @Griffo said in Official Realtek Driver Binary 1.95 For 2.4.4 Release: I was about to replace my Qotom N3150 based firewall I have one of these Qotom N3150 and I have never had any issues since updating the drivers over 12 months ago. It just keeps 'trucking' along and only gets rebooted for an update.
• N

  WatchGuard Firebox T70
  • networkBob  

  12
  0
  Votes
  12
  Posts
  180
  Views

  

  Ah, some more info there. We can see the headings on the SW1 DIP switch settings. Either I210-88E6176, the default setting and how they are now set, or SoC-88E6176. So maybe the switch can be configured via one of the igb ports or from a GPIO line on the SoC dircetly. The bootlog from the original OS might provide a clue there. The 2-wire eeprom is almost certainly what the switch pulls it's default config from. As we discussed before it is probably configured to come up with all ports disabled as that is the best option from a security point of view. Then the OS sets up the ports and VLANs as required. However without the eeprom connected there's a good chance it comes up as a dumb 5 port switch which would be much more useful here if we can't control it. I don't have one of those but if I did I would move the SW5 DIP switches to the other position. And see if that allows the switch to come up with ports enabled. If course I'm guessing here so the risk is all yours! Steve
• R

  Predicting resources used by packages
  • riftor_77  

  6
  0
  Votes
  6
  Posts
  64
  Views

  

  @riftor_77 said in Predicting resources used by packages: Thanks for all the responses so far. For context, I set up my system similar to pfSense baseline guide with VPN, Guest and VLAN support and then added pfBlocker and Suricata on top. My question is actually how to calculate what changing each of those many variables will add or subtract from the resource load. I want to find it my ideal settings, calculate how much resources everything takes, and then build my system to those specifications. For example, if I am using pfBlocker and I add another feed, how do I calculate the additional CPU and RAM usage that adding that feed will require? Let me know if I am clearly explaining my request. Why not simply run a controlled test and see for yourself? Measure CPU and RAM usage while running traffic through the box with iperf without that additional feed enabled, then repeat the exact same test with the feed enabled. You can even do it several times and compute an average. I doubt you see very much of a change, though. Just remember to reset the states in between the tests to be sure the firewall actually inspects the test traffic against the entire rule chain and does not use an existing state established during the first test to bypass a bunch of rules in the second test.
• C

  Hardware recommendations for new user
  • calgarychris  

  14
  0
  Votes
  14
  Posts
  297
  Views

  C

  @valnar said in Hardware recommendations for new user: If one of your requirements is route at gigabit speeds (#6) internally, and not just be limited to the 100Mb Internet speed, then some of the smaller units won't suffice. That said, I do have a PC Engines APU2 myself for my pfSense box it's great, but it won't go much more than 600-700Mb. Yeah, I would definitely want to keep internally routing at gigabit speeds. My understanding from watching some of the Lawrence Systems reviews is that it isn't an issue with the 3100 and above. My concern with that unit is whether is can reliably do OpenVPN at > 100Mbps and secondly, if it's up to the task if I were to start installing packages. The LS review suggests it is, but I've seen some posts suggesting it might not be. Thanks
• V

  Temperature sensor : Intel NIC
  • verizu  

  6
  0
  Votes
  6
  Posts
  213
  Views

  

  Yep, that's probably a good idea. If it can be read I doubt it would be that hard to display it. Steve
• A

  Zotac CI323 Installation - Controller Failures
  • ac0hen  

  25
  0
  Votes
  25
  Posts
  7344
  Views

  N

  @Orbixx said in Zotac CI323 Installation - Controller Failures: @noconnor Any luck? I added those entries to /boot/loader.conf.local and that has definitely bypassed the boot issues. I did try adding those elements to System > Advanced > System Tunables (for config backup) but couldn't get that to work. I'm pretty sure that was a just me entering them wrong. I haven't tried moving over to a 2.5 version yet to see if that makes a difference. edit: Actually, reading the docs for System Tunables, it looks like I was mistaken and those values (Loader Tunables) are not applicable to System Tunables.
• R

  Watchguard Firebox M400/M500
  • revsie  

  319
  0
  Votes
  319
  Posts
  24470
  Views

  

  For anybody looking.. https://www.amazon.com/Extension-Female-Signal-Exchange-Flexible/dp/B086W3JK1X/ref=sr_1_689?dchild=1&keywords=PCI-E%2BPCI%2BExpress%2BFemale%2Bto%2BFemale&qid=1590442937&s=electronics&sr=1-689&th=1 There is more than one type on Amazon. Lanner tells me that the adapter shown earlier is out of production.
• 

  Pfsense 2.4.5 - Bug? "bge0: firmware handshake timed out, found 0x4b657654" dropping WAN interface needing reboot.
  • Aterfax  

  15
  0
  Votes
  15
  Posts
  260
  Views

  

  Yeah, that's a huge latency. When it reloads normally it's barely noticeable. I would at least test disabling smp to see if it solves the issue. If it does that is fixed in 2.4.5p1 so that will be a permanent solution. Steve
• K

  Watchguard XTM 5 Series
  • kmeyntz  

  917
  0
  Votes
  917
  Posts
  242635
  Views

  L

  @stephenw10 ok i will flash the card F with last pfsense with pfsense : boot stuck at : em5: <Intel(R) PRO/1000 Network Connection 7.6.1-k> port 0xac00-0xac1f mem 0xfe7e0000-0xfe7fffff,0xfe7dc000-0xfe7dffff irq 17 at device 0.0 on pci2 : solved. same issue : [2.4.3-RELEASE][root@pfSense.localdomain]/root: pkg update Updating pfSense-core repository catalogue... pkg: Repository pfSense-core load error: access repo file(/var/db/pkg/repo-pfSense-core.sqlite) failed: No such file or directory Certificate verification failed for /C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Domain Validation Secure Server CA 34405266376:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:/builder/ce-243/tmp/FreeBSD-src/crypto/openssl/ssl/s3_clnt.c:1269: pkg: https://pkg.pfsense.org/pfSense_v2_4_3_amd64-pfSense_v2_4_3/packagesite.txz: Authentication error Unable to update repository pfSense Error updating repositories!
• P

  Problem with Intel Pro 1000
  • Pinguincommander  

  17
  0
  Votes
  17
  Posts
  260
  Views

  T

  Thank you guys, very much. All your suggestions and comments really helped me get familiar with pfSense. I'm starting to question why I went such a long time avoiding it. The NC-365T card came in and pfSense recognized it right away. But before it came in I had already learned how to use VLANs for the multiple internal subnets. Now I believe that VLANs is the best solution. It saves ports on the switch. Plus, the bottleneck is still the going to be the WAN connection and not the single Trunk port for all the subnets. I also learned how to use Virtual IP addresses for my static IP subnet on my WAN. In my opinion, pfSense rocks. I will be using the NC-365T on my Hyper-V Server to separate NAS devices and shared printers into different VLANs.
• D

  Found that Realtek NICs are now adequately supported
  • DominikHoffmann  

  4
  0
  Votes
  4
  Posts
  131
  Views

  D

  @Pippin: In my case it would be for home use. Problem was that I purchased that fanless PC before realizing that it would pose a problem. I was pleasantly surprised that the problem had gone away in the meantime. I am also wondering, whether Intel NICs carry a licensing premium.
• A

  Netgate SG-1000 Slowdown Connection Speed
  • acebugner  

  2
  0
  Votes
  2
  Posts
  37
  Views

  

  The SG-1000 was a lower powered device, I would expect to see ~130Mbps through it in a typical install. So 94Mbps seems low but you will never see anywhere near 500Mbps. Steve
• R

  Firebox LCD Driver for LCDProc
  • ridnhard19  

  398
  0
  Votes
  398
  Posts
  219055
  Views

  D

  @stephenw10 yea, very strange. It seems to me that the lcdproc service window where you set that information isn't copying and saving that information. Thanks again
• C

  Official Realtek Driver Binary 1.95 For 2.5.0-DEVELOPMENT (amd64) FreeBSD 12.1-STABLE
  • christian.k  

  7
  1
  Votes
  7
  Posts
  173
  Views

  N

  @christian-k How did you manage to include Netmap support for the Realtek driver? I tried to do the same for Intel ix553 cards that come with this board https://www.supermicro.com/en/products/motherboard/A2SDi-4C-HLN4F , but after compiling I'm getting this error: link_elf_obj: symbol D undefined linker_load_file: /boot/modules/if_ix_updated.ko - unsupported file type With the current pfSense driver I only reach 176 Mbits with Suricata in Inline mode. If I disable suricata I get 960 Mbits I compiled from ports /usr/ports/net/intel-ix-kmod It's not my intention to hijack the thread, but I did not want to bother you with a private message. Thanks
• N

  Connectivity issues after applying new configuration
  • nulpwn  

  2
  0
  Votes
  2
  Posts
  30
  Views

  

  What exactly happens? What connectivity is lost? This happens with any config change? Creating a new interface is quite a big config change compared to, say, creating an alias. Nothing in that setup should present an issue, they are all well tested components. When you hit this what do you do to regain connectivity? Steve
• S

  This topic is deleted!
  • sangnimit  

  1
  0
  Votes
  1
  Posts
  5
  Views

  No one has replied

• C

  Any out of the box working pcie LTE modems found?
  • Clouseau  

  7
  0
  Votes
  7
  Posts
  132
  Views

  

  I had a GSM modem in the 90's and I assure you it's not that bad. I agree it could be a lot better. The best thing you could do to improve matters is to port umb(4) driver from OpenBSD to FreeBSD, or persuade someone else to port it. Steve
• I

  Low routing performance new build, N3160, i211-AT
  • iphonelover  

  11
  0
  Votes
  11
  Posts
  2646
  Views

  V

  This can be fixed by enabling PowerD and set it to Hiadaptive and applying the following tweaks for network stack. once applied reboot and test. Disable hardware checksum offload Disable hardware TCP segmentation offload Disable hardware large receive offload kern.ipc.nmbclusters="1000000" hw.igb.rxd="4096" hw.igb.txd="4096" net.inet.tcp.syncache.hashsize=1024 net.inet.tcp.syncache.bucketlimit=100 net.isr.defaultqlimit=4096 net.link.ifqmaxlen=10240 hw.igb.rx_process_limit="-1" hw.igb.num_queues=2 dev.igb.0.fc=0 dev.igb.1.fc=0
• M

  Any benefit to going 10Gig on LAN interface with Gigabit WAN?
  • mattlach  

  8
  0
  Votes
  8
  Posts
  251
  Views

  

  I've been running this card for a while: ix0@pci0:2:0:0: class=0x020000 card=0x17d3103c chip=0x10fb8086 rev=0x01 hdr=0x00 vendor = 'Intel Corporation' device = '82599ES 10-Gigabit SFI/SFP+ Network Connection' class = network subclass = ethernet It causes reboot problems but that's almost certainly a BIOS issue in that particular box. It's an HP-560SFP+ card. x520 in general should definitely be supported, it's been in the ixgbe driver for years. Steve
• P

  How Do you Check NIC Interfaces In PFSense/FreeBSD?
  • Phabeon  

  12
  0
  Votes
  12
  Posts
  253
  Views

  D

  As in the previous posts before me, a suspiciously cheap card is sure to cause trouble, there are plenty of fake Chinese clones out there :-). It can be said that there is a good support for Intel cards under FreeBSD, but not all chipsets are suitable. It's a question of what you want to use it for in the pfSense? I350-based cards are perfect, with a smaller compromise I210 and possibly I211-based. (igb4) - https://www.freebsd.org/cgi/man.cgi?igb(4) As Steve recommended, search for possibly used brand (HP, Dell, etc.) cards based on Intel Ethernet controller. I would also take into account the recommendation of "bmeeks" (Bill Meeks) for your future use of NGFW: " Snort Package 4.0 Inline IPS Mode Configuration IMPORTANT HARDWARE LIMITATION The new Inline IPS Mode of Snort will only work on interfaces running on a supported network interface card (NIC). Only the following NIC families currently have netmap support in FreeBSD and hence pfSense: em, igb, ixgb, ixl, lem, re or cxgbe. If your NIC driver is not from one of these families, netmap and Inline IPS Mode is not going to work properly, if it works at all." The question of dual / quad is the extent of usage and the question of segmentation, how big is your network?
• A

  Does anyone know what this means?
  • AYSMAN  

  4
  0
  Votes
  4
  Posts
  71
  Views

  

  No it just means the button itself is registered not that it was pressed. It's a message that appears at boot in almost every x86 device. For example: isab0: <PCI-ISA bridge> at device 17.0 on pci0 isa0: <ISA bus> on isab0 pcib5: <ACPI PCI-PCI bridge> at device 19.0 on pci0 pci4: <ACPI PCI bus> on pcib5 acpi_button0: <Sleep Button> on acpi0 acpi_button1: <Power Button> on acpi0 acpi_tz0: <Thermal Zone> on acpi0 acpi_tz1: <Thermal Zone> on acpi0 acpi_acad0: <AC Adapter> on acpi0 You need to check the system logs for whatever the last thing shown was before it shutdown. Steve
• E

  pfSense on HP DL320e Gen8 v2 ZFS issue
  • emiljan  

  4
  0
  Votes
  4
  Posts
  110
  Views

  E

  @provels, Im not sure if top will show you what you need, but the command "procstat -ta" will list all processes running including all processes that start with zio. I also ran a zfs scrub and zpool status command, the array appears normal without any issues reported: pool: pfsense state: ONLINE scan: scrub repaired 0 in 0 days 00:00:02 with 0 errors on Tue May 5 11:09:44 2020 config: NAME STATE READ WRITE CKSUM pfsense ONLINE 0 0 0 mirror-0 ONLINE 0 0 0 ada0p3 ONLINE 0 0 0 ada1p3 ONLINE 0 0 0 errors: No known data errors
• F

  PfSense on a Dell Latitude E6420
  • FrankZappa  

  22
  0
  Votes
  22
  Posts
  321
  Views

  

  @FrankZappa I have used Sonnet before on a MacBook Pro I had contemplate using as a pfSense box. Yes, it has Broadcom and it works ... just a little issue running IDS/IPS because it's in emulator mode with Netmap instead of the full interaction with Netmap. BTW - your Intel -82579LM Gigabit is supports the new Intel driver, so no problem.
• R

  Aquantia Network Interface - Can I make this work?
  • Rhydgaled  

  6
  0
  Votes
  6
  Posts
  134
  Views

  

  FreeBSD 13 is the bleeding edge development branch. It won't make it into pfSense anytime soon. An additional 1G NIC should not be a big deal. You may be able to use VLANs instead if you have the switches. Steve
• D

  SR-IOV support on consumer grade motherboards.
  • dwa  

  9
  0
  Votes
  9
  Posts
  81
  Views

  

  no, no difference
• D

  Intel X710 troubles
  • dagrizz  

  3
  0
  Votes
  3
  Posts
  103
  Views

  D

  I should have been more clear that when the system boots and reports those "queue timeout" errors, there is no network connectivity. I am unable to communicate with the system until I disable the switch ports and reboot. From pciconf: class=0x020000 card=0x00068086 chip-0x15728086 rev=0x02 Attached is the screenshot from iDRAC reporting driver, nvm, etc versions. No virtualization is being used.
• T

  NIC swap help
  • techpro2004  

  24
  0
  Votes
  24
  Posts
  245
  Views

  D

  Now in this case it is not the "size" that matters :-) The size of the PCB depends on the component density of the cards and the ideas of the engineers designing the circuit. The front of the cards is most often interchangeable with a full-size and half-size adapter plate. Hmmm, if I remember correctly we have already talked about the right source of purchase above. Amazon is not a typical quality hardware retailer site. I'm glad you resolved the issue without community help.
• A

  XL710TF4 sfp+
  • aminbaik  

  7
  0
  Votes
  7
  Posts
  82
  Views

  

  It doesn't show at all in pciconf or it just shows up as a 'none' entry? If it doesn't show at all then a newer driver will not help. Steve
• 

  APU 4d4 installation problems 2.4.5
  • dotdash  

  7
  0
  Votes
  7
  Posts
  247
  Views

  

  Adding some more data points into this conversation with myself: Managed to get the first two apu4d4's loaded with 2.4.5 (using a usb header off the board, not the front usb). Swapped them out with two units that were running 2.4.4p3. Same batch of hardware, same bios revision. I tested writing the image to an SD card and installing from SD to the msata. This works fine. These two units get the same CAM errors trying to install from a usb stick in the front usb ports. I tried updating the bios on one from 4.11.0.3 to 4.11.0.6, no change.
• F

  EZIO Driver for LCDproc
  • fmertz  

  133
  1
  Votes
  133
  Posts
  11953
  Views

  P

  @stephenw10 yes, reinstalled the package and have done the same just to make sure I am not mad. so no mods this time, same effect. Ie lcdproc server is running but no client connected.
• H

  This topic is deleted!
  • hycsystembella  

  1
  0
  Votes
  1
  Posts
  8
  Views

  No one has replied

• G

  Sunix serial PCIe driver - close but no banana
  • greeners  

  10
  0
  Votes
  10
  Posts
  75
  Views

  

  What? (smells like spam) Edit: Yup!