Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Intel hardware for pfsense

    Scheduled Pinned Locked Moved Hardware
    20 Posts 6 Posters 8.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      youngadmin
      last edited by

      I see. If in the future, I wanted to use pfsense to route between subnets, at gigabit speed, what should I get, assuming cost is not an option?

      On the VLAN note, I'm wondering how secure pfsense's Inter-VLAN routing mechanism is, especially in a one armed router scenario. I'm reading some whitepapers on this as a type.

      thanks.

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        For gigabit wire speed, you're going to need server class hardware, or something with PCI-e NIC's. You can't firewall gigabit at true wire speed with a 32 bit PCI bus - the bus isn't fast enough. Any new server class machine with dual onboard gig NIC's should be more than adequate for 1 Gb wire speed.

        The router on a stick scenario (as Cisco calls it, and I tend to stick with Cisco's nomenclature) is as secure as your firewall rules and your switch configuration. Never use the default VLAN, and adhere to any security recommendations your switch vendor outlines in their documentation. And of course with your firewall ruleset, be as restrictive as possible.

        1 Reply Last reply Reply Quote 0
        • Y
          youngadmin
          last edited by

          Thanks cmb. i forgot to mention that I'll be running Snort and doing traffic shaping as well. Some of those packages, like ntop, pfstat and iperf look real nice too…

          1 Reply Last reply Reply Quote 0
          • S
            Snailer
            last edited by

            Just out of curiosity: If a NIC is inserted, with a duel connector, like to Intel server nic the topicstarter suggested. Will he see two interfaces at the PfSense-GUI he needs to configure? –> How does this work in practice?  ???
            (Give that guy of the Firefox spelling checker a huge icecream, I sure do need it!)

            1 Reply Last reply Reply Quote 0
            • dotdashD
              dotdash
              last edited by

              Shows up as two interfaces. Just like two separate cards.

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                Yeah, to the OS, a two port card looks no different than two individual NIC's. A four port card looks no diff than four individual NIC's. etc.

                If you want to run Snort, that's one of the (ahem) piggier packages resource-wise, you'll want 512 MB RAM minimum.

                1 Reply Last reply Reply Quote 0
                • Y
                  youngadmin
                  last edited by

                  That's no prob, I wanna equip it with 2 GB.

                  1 Reply Last reply Reply Quote 0
                  • Y
                    youngadmin
                    last edited by

                    I've done a bit more planning, and now realize that I may want to use pfsense to route and filter between 4 subnets….@ gigabit speed...or faster (using LACP)....while running Snort....and terminating an IPsec tunnel...and doing traffic shaping (esp for SIP)...while load balancing 2 or 3 WANs...and CARP. What will it take?

                    1 Reply Last reply Reply Quote 0
                    • J
                      Justinw
                      last edited by

                      Load balancing essentially breaks several of the useful packages/services, particularly traffic shaping, just an FYI

                      1 Reply Last reply Reply Quote 0
                      • C
                        cmb
                        last edited by

                        @youngadmin:

                        I've done a bit more planning, and now realize that I may want to use pfsense to route and filter between 4 subnets….@ gigabit speed...or faster (using LACP)....while running Snort....and terminating an IPsec tunnel...and doing traffic shaping (esp for SIP)...while load balancing 2 or 3 WANs...and CARP. What will it take?

                        This is more than I'd suggest running on any single box.

                        I'd split it out into two machines (or two CARP clusters). One for routing and filtering between internal subnets for gigabit. You'll have to run Snort on a different machine most likely, you're not going to be able to route gigabit speeds and have Snort analyze at the same speeds on any hardware. Routing 4+ Gbps is going to require a new server class machine.

                        Second, I'd put up another machine or CARP cluster at your perimeter, which could do Snort, load balancing, etc. Not sure how the shaper would work in a multi WAN environment, but I'm guessing not real well.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.