I'm sure people have done plenty of work on this subject, there's probably more reading material than you could get through in a rational time! It's interesting to look at other hardware. Many 'hardware' firewalls use a dedicated ASIC/FPGA to speed up routing duties also many newer system on chip style devices have dedicated hardware for doing so. In pfSense we are using all software and since it's built on FreeBSD there is little hope of seeing support for obscure hardware acceleration devices. Also the FreeBSD Marvell driver used here does not seem to perform as well as the equivalent Linux driver used by Watchguard. Even so if you look at those figures you'll see that on the X550e the CPU is not the limiting factor. It's just not possible to read and write the data across the PCI bus fast enough. I did spend some time trying to decide what the maximum theoretical throughput would be between two devices sharing the same PCI bus but failed to reach any useful conclusion. The maximum bus speed is (33MHz x 32bit) 1056 Million bps, ~1Gbps. The data path depends on reading the data, processing it, and writing it out again which can not be done simultaneously. Thus I expect the maximum speed, given an infinitely fast CPU, to be ~512Mbps. That seems to line up with the results above but I've seen other figures stating more than that. Perhaps the bus speed is >33MHz or wider than 32bit? I'm unsure how to find out. Slightly off topic but all the calculations you ever see on this state 133MB/s calculated by 4bytes (32bit) x 33MHz. However that seems to completely ignore the fact that Mega is 33MHz is 1x10^6 where as the Mega in 133MBps is 2^20.  ??? If you come up with some definitive numbers on this I'd love to know.  ;) Steve

Are you trying with a CFCard? Already tried to change the CF Card? It appears a filesystem problem (sh not found).

Indeed. I've never looked inside one but the 4200 at least is ARM. https://forum.openwrt.org/viewtopic.php?id=23517 They have number of models though, they may not all be ARM. Steve

So is mbmon running? It isn't included in 2.1 as standard. Here's my own P4 box: [2.1-RELEASE][root@pfsense.fire.box]/root(3): mbmon mbmon: Command not found. [2.1-RELEASE][root@pfsense.fire.box]/root(4): /etc/rc.conf_mount_rw [2.1-RELEASE][root@pfsense.fire.box]/root(5): pkg_add -r mbmon Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.3-release/Latest/mbmon.tbz... Done. [2.1-RELEASE][root@pfsense.fire.box]/root(6): rehash [2.1-RELEASE][root@pfsense.fire.box]/root(7): /etc/rc.conf_mount_ro [2.1-RELEASE][root@pfsense.fire.box]/root(8): mbmon ioctl(smb0:open): No such file or directory Temp.= 42.0, 17.0, 55.5; Rot.= 5625, 5720, 5578 Vcore = 1.15, 2.38; Volt. = 3.36, 5.05, 12.10, -12.04, -0.62 Steve

You will need to be careful with that. Notice in your logs: cdce0: <huawei 0="" 2="" technology="" huawei="" mobile,="" class="" 0,="" rev="" 2.00="" 1.02,="" addr="">on usbus0 cdce0: faking MAC addresscd0 at umass-sim0 bus 0 scbus1 target 0 lun 0</huawei> The cdce(4) driver cannot read the MAC address from the USB device correctly so it makes one up. That's fine but if you ever disconnect it or reboot pfSense it will make up a new MAC address causing trouble. At least that has been my experience with similar devices. Steve

I would be amazed if it didn't have those options. Depending on which hardware revision on that router you have you may be able to put OpenWRT or DD-WRT on to it to unlock some more options. You shouldn't need to do that though. Steve

@razzfazz: Even when using inefficient MPEG2 encoding, 1080p needs less than 40mbps (and obviously even less when you use a more efficient codec like H.264). What makes you think you'd need gigabit speeds for your streaming? I don't.  But it does mean that prices for higher-tier plans will follow suit and drop across the board so that more people will pick-up faster fibre and I'll get more places to tunnel and stream from.

Based on the personal performance testing of the R300 vs other rack mounts I have tried, these are an awesome deal that helps the project at the same time. Seems like developing pfSense on these Rxxx series has really paid off in terms of performance.

Been messing around with this a bit, from claims like "PowerEdge R300 has up to 26%better performance than the ProLiant DL320 G5p " even in Dells own literature was worth investigating. http://www.dell.com/downloads/global/products/pedge/en/pe_t300_r300_march2008_v5.pdf From the looks of it, having now installed the pfSence on both, the Dell is far superior. Main things i am seeing is 12% CPU use under the same load the HP took almost 70% CPU use. (Saturated 250 down/25 up at the same time, 300+ connections). Also even though the r300 is running from a USB stick vs the HP's SATA drive, the WEB ui is literally instant compared to the few seconds of load time for page changes with the HP. (I expected the Opposite running from USB) Don't know why but its running a lot better on the r300, cant see a X3353 CPU being this much stronger than a X3210… dunno whats causing the performance gap. Really amazing performance with this unit. if the R200 in the pfSense store run anything like this they are an awesome deal.

Yep, looks like OpenWRT doesn't have specific support for that either.  :( They do have general Cavium Octeon support though so if you fancied a project you might be able to get it running. http://downloads.openwrt.org/snapshots/trunk/octeon/ Steve

@Mark01ta: I'm wondering if a higher power solution will translate into higher throughput through the vpn though. Probably not. You could attempt to run an encryption that has greater data compression to squeeze more down your connection. That would require more cpu cycles but it would have to be supported by the other end. Steve

Short novel emailed your way.  :)  If you didn't get it, let me know. But yeah we can definitely pick up on all that from there on support. Thanks!

You could use something like this: http://www.spectra.de/produkte/130224/web/Handbuch-MEC-ETH-101_V1.pdf which uses the Intel 82583V which seems to work well with FreeBSD.

We'll need a lot information than that! What wireless hardware? What have you tried? What didn't work? Steve

They are. I tried it, it works.  :) http://forum.pfsense.org/index.php/topic,20095.msg383842.html#msg383842 Steve

@foonus: Seems to be some problem with the watchdog going off for the card now -.-  the following lines keep coming up again and again, any ideas? Strange its a 4 port NIC atm igb0 is WAN and ibg1 is LAN.. curious its not doing this for both of them… Tracked this down to an issue with importing a config from a RC build to the final release, specifically the Limiter I had set up.

The HP 364T works fine I have the same set up and card payed a little bit extra over the 2port NC360 card, since pfsense does not support my realtek lan and realtek lans are pretty terrible anyhow I opted for the 364T. I am using 2 ports from the NC364T, but yeah it is a tad overkill you only need a dual card at best and a cheap switch. Only nice thing about a 4 port nic is if one got fancy with it you could use different ports to do different task….

Just curious if anyone got pfsense 2.1 working well on these units.  I just got a batch of 5 for free and was thinking of setting some up as firewalls.

I'll just answer to myself: after 5h the problem came back, so i disabled hardware checksum offloading and the system have been stable for 20h, wich is promising, i'll just wait and see.