Thank you so much for your info. Nice on the xeon  ;D it should be a killer firewall with the specs you suggested  :P

Like this? Yes, exactly, all custom tunings should be entered by you inside of this file, to survive the next update or upgrade because then all files will be new written or over written. Delay command seems unnecessary. Cold be insertedby default or pending on other hardware, that must be recognized by the OS at boot time, so if you have some USB gear connected to the entire pfSense box and it will be not really recognized and enabled, this could be a really gain to give pfSense enough time to locate and found them to load the right driver for it. Odd as that was already in the file when I loaded it.  Must be a default. Yes again.

They used to make PCI cards but Ive not seen any in years. Not a good idea anyhow.  A good power bump over the coax and your router would be toast. Besides- the lights on the modem can be pretty important to see if your troubleshooting.

Supermicro SATA-DOM? Also a good choice this could be seen as a replacement for the older IDE-DOMs. But there are two different models able to buy and use, so you might before buying have a closer look to your mainboard and the needs of what kind of SATA-DOM you should go with or buy. Supermicro SATA-DOM solutions

What a day guys…..my system died and I have to install all over from version 2.1.5 to make the 2 main NIC to work (LAN and WAN). At the mainboard of the Jetway NF9D-2550, there´s 2 x NIC Realtek 8168/8111 (WAN and LAN) that pFsense version 2.2.6 will have driver issues with these 2. Connecting a screen at the VGA port, I will get a lot of "phy write failed", related with the drive issue. The 3 x Daughterboard Realtek RTL8110SC (8169/8169S/8169SB(L)) NIC´s are working perfectly, the issue is with the onboar NICs. I´m not happy going all the way to version 2.1.5 but I´m online after 3 hour of work trying to locate the source of the problem. Any idea of after the upgrade, the since with start to outperform?...will this issue be corrected in further updates? Thanks. Mike.

I resolved my problem by ordering a new nic thanks for you help

Thank you, that was one area in which I didn't think of using.  The reason as to why, is that the tunable, kern.ipc.nmbclusters=131072, did not work when configured this way.  At first tunable hw.igb.fc_setting=0 didn't work, but I am persistent and there are a few possible configurations.  So, I used dev.igb.0.fc=0 and dev.igb.1.fc=0 as tunables and finally flow control was disabled on WAN and LAN.  I also configured hw.igb.header_split: 1 but that didn't work as a tunable.  However, flow control is finally disabled, and that was my goal. Thank you

It's not that expensive But easy to use, easy to configure and really powerful. @csswormy As a home user it is also not really wise to use a LAG, pending on the configuration, because the first link must be fully rendered or saturated until the next one will be in use. So a home network often is not able to produce so much traffic.

It will be mostly only a workaround solution and if this device is driver based and you get no driver for FreeBSD or pfSense it will be only a fine dust collector with no kind of sin.

The latest ix driver from Intel was imported to 2.3 this week. None of the Intel 10G cards we sell or have available show any of the issues described in this thread, so not sure whether or not that fixes it, but it's definitely worth trying.

@thejtshow thank you. Yes I will take that criticism at this point. In normal we all awaiting constructive criticism, and we are all not really pleased about, if we are only hearing some monotheistic repeating refrains like "don´t do that and don´t use this" for sure I will consider to that point. But on the other way I must also really consider to the standpoint of all other peoples, that "bridging ports" is only a use case for very experienced network admins that knows to 100% when and where bridging must be done or is needed. So in shorter words for all others of us, routing should the right way to be gone. As a golden rules for networking, you cold remind of this: Route if you can and bridge only if you must. btw. I heard the Donald looked like an idiot last night, no clue what to do with health care or whatever. Maybe he REALLY is clueless when it comes to real  politics? Our Donald was tumbling down in earlier years to the deepest bottom, and rising again from their to the highest top now, it is a hard way and really steep journey! So I really think he is a good guy and means it in the right direction for his country, but sometimes also that he is not able to transport it to the masses as he is meaning it really.

Thanks very much cmb. I do have a limiter configured. I'll disable it and report back.

Another idea would be to get a RaspberryPI with a big button beside it. Write a small script on the PI to remotely shutdown your pfSense through network (pfSense would also need a small server script for that). Teach your boss to hit the big button first before he leaves, and wait until the LEDs on the appliance go down. And cut power afterwards. Oh - and keep a couple of PIs for spare in the drawer  ::)

divsys, Thanks. There is indeed only one client with "brain dead" applications that can't handle a change in IP address. I've moved it to a static lease. jahonix, Thanks for pointing that out. I will indeed use the amd64 embedded image. MV

Well the 970 is very very fast and will use less power encoding too..:)

@Diler: https://forum.pfsense.org/index.php?topic=88595.0 As I see it is not supported :-( Yes it sin´t supported because of the ARM-A9 CPU, there is no ARM fork of pfSense until now. But, if you interested in, you could go with a SG-2220 from the pfSense Store. Or with the Minnowboard Turbot what is nearly the same as the Hummingboard.

My main reason for this question is because most of the time when you sell a firewall to a customer there is an expectation of warranty and support for the unit.  PfSense does not offer this with their product from what I have seen so I only purchased one from them.  When the price for the customer and myself is the same I become hesitant to sell a solution in which I end up carrying the burden of being responsible for replacing it. The onsite warrant eleviates that concern. For me to source parts would be about a week as no one has this stuff locally where I am. I am an MSP and looking at selling this as part of a bundled service to customers.  I think with the time required to source parts, wait for delivery, build time I am better off just buying the units with warranty.  I can always give the option of lower warranty period as they offer 1,2,3 year options. Curious what others charge either annually or monthly to maintain, support and replace pfSense firewalls. And with regards to supporting the software I think I could just buy a 5 pack of incidents as a backup and spread those across all the firewalls in the event I need them.  It did not look like their support incidents were device specific.

I am very interested in the SG-2220, as it is a certified piece of hardware with a solid looking set of specs. Pending on your art of usage and the not available extra packets, it would be really nice for you. As far as I understand, if I buy the unit with an mSATA SSD installed pfSense will be installed onto it, but if I buy the unit without the SSD, pfSense will be installed on the on-board flash.  Is this correct? Yes this might be correct, but I in your situation would more send a email address with a pre-sales question to the pfSense -store itself. If I were to buy the unit without the SSD, can I insall an SSD in the future without voiding the warranty? How would I move the installation over? You might be installing it on the eMMC storage or a mSATA, this did not avoid the warranty as I see it right but again those questions should be asked not in a forum but more send directly to the pfSense store via mail. Any help/direction that anyone could provide would be appreciated. Get this device without a mSATA and use the eMMC storage and if you decide yourself later then to get a mSATA you only have to change the boot order in the BIOS thats it, and perhaps on top copying the config backup over to the new installation, not more and not less. A custom ADI image, matching to your SG-2220 unit, will be available to download after the registration of your SG-2220 unit. My internet connection, if it matters is 76 down/19 up, but I am getting nowhere near that right now because the way my network is set up. The SG-2220 will be handle it with ease.

Please check http://www.3g-modem-wiki.com/page/ZTE+AT-commands