@TomT:

Thanks.  Can you advise which box will be better for our needs ?

The SG-2220 would be better or another option is the i3 version of the Qotom mini pc.  Check out the hardware section on the forum.

You won't be able to use the crypto accelerator until pfSense 2.5 comes out.  Right now, The SG-1000 can do about 10Mbps over VPN, give or take depending on cipher and what other services you have running on the box.

Any good ideas ?  Small PC boxes I could buy? and combine 3 network cards ?

It all depends on the Internet connection speed and what and how many packets you have installed on that box!

It could be that a smaller variant likes the SG-2440 would do the job also fine, and with more luck a smaller one
will do the job too but without installing any packets then on that device. (pure firewall, DHCP, 3 VLANs,….)

SG-1000 - up to ~100 MBit/s Internet speed and low VPN & firewall only
SG-2220 - up to ~500 MBit/s, Internet speed IPsec & OpenVPNVPN, IDS/IPS
SG-2440 - up to ~900 MBit/s Internet speed, VPN, Squid & SquidGuard, pfBlockerNG, IDS/IPS

Or a total different way with the R1 from netgate.com

pfSense supports two IDS / IPS packages, Snort and Suricata. These filter network traffic for any malicious activities and available from the pfSense package repository. You can enable also ClamAV with Squid package, however Snort is much more effective.

It is to prevent scratches to that surface during assembly, packing, and shipping.

ADI images are available at https://www.pfsense.org/download/

After your support contract and warranty expires, you lose access to portal.pfsense.org however you can always download the images from our website. Simply select Netgate ADI under architecture.

@vilyallc:

Getting an access denied message after I login with the same account that I bought the device with.  Frustrating but I guess I will need to get with NetGate support to find out why my account is messed up.

Thanks for the help

Yes, please contact our support and they will resolve it ASAP!

@tim.mcmanus:

I want to download and archive the SG-2440 disk image because I've deployed two of these devices so far.

I was following the instructions on this link:  https://www.netgate.com/docs/sg-2440/reinstall-pfsense.html

The first instructions says to "retrieve the appropriate installer image after logging in on the Portal account page under Active Resources…"  I have a Gold Subscription and am using one of the two devices in my office, but I do not have anything listed until the Active Resources section other than my Gold Subscription.

Is there anything I need to do to get access to that resource?

I bought one of these devices 12/15/16, and had a client purchase theirs last week.

Any guidance is greatly appreciated.

Log in to portal.pfsense.org and then open the following link to activate support for your appliance https://portal.pfsense.org/members/signup/per-incident-support

After that the SG-2440 will be automatically be added to your account with the Gold subscription.

Sorry, no AES-256-CBC numbers.

Follow this guide to connect to the console https://www.netgate.com/docs/sg-4860/connect-to-console.html

If you restored the backup from another pfSense router, you likely don't have console selected as a default output (or perhaps at a different baud rate).

Thank you both for the replies, very helpful.

@n3mmr:

I'm looking for official numbers for total routing capacity for various HW environments, and how this depends on various settings in ofSendmse.

I'm a total newbie, so please be patient.

We're a condominium in Stockholm, of 348 users. We share a single delivery of network capacity, currently of 2Gbps, soon to go up to 10Gbps.

We'd like to be able to trust that entire cap to be shared in a fair manner, and having that entire capacity available at all times.
I e if 20 tenants start a download at the same time, the aggregated speeds should add up to fairly near 2Gbps.
So, are there any official numbers for total routing cap?

As johnkeates points out, those are the specifications we currently offer. We don't offer more detailed stats on our website because we feel it would not be correct. If you are interested in purchasing our device, our sales and support will ask for more information about the environment in which you intend to deploy our device, your requirements and make a recommendation based on that.

Our own Jim Thompson has worked on Network Performance Analysis for FreeBSD along with George Neville-Neil, explaining how benchmarks are hard (unless you're a marketing department). I suggest you check it out https://youtu.be/LE4wMsP7zeA

@mhab12:

Looks like 500/500 should be easy for the 4860…just ran this on mine.

Client connecting to iperf.he.net, TCP port 5001 TCP window size: 65.0 KByte (default) ------------------------------------------------------------ [  3] local xxx port 35498 connected with 216.218.227.10 port 5001 [ ID] Interval      Transfer    Bandwidth [  3]  0.0-10.0 sec  869 MBytes  729 Mbits/sec

Should be a more. Up to a gigabit.

Through the web interface I did update the box to the latest(before getting the numbers in my first post).

Never used traffic shapers or limiters on it.

Network interfaces showed 1000 full duplex

No Ierrs or Oerrs

I brought the box into work and did some testing.

Speedtest.net shows 120 mbps

speedof.me shows 10 mbps

testmy.net shows 10 mbps

I also tried one of the other SG-1000s we bought for work with the same results for speeds.  My laptop directly behind the work firewall i am able to try the SG-1000s behind i get: speedtest 793, speedof 273, testmy 184

When I put a public IP on it i got 16 mbps for speedof

Yes, when ordering specify what type of plug you need. You can also order the SG-1000 from one of our partners, if you live in EU.

@deadmalc:

Are you using pppoe? I get that issue when the IP changes

No, i'm not.

200Mbps is optimistic IMO.  The most I've seen is between 100-150.  OpenVPN seems to do between 10-12Mbps, but that's without support for the crypto accelerator at the moment so will probably do better when 2.5 finally comes out.

@kpa:

It's an ARM system and FreeBSD on ARM is still much more of "work in progress" than on the more established platforms. There are going to be teething problems like this until the kinks get sorted out by FreeBSD devs and the manufacturers of these devices.

"ufs dir bad" suggests that the unit could be fixed by booting into single user mode (usually by selecting single user boot from the FreeBSD boot menu) and running 'fsck -y /dev/<rootfilesystem>' on the root filesystem.

If it's the boot code spitting out the error and the boot never makes it to the /boot/loader menu then the only solution would be then somehow mount the eMMC card on another pfSense/FreeBSD system run the fsck there.</rootfilesystem>

It's a FreeBSD file system issue, happens across all platforms. FreeBSD on ARM is established, there's always room for improvement. If someone has power issues they should put UPS in place.

Thanks for the thoughts. I'm gonna work to get traffic shaping setup for my needs. I have something basic rolling now that brings the performance back to something more sane while the backup is rolling. I have Ooma (third party VOIP) some gaming systems, host some personal websites, have this epic backup going, and of course want the internet to be usable for surfing and watching stuff online. I just gotta do it anyway.

For now at least, I'm calling this issue closed. I am 99% confident my pfSense performance issues were due to that forgotten backup job without using traffic shaping and I was comparing to my old firewall that had traffic shaping all configured on it. Why it knocked me down so much is a bit of a mystery. I'm assuming the uncontrolled backup traffic was causing contention on the way the speedtest.net site works.

@kapara:

Just purchased one.  If we were to want to run the licensed version of pfsense is that possible?  Pay a fee of some kind?

You mean pfSense factory? Factory isn't "licensed". There are no major differences between factory and community edition, just a way to point out an official pfSense system from DIY one.