I resolved my problem by ordering a new nic
thanks for you help

Thank you, that was one area in which I didn't think of using.  The reason as to why, is that the tunable, kern.ipc.nmbclusters=131072, did not work when configured this way.  At first tunable hw.igb.fc_setting=0 didn't work, but I am persistent and there are a few possible configurations.  So, I used dev.igb.0.fc=0 and dev.igb.1.fc=0 as tunables and finally flow control was disabled on WAN and LAN.  I also configured hw.igb.header_split: 1 but that didn't work as a tunable.  However, flow control is finally disabled, and that was my goal.

Thank you

It's not that expensive

But easy to use, easy to configure and really powerful.

@csswormy
As a home user it is also not really wise to use a LAG, pending on the configuration, because the first link
must be fully rendered or saturated until the next one will be in use. So a home network often is not able
to produce so much traffic.

It will be mostly only a workaround solution and if this device is driver based and you get no driver for FreeBSD
or pfSense it will be only a fine dust collector with no kind of sin.

The latest ix driver from Intel was imported to 2.3 this week. None of the Intel 10G cards we sell or have available show any of the issues described in this thread, so not sure whether or not that fixes it, but it's definitely worth trying.

@thejtshow

thank you. Yes I will take that criticism at this point.

In normal we all awaiting constructive criticism, and we are all not really pleased about, if we
are only hearing some monotheistic repeating refrains like "don´t do that and don´t use this"
for sure I will consider to that point. But on the other way I must also really consider to the
standpoint of all other peoples, that "bridging ports" is only a use case for very experienced
network admins that knows to 100% when and where bridging must be done or is needed.
So in shorter words for all others of us, routing should the right way to be gone.

As a golden rules for networking, you cold remind of this:
Route if you can and bridge only if you must.

btw. I heard the Donald looked like an idiot last night, no clue what to do with health care or whatever. Maybe he REALLY is clueless when it comes to real  politics?

Our Donald was tumbling down in earlier years to the deepest bottom, and rising again from their to the
highest top now, it is a hard way and really steep journey! So I really think he is a good guy and means it
in the right direction for his country, but sometimes also that he is not able to transport it to the masses as
he is meaning it really.

Thanks very much cmb. I do have a limiter configured. I'll disable it and report back.

Another idea would be to get a RaspberryPI with a big button beside it. Write a small script on the PI to remotely shutdown your pfSense through network (pfSense would also need a small server script for that). Teach your boss to hit the big button first before he leaves, and wait until the LEDs on the appliance go down. And cut power afterwards.
Oh - and keep a couple of PIs for spare in the drawer  ::)

divsys,

Thanks. There is indeed only one client with "brain dead" applications
that can't handle a change in IP address. I've moved it to a static lease.

jahonix,

Thanks for pointing that out. I will indeed use the amd64 embedded image.

MV

Well the 970 is very very fast and will use less power encoding too..:)

@Diler:

https://forum.pfsense.org/index.php?topic=88595.0

As I see it is not supported :-(

Yes it sin´t supported because of the ARM-A9 CPU, there is no ARM fork of pfSense until now.
But, if you interested in, you could go with a SG-2220 from the pfSense Store. Or with the
Minnowboard Turbot what is nearly the same as the Hummingboard.

My main reason for this question is because most of the time when you sell a firewall to a customer there is an expectation of warranty and support for the unit.  PfSense does not offer this with their product from what I have seen so I only purchased one from them.  When the price for the customer and myself is the same I become hesitant to sell a solution in which I end up carrying the burden of being responsible for replacing it.

The onsite warrant eleviates that concern.

For me to source parts would be about a week as no one has this stuff locally where I am.

I am an MSP and looking at selling this as part of a bundled service to customers.  I think with the time required to source parts, wait for delivery, build time I am better off just buying the units with warranty.  I can always give the option of lower warranty period as they offer 1,2,3 year options.

Curious what others charge either annually or monthly to maintain, support and replace pfSense firewalls.

And with regards to supporting the software I think I could just buy a 5 pack of incidents as a backup and spread those across all the firewalls in the event I need them.  It did not look like their support incidents were device specific.

I am very interested in the SG-2220, as it is a certified piece of hardware with a solid looking set of specs.

Pending on your art of usage and the not available extra packets, it would be really nice for you.

As far as I understand, if I buy the unit with an mSATA SSD installed pfSense will be installed onto it, but if I buy the unit without the SSD, pfSense will be installed on the on-board flash.  Is this correct?

Yes this might be correct, but I in your situation would more send a email address with a pre-sales question
to the pfSense -store itself.

If I were to buy the unit without the SSD, can I insall an SSD in the future without voiding the warranty? How would I move the installation over?

You might be installing it on the eMMC storage or a mSATA, this did not avoid the warranty as I see it right
but again those questions should be asked not in a forum but more send directly to the pfSense store via mail.

Any help/direction that anyone could provide would be appreciated.

Get this device without a mSATA and use the eMMC storage and if you decide yourself later then
to get a mSATA you only have to change the boot order in the BIOS thats it, and perhaps on top
copying the config backup over to the new installation, not more and not less.

A custom ADI image, matching to your SG-2220 unit, will be available to download after the registration
of your SG-2220 unit.

My internet connection, if it matters is 76 down/19 up, but I am getting nowhere near that right now because the way my network is set up.

The SG-2220 will be handle it with ease.

Please check http://www.3g-modem-wiki.com/page/ZTE+AT-commands

I would think with the design of the supermicro 1u case and having it mounted vertically convection would create airflow.  The case is completely porous on the back and front.  So I will probably get it with the fans and try using it without and as mentioned if it runs to hot I call always re-connect the fans.  Thanks to everyone for the advice and suggestions.

The shaping config was pretty basic, just went thru the multi wan wizard and created the (PRIQ) queues for each of the openvpn interfaces.  Each interface was just set to prioritize VoIP traffic and treat all other traffic at the same priority after that.

When uploading anything more than a couple mbps, the cpu spikes.  Anything about 10mbps sustained and it's 100% CPU.  The top output shows all openvpn client processes being used for uploading at 100%.  The CPU line in top is ~8% user, ~92% system.  I'm pretty sure that 8% is for the vpn encryption and the 92% in the system is the traffic shaper doing its thing.

So we are done with Intel 535 SSD… sigh...

Bad for you, but on the other site fine for us to know, thanks for sharing this information with us.

For official product SG-2440,  it can choose "802.11a/b/g/n 2T2R with Two Antennas - ($75.00)"  what model for this ??

Antennas are even based on the chosen WiFi card, it is more the question what WiFi card is installed
and what antenna is supported by this card!

I want to buy a mini PC + mini PCIE wifi module to build my wireless router.

There are different models and chip sets you can use with pfSense, I think there are many
documents that will be showing well supported WiFi cards for pfSense and then if you where
choosing one of this you might be looking for an antenna that matches this cards.

The other think is the case of usage, if you want to connect some devices at home, in the office
or else where (many to one) you go better with round beam Dipol antennas and if you want to
connect only one point-to-point you get better results with beam aerial or directive antennas.

So you see it is more based on the used card and the entire use case what kind of antennas you
will need to buy.

I have had really good results with the following cards:
Compex WLE200NX a/b/g/n
Ubiquiti (UBNT) SR71-E a/b/g/n

Here are on top some links you could get informations about:
What is the best WiFi card to use
Supported Wireless Cards
pfSense wireless interfaces

HowTo pfSense WiFi installation (Germany language)

@Onigma:

Does pfSense work on nano ITX (on Intel J1900 SoC) ?

http://www.ebay.com/itm/China-Computer-Hardware-4-Ethernet-Mini-PC-Barebone-pc-industrial-Free-shipping-/262265331612

PfSense software firewall based on x86 hardware, so it should run without problems. This is the third device
I have seen in the last month here in the forum, and yes this devices should be fine on the first view, but for
running 24/7/365 they will get to hot!

Self made box:
2 x 4 GB RAM $40
mSATA 120 GB $50
Compex WLE200NX $40
Jetway NF9HG-2930 Thin mini-ITX Network Motherboard $204.00
M350 Universal Mini-ITX PC enclosure PicoPSU compatible; $38.50
Sabrent AD-LCD12 LCD Monitors 12V 6A 72W AC Adapter Power Supply $10

ready assembled Bare bone
Jetway NF9HG-2930 Intel Celeron Quad Core Fanless PC w/ 4X Intel LAN, 2GB, M350 ~$299

Yours might be cheaper but if you must RMA it, amazon will be the better choice as I see it right.

I know people sh*t on older CPU's but IMHO if you can get a board with an older CPU for the right price it and it meets your requirements go for it.

And exactly the price and other numbers was the turn around point for me to prevent from this one!
Jetway Intel Atom D252 based boards are at $198 - $214, but the Intel Celeron N2930 is also able to
get hands on and also from Jetway for $199 - $204!!!
D252          N2930
Q1/2010    Q/2014
2C/ 4T        4C/4T
4 GB max.  8GB max.
13 Watt      7,5 Watt 
1,8GHz      1,8GHz - 2,16GHz

My pfsense box with an Atom D525, dual wan, and squid doesn't break 20-30% as a home router with heavy duty streaming.

And what now might be false to go with the same price range but getting more power and less power using
on top for the same money? The N2930 is able to route 1 Gbit/s at the WAN interface and able to run Snort,
Squid and pfBlocker-NG.