Considering trying out pfsense

Rango

Bluekobolt u rock man. So i see the APU engines only support nano image. Does that mean that certain packages like snort or other downloadable packages may not be available for Nano pfsesne ? Is there limitations in nano vs full or is this only during install. I see nano is only 177mb tiny comparing to 1.0G full version. Just trying to see if this is not stripped version of pfsense and packages may not be available. ???

download pfSense (pfSense-X.Y.Z-RELEASE-4g-amd64-nanobsd.img.gz) image. (nano, amd64, non-vga)

https://doc.pfsense.org/index.php/Full_Install_and_NanoBSD_Comparison

http://pcengines.ch/howto.htm#OS_installation

Guest

Bluekobolt u rock man. So i see the APU engines only support nano image.

You was mixing the older Alix boards and the newer APU & APU2 ones from today!

Does that mean that certain packages like snort or other downloadable packages may not be available for Nano pfsesne ?

Yes, for NanoBSD this might be absolutely correct. But together with the PC Engines APU & APU2 you
are able to use the following storage and boot mediums such as;

SDCard
mSATA
SSD/HDD
SATA -DOM
USB pen drive (internal & external)

Is there limitations in nano vs full or is this only during install. I see nano is only 177mb tiny comparing to 1.0G full version. Just trying to see if this is not stripped version of pfsense and packages may not be available. ???

For sure it will be not only one.

https://doc.pfsense.org/index.php/Full_Install_and_NanoBSD_Comparison

Here you will get the detailed answer on your earlier question you made above.

http://pcengines.ch/howto.htm#OS_installation

That we both are clear to talk about one and the same thing here is a http Link to the APU & APU2
boards we are talking about. PC Engines APU2C4
Above it will be shown how sorted and what kind of hardware it is.

The APU2 actual status is the following:
_BIOS is not feature complete yet, in particular -

• No boot from SD card.
• ECC not working yet.
• iPXE module not included yet._

Rango

So on new APU2d board that will be coming out can i install fully featured iso and run all packages i desire as long as msata drive is in it?

And would it be be non-vga iso since this board has no vga card ?

They feature their msata drive for APU board, does that mean i only can use theirs or can i use any other msata. I suspect no as it refers to apu msata controller?

I'm new to this and instructions on apu site were talking about nano so i took it as only nano be used on their (apu) boards. Sorry i pasted entire line. It's been edited. Didn't even notice that.

Thank you for all your help in this.

Guest

This thread was started by @JanFrode and was originally based on other informations and questions she or he
were asking! Please accept this, because I really don´t want to high jack his or her thread so this might be the
last time I will answering your personally questions here. Please go and open your own thread that is helping you.

So on new APU2d board that will be coming out can i install fully featured iso and run all packages i desire as long as msata drive is in it?

Yes.

And would it be be non-vga iso since this board has no vga card ?

Yes.

Rango

Oh so sorry. I'm also trying to pick best solution so i'm only joining the chat for best solution. One more question and i'm done as i think i got everything.

On apu website they feature their msata drive for APU board, does that mean i only can use theirs or can i use any other msata. I suspect no as it refers to apu msata controller for that apu board only?

movax

pc engines apu, are pretty nice. Also I am from Zurich, Switerland, so it is just next door to me (few minutes by tram to pick directly from their hq).

Found some benchmarks for older ones: http://www.firewallhardware.it/entry_level_apu_based.html based on current pc engines board, does about 500Mbps in NAT.

The apu2 is coming in few days, and should easily have 2x CPU performance. (And does AES in hardware, which is also nice)

I guess, I will actually get then new one, something like apu2c4, which has Intel NICs and better CPU. Should do 1Gbps actually. Around 125 CHF (~128USD, without case, psu, and storage, but all the accessories are surprisingly cheap in their webshop for Switzerland, wil probably fit below 180$). I like it. VGA would be somehow useful, but serial port is ok too. And I can always use 3rd NIC as an emergency network access or something. It is pretty expandable too, with usb, minipci, sata, SD, etc.

Anyhow, I had no idea AMDs APS comes also without GPU. And indeed apu2c4 comes with CPU which doesn't have GPU (but that might be just a binning, the GPU might be still there on silicon disabled).

Rango: I am pretty sure you can put most of the other mSATA or SD stuff there. I think they just have it in the shop for your convenience,. and often they are good enough to do the job. 16GB is somehow small by current standards tho. They list some stuff on their webpage, as for APU board, or for older ALIX boards. It is just so people do not choose something like this mSATA drive, or minipci express wlan card, when they are buying ALIX board, because this will not work or fit even.

Rango

Cool when you get it lest us know how you like it. BTW the board name will change to apu2d4 from what i heard. For me no vga was deal killer. I don't wanna mess around with console port. If you do some research you won't see some of the output during install. It will be garbage, then you have to switch some bound on console port. It's ok but hassle for me. I would appreciate simple 1024x768 vga output, don't have to be hdmi or anything but serial port is no go for me, as troubleshooting may be an issue, at least for me.

Also that amd chip i'm not impressed with it. Didn't dig the way they implemented heat sink solution either. Since this is custom build board if there are issues you will have to deal with their forum board and play around there. Like their custom BIOS development and bugs and updates within their custom board and bios that drives it. I don't wanna deal with that. With NUC it's a pc essentially with vga output. I don't thing throughput is bad, i don't know exactly what it is. Maybe be similar to intel but i know intel will outperform. Realtek nics are not issue for setup, just maybe high end throughput, from what i hear.

Honestly i like 2758 the best but not willing to spend that kinda money now at this box so this was best compromise. I didn't want to mess around with serial port. I think they made mistake by not including vga output but that's my opinion. Also with that NUC you can always convert it to media player as it's 4k compatible and has hdmi. It's more versatile and price is right. It's really personal preference. I honestly wanted 2758 but its too much $ for pfsense box imho.

btw 1d sucks….that's not even 100Mbps, and NUC will anihilate that box, 2d maybe way better but u should pass on 1d. And it's 230 euros so it's expensive for this performace.
My asus 78u does 60Mpbs on it's ARM processor. Any pfsense box MUST MUST do more then 100Mbps on AES 256, otherwise it's not worth my time.

AES256 58,63 Mbps 55,00 Mbps

movax

@Rango:

btw 1d sucks….that's not even 100Mbps, and NUC will anihilate that box, 2d maybe way better but u should pass on 1d. And it's 230 euros so it's expensive for this performace.
My asus 78u does 60Mpbs on it's ARM processor. Any pfsense box MUST MUST do more then 100Mbps on AES 256, otherwise it's not worth my time.

AES256 58,63 Mbps 55,00 Mbps

Its cpu doesn't have AES-NI. apu2 does have one (in each core ofc). I am pretty sure apu2 will be able to do much more than 1Gbps in AES128 in memory. Other factors might limit performance tho.

nib01

@BlueKobold:

Small:

Jetway Intel Atom D525 ~$200
No AES-NI & QuickAssist

PC Engines APU1D4 ~$250
No AES-NI & QuickAssist

PC Engines APU2D4 ~$300 (upcoming, not fully ready now)
AES-NI but no QuickAssist

Mid ranged:

Jetway N2930 ~$300 (barebone)
No AES-NI & QuickAssist

Intel Atom C2358, C2558, C2758 ~$300 - ~$800
AES-NI & QuickAssist

Looking spend ~200$. If more i may have to wait later on. Maybe atom E3845 ?

http://ark.intel.com/search/advanceds=t&FamilyText=Intel%C2%AE%20Atom%E2%84%A2%20Processor&AESTech=true

I am not really informed about the newer Intel Atom CPUs or SoCs that coming actual out there, sorry.
Only some vendors I know really that are using this kind of Intel Atom Nxxxx SoCs in their devices to
be a router or firewall. But I really can´t say anything about the VPN capabilities and throughput that
will be able to reach with them. Sorry again.

Axiomtek NA342 w/ Intel Atom E3825 processor

AES-NI

no QuickAssist

Axiomtek NA343 w/ Intel Celeron N3050

AES-NI

no QuickAssist

Supermicro X11SBA-LN4F w/ Intel Pentium Processor N3700
But problems with pfSense are reported.

AES-NI

no QuickAssist

So i really would go more with the SG-2220 from the pfSense store or waiting until the APU2C4 is ready
and the name is changing into to APU2D4 both comes woth AES-NI and will be sufficient enough for
100 MBit/s IPSec VPN as I see it right. What the OpenVPN is really needing others should answering
because I don´t use it and as I am informed it is not getting any benefits from the AES-NI.

I think these two boards Supermicro A1SRi-2558/2758 are quick assist and AES-NI supported.

I don't know if there any issue right now. What you guys think?

movax

APU2C4

Debian 8.4

Linux apu2 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-1 (2016-03-06) x86_64 GNU/Linux

I still do not have any pfsense results (I am still playing with it in VirtualBox, and I am still not convinced about pfsense right now), but here are some performance numbers from Linux.


# gnutls-cli --benchmark-ciphers
Checking cipher-MAC combinations, payload size: 16384
     SALSA20-256-SHA1 39.57 MB/sec
     AES-128-CBC-SHA1 67.64 MB/sec
     AES-128-CBC-SHA256 37.11 MB/sec
     AES-128-GCM 0.41 GB/sec

Checking MAC algorithms, payload size: 16384
            SHA1 92.43 MB/sec
          SHA256 43.06 MB/sec
          SHA512 38.80 MB/sec

Checking ciphers, payload size: 16384
        3DES-CBC 4.48 MB/sec
     AES-128-CBC 0.23 GB/sec
     ARCFOUR-128 76.71 MB/sec
     SALSA20-256 67.65 MB/sec

with 6.3W total power consumption during this test.


# openssl speed -evp aes-128-ecb  aes-128-cbc  aes-128-gcm
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-ecb     127544.98k   406525.93k   656512.60k   749048.83k   792521.39k
aes-128-cbc     124649.83k   175624.04k   214096.38k   226685.61k   230045.01k
aes-128-gcm      64513.34k   165438.55k   247261.70k   282979.33k   295043.07k

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
rc4              97220.57k   130829.63k   143616.68k   146905.90k   149889.02k
des cbc          12226.79k    12978.73k    13191.42k    13242.37k    13254.66k
des ede3          4833.95k     4937.05k     4954.88k     4959.57k     4961.62k
blowfish cbc     22437.34k    25266.43k    26045.61k    26310.31k    26359.13k
aes-128 cbc      16068.08k    17115.71k    17509.46k    44544.68k    45140.65k
camellia-128 cbc    20475.77k    31573.53k    36410.03k    37942.95k    38466.90k
aes-128-gcm      64770.55k   165564.91k   247574.61k   282806.27k   295458.13k
aes-128 ige      15734.23k    16539.99k    16828.84k    16869.38k    16867.33k

with power usage 6.3W during this test.

Also I got a mSATA drive 16GB SSD from PC Engines, and it is fast. ~350MB/s write and up to 410MB/s sustained sequential read. Power usage 7.4W when doing read using dd bs=64k of=/dev/null.

Power consumption is around 5.6W (with power factor 63%) when idle (and PSU essentially at the room temperature!), even with cpufrequency governor set to performance and 1GHz all the time. 5.0W at idle, when using ondemand governor (600MHz on all cores). All with only one Ethernet port active right now. Power factor improves to 70% during load at one core (with usage around 6.3-7.5W depending on a test).


root@apu2:~# sensors
k10temp-pci-00c3
Adapter: PCI adapter
temp1:        +53.4°C  (high = +70.0°C)
                       (crit = +105.0°C, hyst = +104.0°C)

at idle, but I would need to recheck if my heatsink and thermal adhisive is correctly attached, because it is little hot.

I done some ethernet tests again, and I was able to get sustained 101MB/s downloading ubuntu iso files from Internet over IPv4 to /dev/null (with other router doing NAT and probably being a bottelneck). Average 90MB/s. At about 44% CPU usage (out of 400% available), most spend in kernel. Power usage 6.7W during that test.

Running 4 instances of burnK7, power usage 7.4W (power factor 65%). Temperature stays at around 62.0 °C after stabilisation after few minutes, with my room around 25.6 °C.

All tests with upper cover not mounted. With cover mounted it might right be few degree.

PSU is cold all the time, and I cannot even feel it warming up at all even during stress tests. Voltage regulators, converters, coils at the board are only little warm during stress test, and you need to touch them to feel any temperature out of it, and it was low all the time. Capacitors do not warm at all.

The board is essentially noiseless, but if I try really hard, I can hear some hiss / whine (both during load and when idle, with a little bit different spectrum). It is extremeally low in volume tho. With cover put on, it would be impossible to hear.

I am positively impressed so far.

And dmidecode, lspci and lsusb for curious


# dmidecode 
# dmidecode 2.12
SMBIOS 2.7 present.
7 structures occupying 306 bytes.
Table at 0xDFFB7020.

Handle 0x0000, DMI type 0, 24 bytes
BIOS Information
	Vendor: coreboot
	Version: 88a4f96
	Release Date: 03/07/2016
	ROM Size: 8192 kB
	Characteristics:
		PCI is supported
		PC Card (PCMCIA) is supported
		BIOS is upgradeable
		Selectable boot is supported
		ACPI is supported
		Targeted content distribution is supported
	BIOS Revision: 4.0
	Firmware Revision: 0.0

Handle 0x0001, DMI type 1, 27 bytes
System Information
	Manufacturer: PC Engines
	Product Name: apu2
	Version: 1.0
	Serial Number: 123456789
	UUID: Not Settable
	Wake-up Type: Reserved
	SKU Number: Not Specified
	Family: Not Specified

Handle 0x0002, DMI type 2, 8 bytes
Base Board Information
	Manufacturer: PC Engines
	Product Name: apu2
	Version: 1.0
	Serial Number: 123456789

Handle 0x0003, DMI type 3, 21 bytes
Chassis Information
	Manufacturer: PC Engines
	Type: Desktop
	Lock: Not Present
	Version: Not Specified
	Serial Number: Not Specified
	Asset Tag: Not Specified
	Boot-up State: Safe
	Power Supply State: Safe
	Thermal State: Safe
	Security Status: None
	OEM Information: 0x00000000
	Height: Unspecified
	Number Of Power Cords: Unspecified
	Contained Elements: 0

Handle 0x0004, DMI type 4, 42 bytes
Processor Information
	Socket Designation: Not Specified
	Type: Central Processor
	Family: Pentium Pro
	Manufacturer: AuthenticAMD
	ID: 01 0F 73 00 FF FB 8B 17
	Signature: Type 0, Family 22, Model 48, Stepping 1
	Flags:
		FPU (Floating-point unit on-chip)
		VME (Virtual mode extension)
		DE (Debugging extension)
		PSE (Page size extension)
		TSC (Time stamp counter)
		MSR (Model specific registers)
		PAE (Physical address extension)
		MCE (Machine check exception)
		CX8 (CMPXCHG8 instruction supported)
		APIC (On-chip APIC hardware supported)
		SEP (Fast system call)
		MTRR (Memory type range registers)
		PGE (Page global enable)
		MCA (Machine check architecture)
		CMOV (Conditional move instruction supported)
		PAT (Page attribute table)
		PSE-36 (36-bit page size extension)
		CLFSH (CLFLUSH instruction supported)
		MMX (MMX technology supported)
		FXSR (FXSAVE and FXSTOR instructions supported)
		SSE (Streaming SIMD extensions)
		SSE2 (Streaming SIMD extensions 2)
		HTT (Multi-threading)
	Version: AMD GX-412TC SOC                               
	Voltage: Unknown
	External Clock: Unknown
	Max Speed: Unknown
	Current Speed: Unknown
	Status: Unpopulated
	Upgrade: Other
	L1 Cache Handle: Not Provided
	L2 Cache Handle: Not Provided
	L3 Cache Handle: Not Provided
	Serial Number: Not Specified
	Asset Tag: Not Specified
	Part Number: Not Specified
	Core Count: 4
	Characteristics: None

Handle 0x0005, DMI type 32, 11 bytes
System Boot Information
	Status: No errors detected

Handle 0x0006, DMI type 127, 4 bytes
End Of Table

PS. 123456789 is real serial number. oops.

lspci


# lspci 
00:00.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1566
00:02.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 156b
00:02.2 PCI bridge: Advanced Micro Devices, Inc. [AMD] Family 16h Processor Functions 5:1
00:02.3 PCI bridge: Advanced Micro Devices, Inc. [AMD] Family 16h Processor Functions 5:1
00:02.4 PCI bridge: Advanced Micro Devices, Inc. [AMD] Family 16h Processor Functions 5:1
00:08.0 Encryption controller: Advanced Micro Devices, Inc. [AMD] Device 1537
00:10.0 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB XHCI Controller (rev 11)
00:11.0 SATA controller: Advanced Micro Devices, Inc. [AMD] FCH SATA Controller [IDE mode] (rev 40)
00:13.0 USB controller: Advanced Micro Devices, Inc. [AMD] FCH USB EHCI Controller (rev 39)
00:14.0 SMBus: Advanced Micro Devices, Inc. [AMD] FCH SMBus Controller (rev 42)
00:14.3 ISA bridge: Advanced Micro Devices, Inc. [AMD] FCH LPC Bridge (rev 11)
00:14.7 SD Host controller: Advanced Micro Devices, Inc. [AMD] FCH SD Flash Controller (rev 01)
00:18.0 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1580
00:18.1 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1581
00:18.2 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1582
00:18.3 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1583
00:18.4 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1584
00:18.5 Host bridge: Advanced Micro Devices, Inc. [AMD] Device 1585
01:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)
02:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)
03:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)
root@apu2:~# lspci -vt
-[0000:00]-+-00.0  Advanced Micro Devices, Inc. [AMD] Device 1566
           +-02.0  Advanced Micro Devices, Inc. [AMD] Device 156b
           +-02.2-[01]----00.0  Intel Corporation I210 Gigabit Network Connection
           +-02.3-[02]----00.0  Intel Corporation I210 Gigabit Network Connection
           +-02.4-[03]----00.0  Intel Corporation I210 Gigabit Network Connection
           +-08.0  Advanced Micro Devices, Inc. [AMD] Device 1537
           +-10.0  Advanced Micro Devices, Inc. [AMD] FCH USB XHCI Controller
           +-11.0  Advanced Micro Devices, Inc. [AMD] FCH SATA Controller [IDE mode]
           +-13.0  Advanced Micro Devices, Inc. [AMD] FCH USB EHCI Controller
           +-14.0  Advanced Micro Devices, Inc. [AMD] FCH SMBus Controller
           +-14.3  Advanced Micro Devices, Inc. [AMD] FCH LPC Bridge
           +-14.7  Advanced Micro Devices, Inc. [AMD] FCH SD Flash Controller
           +-18.0  Advanced Micro Devices, Inc. [AMD] Device 1580
           +-18.1  Advanced Micro Devices, Inc. [AMD] Device 1581
           +-18.2  Advanced Micro Devices, Inc. [AMD] Device 1582
           +-18.3  Advanced Micro Devices, Inc. [AMD] Device 1583
           +-18.4  Advanced Micro Devices, Inc. [AMD] Device 1584
           \-18.5  Advanced Micro Devices, Inc. [AMD] Device 1585
root@apu2:~# lspci -vtn\
> ^C
root@apu2:~# lspci -vtn
-[0000:00]-+-00.0  1022:1566
           +-02.0  1022:156b
           +-02.2-[01]----00.0  8086:157b
           +-02.3-[02]----00.0  8086:157b
           +-02.4-[03]----00.0  8086:157b
           +-08.0  1022:1537
           +-10.0  1022:7814
           +-11.0  1022:7800
           +-13.0  1022:7808
           +-14.0  1022:780b
           +-14.3  1022:780e
           +-14.7  1022:7813
           +-18.0  1022:1580
           +-18.1  1022:1581
           +-18.2  1022:1582
           +-18.3  1022:1583
           +-18.4  1022:1584
           \-18.5  1022:1585

lsusb


# lsusb 
Bus 001 Device 002: ID 0438:7900 Advanced Micro Devices, Inc. 
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
root@apu2:~# lsusb  -tv
/:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/2p, 5000M
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/2p, 480M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/2p, 480M
    |__ Port 1: Dev 2, If 0, Class=Hub, Driver=hub/4p, 480M

cpuinfo


# cat /proc/cpuinfo 
processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 22
model		: 48
model name	: AMD GX-412TC SOC
stepping	: 1
microcode	: 0x7030105
cpu MHz		: 1000.000
cache size	: 2048 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc extd_apicid aperfmperf eagerfpu pni pclmulqdq monitor ssse3 cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt topoext perfctr_nb perfctr_l2 arat cpb xsaveopt hw_pstate npt lbrv svm_lock nrip_save tsc_scale flushbyasid decodeassists pausefilter pfthreshold vmmcall bmi1
bogomips	: 1996.14
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb [12] [13]

...

I commented on mSATA drive details in another thread: https://forum.pfsense.org/index.php?topic=109970.msg612649#msg612649