@Cojo:

I'm currently running my pfsense on a via mini-itx board with dual nics.
I only have one pci slot available so my question is if just one INTEL PRO 1000 GT will increase my thoughput?
As it is now I have only a throughput around 60mbit on my 100mbit connection.

It will to some extent, but not as much as replacing all the NICs. The Intel cards do more on the card and require less of the CPU. Since it sounds like you're maxing out the CPU, replacing one of the NICs will lower your CPU usage (or allow you to push more traffic before pegging the CPU). But not nearly as much as replacing both would.

I'm not sure exactly how much benefit this will provide since you can't replace both NICs, but it should have some measurable benefit. If you try it, let us know how much more you can get through the box after doing so.

@sentofuno:

SOHO users regard the alix/wrap boards, and admins of larger networks find them lacking

Depends on how you define "larger networks".  :)  If you're doing NAT, firewalling, a little VPN, and don't consistently need more than 75 Mb of Internet throughput or 10 Mb of VPN throughput, and have fewer than 500 machines you'll be fine with an ALIX.

Just the reply I was hoping for!  ;D

There's a ubsec(4) in the Nokia IP130 (and maybe in all IP1x0) that is seen by the kernel.

Is there anything special to be done in order to use it (in a VPN) ?

Forgot about this thread.  I put in four Intel cards from ebay and haven't seen a problem since!

Thanks for all of your help!

Another NIC problem disappears with a switch to Intel or Broadcom.

re is a Realtek NIC. These are reasonably well supported in FreeBSD, in that there is one developer actively developing and supporting that driver, but they are known to be problematic (as you'll discover if you hang out on freebsd-current or some of the other FreeBSD mailing lists). The driver keeps being refined, but I would recommend steering clear, particularly for a 'high stress' application such as a firewall. Intel or Broadcom are better choices.

I'm running full install on Alix using the virtual box install method. Works!

I am running that image in production on a Dell PowerEdge R200; it is 1.2-RELEASE running on FreeBSD 6.3-RELEASE-p1. I can't use the 'true' 1.2-RELEASE because FreeBSD 6.2-RELEASE has no support for the ICH9 SATA controller in the R200, just as you can't use the 'true' 1.2-RELEASE because FreeBSD 6.2-RELEASE doesn't support Dell SAS 6/iR.

You don't have a PERC 6/i in the machine - at least not from the line you posted. That's the hard drive configuration - which simply says "RAID 1 on the controller in the controller slot, whether it is a SAS 6/iR or PERC 6/i". I still believe you've got a SAS 6/iR in your machine. If your disk partitions are showing up as mpt… rather than mfid..., it's certain that you have a SAS 6/iR.

Anyway - I'm glad you've got it working - pfSense is great, particularly on good hardware like the PowerEdge machines that you and I are using.

I'm pretty sure this is a dc NIC - are the interfaces dc0 to dc3?

The NICs that are most often recommended are Intel gigabit, especially the server types (em; in FreeBSD HEAD some of the very latest cards are supported by a new driver - I can't remember what that is). Other decent NICs are Broadcom gigabit (bge and bce), Intel fast (fxp) and 3Com 3C905 (xl). The Dell PowerEdge R200 I'm using for pfSense has a couple of bge NICs built in; with VLANs I only really need one anyway.

dc are fairly old and relatively cheaply designed NICs. There's also a lot of slightly different cards using this driver - which may not be awarey of the quirks in your particular card. The driver hasn't received a lot of attention recently - unless I'm misreading the FreeBSD CVSweb, the last change in the FreeBSD 6 branch for this driver was in October 2005. Your results seem to indicate that it just isn't up to the load put on it in a FreeBSD based firewall. It may well be the driver's fault, but the chances of anyone fixing it are slim.

One reason that the Intel gigabit drivers are good is that they're maintained by someone who works for Intel. A four port Intel gigabit card would be expensive, especially as such a card would have to be a server card. What about a cheap single port Intel gigabit card (desktop grade if finance is an issue) and a cheap VLAN capable switch (off eBay, perhaps)? That said, 24 port 10/100 plus 2 port gigabit Level 2 managed switches can be had very cheaply new these days - some units are fanless.

His pricing is very expensive if buying from the US.  If you are planning on buying multiple items, you would be better off buying direct.  You could get qty 40 direct for the price you would be paying for qty 20 from him.

My guess is the old ReefEdge EC25's (EC, not SP) they were SnapGear 2540's/2541's which I was unable to get into the bios, after some time I just flashed it with the SnapGear firmware. The source code for the firmware is available on the website but it runs a modified minimalist linux 2.4 kernel. The hardware configuration of the devices was always interesting due to the built-in IPSec hardware accellerator, power consumption, and size but I couldn't get the 25's to worth with pfsense. On a side note, the larger EC125 works very well for pfsense….quad nics + vpn accelerator card + celeron 1.2ghz ;)

Thanks very much for all your feedback, its very much appreciated.

I've decieded to go with 2 x intel pro 100+ for my wans and 1 x intel pro gt 1000 for my lan :D

I'll at some point upgrade the desktop as David suggested to server, as things expand.

Cheers

Whoops, my bad :-(  They are indeed 3c905s - I obviously spent too many years being burnt with 3c509s!

Cheers, Liam

Thanks for the info guys. I appreciate it. ;D

Good suggestion. Thanks.

Thanks for the help. I got the image to work by renaming it to ISO instead of extracting it. Boots fine, but unfortunately it still doesn't detect the Intel Pro/1000 GT quad card. It is still only detecting the 4 Intel GB NICs on the motherboard. I can use it like that for now, as 4 ports are all I really need, but it would be nice to get the extra 4 ports working for expansion. I really don't plan on needing to touch this pfSense box for at least a year once it's running based off previous experiences with pfSense. If anyone has some more ideas, I'd love to hear them, otherwise I'll find another use for the quad gig card.

It's possible from serial console. soekris and pcengines boards can be flashed that way as well so why should it be impossible for that device. For alix you can use a cfcard with freedos but there is an other option as well where you break into the biossettings at bootup and transfer the biosimage via the serial console (zmodem file transfer iirc).

Whatever happened to the developers package?

Found it:

http://pam2007.info.ucl.ac.be/slides/pam2007slides_schneider.pdf

Slide 19 is the one that mentions that 64 bit drops more packets.

Mind you, the paper also suggests that the problem doesn't become apparent (on their hardware) until over 600 Mb/s.  Probably not an issue for the majority of people ;)