pfSense newbie: can it run in a VM and handle a 10Gb/s ISP line?

stephenw10

Nice. I assume you need the multiqueue blacklist tweak for vmxnet NICs to reach that?

Cr4z33

Woah lots of questions here, but my bad I had actually to say what hardware I was using and it's nothing special so I guess myself it won't nearly match the needed specs right...?

INTEL Core i3-4130
2x8GB DDR4 RAM
INTEL X540-T2 NIC card

WLAN: yes I meant Wi-Fi, but all I want is to secure manage the wireless IP cameras and Synology Surveillance Station traffic.

Seeing your posts about beefy hardware needed I wonder if a Netgate 6100 would be actually able to carry all the load needed here?

Cool_Corona

@stephenw10 I dont use passthrough nics...

stephenw10

@Cool_Corona
Right but if you use vmxnet NICs to the VM you need to disable the blacklist to get pfSense to use multiple queues on them. Which I would expect to be required to pass 10Gbps.

@Cr4z33
No I would not expect an i3-4130 to pass that as a hypervisor. Though it may get close I've never tried ESXi on something like that.

And no I would not expect to see 10Gbps through a 6100 if it's NATing and filtering the traffic. Especially if that's a single stream TCP test.

Steve

Cool_Corona

@cr4z33 You will not reach 10gbit/s on the hardware.

You need Xeon CPU's.

We run this in our testrigs to compare opnsense to pfsense

https://www.supermicro.com/en/products/system/iot/1u/sys-510d-10c-fn6p

Cool_Corona

@stephenw10 On current ESXi its not needed and on the older ones it hardly made a difference.

Cr4z33

@cool_corona cheers mate gonna see if I can find a deal on eBay then for some used unit.

Cool_Corona

@cr4z33 https://www.serverworlds.com/refurbished-lenovo-x3550-m5-sff-configured-to-order-8869-ac1/

provels

FWIW, even my ancient 2012R2 Hyper-V VM on a 14 year old host shows the logical interface as 10G, but I think you would need a very high power host to come near the packet processing power needed. Free standing host would be better. Then again, I can't even imagine needing 10G unless I had thousands of users anyway. But I'm a dinosaur.

Cool_Corona

@provels You need new nics and xeon's to reach it... and not running it in a Hyper-V environment.

stephenw10

@cool_corona said in pfSense newbie: can it run in a VM and handle a 10Gb/s ISP line?:

on the older ones it hardly made a difference.

Hmm, that's very much not been my experience when working with customers virtual installs. Setting that value usually dramatically increased throughput or reduced per core CPU loading. Though that won't be the case in FreeBSD main builds.

Steve

provels

@cool_corona said in pfSense newbie: can it run in a VM and handle a 10Gb/s ISP line?:

@provels You need new nics and xeon's to reach it... and not running it in a Hyper-V environment.

Would be less than worthless on my 75Mb WAN, my GB LAN and 54Mb WLAN...

Cool_Corona

@provels Yeah...

Cr4z33

This post is deleted!

Cr4z33

@cool_corona said in pfSense newbie: can it run in a VM and handle a 10Gb/s ISP line?:

@cr4z33 https://www.serverworlds.com/refurbished-lenovo-x3550-m5-sff-configured-to-order-8869-ac1/

Thanks mate, but living in the EU that would cost me too much hehe.

I have however found a refurbished Supermicro CSE815 - X10SLH-LN6TF / N6-ST031 for quite a very interesting price.

Would that finally be good for my needs?
Might also be a good purchase to start learning networking in a more serious way for me.

Cool_Corona

@cr4z33 said in pfSense newbie: can it run in a VM and handle a 10Gb/s ISP line?:

CSE815 - X10SLH-LN6TF

No that CPU cant handle it...

Cr4z33

@cool_corona alright may I ask you then what Xeon CPUs suite my needs so that I can monitor the eBay bargains?

Cool_Corona

@cr4z33 Core count is not that important but CPU speed is.

https://www.intel.com/content/www/us/en/products/details/processors/xeon/d/products.html

Look after something on this list if you can...

Cr4z33

@cool_corona thank you for all your help.

LJGriz

I'd like to add that adding the following lines to /boot/loader.conf to my pfSense CE 2.6.0 VM hosted under ESXi 6.7 has been stable for the past few days, and increased my speeds from ~1.8gbps up/down to ~6gbps up/down. Keep in mind that these speeds have been validated on the following hardware:

VM Host: Intel Xeon-D 2146NT w/64GB RAM, dual Intel X722 network adapters
VM Guest: pfSense 2.6.0 CE w/8 vCPUs, 16GB RAM.
-No PCIe-passthru, straight up standard vSwitches.

Workstation behind pfSense: AMD Ryzen 3700x, 64GB ram, dual X520 network adapters.

No switches between, single mode fiber between both the workstation and the VM host.

Mind you speeds could most likely improve, but the trunk line out of town during the time of testing is 10gbps, but saturated with close to 4gbps, thus the nearly 6gbps results.

/boot/loader.conf
hw.pci.honor_msi_blacklist="0"
dev.vmx.0.iflib.override_ntxds="0,4096"
dev.vmx.0.iflib.override_nrxds="0,2048,0"
dev.vmx.1.iflib.override_ntxds="0,4096"
dev.vmx.1.iflib.override_nrxds="0,2048,0"