Thanks for the reply.

Good point you make there, hadn't thought about that.  It's starting to look like it will take a lot of effort to get this ole Thinkpad up to speed, and I might be better off just starting with new hardware.

While USB 1.1 may have a theoretical bandwidth of 12 Mb/s, that includes all the communications overheads.  In reality you'll rarely get more than 8 Mb/s through USB 1.1.  Importantly that's the total bandwidth, whereas your 7 Mb/s service is simply specifying the download portion.  How close you get to that 8 Mb/s depends on a long list of things, including:

Quality of the USB device Quality of the USB chipset's support for USB 1.1 Quality of the USB drivers

At this point in time USB support in FreeBSD is still relatively young and immature - it's getting better but if you're using chipsets that the developers haven't, or a device that they haven't, then you'll have more problems.

I have had good service from a TP-LINK TL-WN651G, a PCI card using the Atheros WiFi chipset. The Atheros chipset is well regarded in the FreeBSD/pfSense community.

A possible problem with getting a WiFi card from some card manufacturers is that they reuse the same model name for cards with different chipsets. This is generally not an issue when the card supplier also supplies the drivers, but with FreeBSD/pfSense you are generally stuck with the included drivers because there aren't many suppliers who provide their own drivers.

Also, as best I can tell, there isn't any support for "wireless N" cards in FreeBSD so steer clear of them.

@ktims:

You really can't make this claim without knowing the traffic profile. I'd be surprised if your proposed box could even route/firewall 100mbps of small packets across a large number of short-lived TCP sessions. pps is far more relevant than mbps, and you'll need pretty serious hardware to get to 1Gbps of 64-byte packets in pfSense. Not that that's a typical traffic profile, but making blanket claims like this is dangerous.

ktims and kc8apf pretty much spot on; it's PPS not Mbps. That FreeBSD has always been the PPS king doesn't hurt. It does not take a great deal of hardware to break 1M PPS - a single Xeon X5420 (2.5GHz Quad Core) is easily sufficient for >1M PPS at 64-byte size on 7.2, with mild tuning, on a broken driver.

Snort can use a lot of memory - yep. But 64-bit is not necessary with PAE. Yes, it will require a custom pfSense build; PAE is not enabled in GENERIC. PAE also has very strict driver restrictions, not all drivers work with >4GB. But for large memory requirements, it's the least disruptive option.

So the OP needs to answer two questions before we could make reasonable recommendations. First, we need to know the average and peak PPS rates. Second, we need to know how many connections per second snort needs to deal with. Those are the two primary consumers of CPU. Past that, it's just going to be tuning and a custom pfSense build with PAE enabled. Honestly, 64GB is likely overkill, but 4GB is also not going to be enough.

@sofakng:

I've purchased an ALIX 2D3 and it seems great but I'm having a little buyers remorse because I think of how much more powerful of a machine I could have gotten for much less.  The tradeoff, however, is energy efficiency.

There are several Intel Atom computers that I could get for cheaper (and are 5x as powerful) but I've been told they use about 70 watts under load where-as the ALIX only uses 5 watts.

Also, almost every Atom board I see uses Realtek NICs which I've been told are garbage.

Anyways, does something like the following exist:  (?)

1 GHz or faster 512 MB RAM 2x good NICs (I don't need GigE on the router) 20 watt load/average

Am I asking for too much?

Really the ALIX will do fine for my small home environment (I don't need snort or vpn) but I'm thinking about the future and if I ever get FIOS, etc.

MSI IM-945GSE
Has an Atom N270 paired with the 945GSE chipset (mobile version of the 945GC used in other Atom boards) which uses significantly less power.
Has 2 onboard Intel PCI-express Gigabit NICs.
Add the ram as per your requirements, it uses DDR2 sodimm.

I doubt it uses 20W total but it certainly uses less than 50W with a 2.5" harddrive.

@jimp:

I can't say I'm the first one to do that, I got the idea from cmb, but I may just be one of the first to post pictures :)

Hehe, well I guess we're "standing on the shoulders of giants" then.

can you install with packages though?  i am in a similar boat to the OP :(

Intel is the most recommend brand. Support is good and stable and performance is best in class. Some other NICs work well also, but really there's not much reason to get anything other than Intel.

What part do you have and what's its PCI id (pciconf -lv at the console, copy the info from the device that hasn't been claimed by a driver).

Should have no problem stomping the WRT54G into the ground in pretty much every metric. The CPU is considerably faster and I think the additional RAM makes a huge difference as well.

Plus you get to run pfSense instead of dd-wrt, and it's obviously a lot more capable.

@raskas:

Hi All,

I've bought an Atheros miniPCI card for my soekris to be able to configure my pfSense as a wireless access point.

Everything is installed and configured but the maximum speed I get through that wireless is around 700K. The speed using an external access point connected to the LAN interface gives me 1.3M.

I've read somewhere that this is a problem with the atheros driver. Is this correct and when will this be fixed?

Greetings Johan

ath0: <atheros 5212="">mem 0xa0010000-0xa001ffff irq 11 at device 14.0 on pci0
ath0: [ITHREAD]
ath0: WARNING: using obsoleted if_watchdog interface
ath0: Ethernet address: 00:0b:6b:d9:d3:e3
ath0: mac 5.9 phy 4.3 radio 3.6</atheros>

Presumably, your WLAN and LAN interface are bridged.
Can you try doing a file transfer between a computer on the LAN interface and the WLAN interface to verify that it is indeed a problem with the Atheros driver/ card?

What version of pfSense are you using? You said "latest stable version" so I presume that's 1.2.2.

My home system system has a USB ethernet adapter on the WAN link. Under pfSense 1.2.2 it locked up a few times. I've been running a 1.2.3 snapshot build since mid June and haven't seen a repeat of that problem, though due to power fails I haven't had an uptime of more than 40+ days. I suggest you try one of the recent snapshot builds of 1.2.3 which can be downloaded from http://snapshots.pfsense.org/FreeBSD_RELENG_7_2/pfSense_RELENG_1_2/?C=M;O=D

Do you have a source for Lanner stuff?

@dotdash:

What's the BIOS on the Alix? Are any settings non-default?

From the console output:

Geode LX: PC Engines ALIX.2 v0.99h tinyBIOS V1.4a (C)1997-2007

I haven't changed any settings.

We've installed and configured !  Final HW config;

Intel Celeron E1500 2.2GHz LGA 775 65W Dual-Core ->http://www.newegg.com/Product/Product.aspx?Item=N82E16819116075

SUPERMICRO MBD-PDSBM-LN2+-O LGA 775 Intel 946GZ Micro ATX Intel Xeon 3000/Core2 Duo/Pentium D/Pentium 4/Celeron D Server Motherboard ->http://www.newegg.com/Product/Product.aspx?Item=N82E16813182126

Kingston 2GB 240-Pin DDR2 SDRAM DDR2 667 (PC2 5300) Desktop Memory Model KVR667D2N5/2G ->http://www.newegg.com/Product/Product.aspx?Item=N82E16820134192

Intel PWLA8492MT 10/ 100/ 1000Mbps PCI PRO/1000 MT Dual Port Server Adapter ->http://www.newegg.com/Product/Product.aspx?Item=N82E16833106209

How is your network setup? Are you using NAT on pfSense?

thx man

No, it's not in pfSense.  If you want it to be silent, look at embedded/nano builds on solid state (eg compact flash) storage.

Thanks,

I'll give the full install a go.  I've been using IPCop for nearly 6 years without a hitch, but I really want something that will handle a IP blocklist, which is supposedly going to be included with pfsense soon I hope.  It also sounds like pfsense is much more flexible and powerful too.  So it will hopefully be a worthwhile upgrade. :)