Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense i7-4510U + 2x Intel 82574 + 2x Intel i350 (miniPCIE) Mini-ITX Build

    Scheduled Pinned Locked Moved
    Hardware
    11
    51
    19.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mauroman33
      last edited by

      @Paint:

      Here is the output:

      [2.3.1-RELEASE][root@pfSense.lan]/root: openvpn --genkey --secret /tmp/secret
[2.3.1-RELEASE][root@pfSense.lan]/root: time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
10.682u 0.677s 0:11.36 99.9%    742+177k 0+0io 1pf+0w
[2.3.1-RELEASE][root@pfSense.lan]/root:

      (3200 / 11.36) = 281.7 Mbps OpenVPN performance (estimate)

      Thanks mate!
      Now I know that I have to find my way in this cpu's class

      1 Reply Last reply Reply Quote 0
      • D
        ddarlington36
        last edited by

        What's the CPU usage like during the tests?  Is that test anything like iperf or dose it simulate the openvpn throughput/bandwidth.  Pretty impressive results !! I'm sold

        1 Reply Last reply Reply Quote 0
        • ?
          Guest
          last edited by

          Got this mostly up and working today. I am going to do some additional tweaks before I release any speed tests, but I can report that my WAN speeds are about he same (I'm capped at 100/100mbits anyway).

          With disabled PowerD (hi adaptive) it could be that the CPU frequency is not scaling from low to high likes it
          is needed by the load, and so any kind of many tests could be not really right then! Please don´t forget this
          and think about.

          I tried to enable TRIM via this post: https://forum.pfsense.org/index.php?topic=83272.msg456248#msg456248

          Unfortunately, after adding ahci_load to my loader.conf.local and running touch /root/TRIM_set; /etc/rc.reboot I still do not have TRIM (I dont think its a big deal though)

          Please use this procedure shown in that thread/post exactly! It is right matching and well working!
          Enable TRIM Support in pfSense

          ahci_load="YES"
kern.ipc.nmbclusters="1000000"
legal.intel_ipw.license_ack=1
legal.intel_iwi.license_ack=1

          This might be right looking to me. If you are doing tests now, you could not be running out of kernel
          space or mbuf size!

          1 Reply Last reply Reply Quote 0
          • P
            Paint
            last edited by

            @mauroman33:

            @Paint:

            Here is the output:

            [2.3.1-RELEASE][root@pfSense.lan]/root: openvpn --genkey --secret /tmp/secret
[2.3.1-RELEASE][root@pfSense.lan]/root: time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
10.682u 0.677s 0:11.36 99.9%    742+177k 0+0io 1pf+0w
[2.3.1-RELEASE][root@pfSense.lan]/root:

            (3200 / 11.36) = 281.7 Mbps OpenVPN performance (estimate)

            Thanks mate!
            Now I know that I have to find my way in this cpu's class

            anytime! Loving this MiniPC so far!

            pfSense i5-4590
            940/880 mbit Fiber Internet from FiOS
            BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
            Netgear R8000 AP (DD-WRT)

            1 Reply Last reply Reply Quote 0
            • P
              Paint
              last edited by

              @ddarlington36:

              What's the CPU usage like during the tests?  Is that test anything like iperf or dose it simulate the openvpn throughput/bandwidth.  Pretty impressive results !! I'm sold

              CPU is almost non existent (less than .1-.2 on the 1min top) I will provide a more detailed update once I finish my firewall/traffic shaping/snort/country blocking setup.

              I still need to do an iperf test, but I believe I will get very close to 1gbps over my LAN. Therefore, CPU is your bottleneck when using VPN. The previous test shows how fast your CPU can encrypt information and backs into a mbps theoretical max.

              pfSense i5-4590
              940/880 mbit Fiber Internet from FiOS
              BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
              Netgear R8000 AP (DD-WRT)

              1 Reply Last reply Reply Quote 0
              • ?
                Guest
                last edited by

                Thanks mate!
                Now I know that I have to find my way in this cpu's class

                If you are unsure, money is not the real problem for you and you will be having much throughput in the WAN
                and LAN area or high throughput over any VPN tunnel, go and buy a Intel Xeon E3-1240v3 and 8 GB DDR3
                1600MHz RAM and you will be getting out the maximum of all! Not cheap, but very effective in any kind of.
                You can also save money over a longer time or get parts refurbished!

                I still need to do an iperf test, but I believe I will get very close to 1gbps over my LAN. Therefore, CPU is your bottleneck when using VPN. The previous test shows how fast your CPU can encrypt information and backs into a mbps theoretical max.

                Set up at the LAN interface a subnet likes 192.168.xx and on the other LAN interface another one likes
                172.xx.xx and then iPerf client to server test, you can repeat it through the WAN interface by setting up there
                a small GB switch and set up outside the AN interface the iPerf server.

                1 Reply Last reply Reply Quote 0
                • P
                  Paint
                  last edited by

                  @BlueKobold:

                  Thanks mate!
                  Now I know that I have to find my way in this cpu's class

                  If you are unsure, money is not the real problem for you and you will be having much throughput in the WAN
                  and LAN area or high throughput over any VPN tunnel, go and buy a Intel Xeon E3-1240v3 and 8 GB DDR3
                  1600MHz RAM and you will be getting out the maximum of all! Not cheap, but very effective in any kind of.
                  You can also save money over a longer time or get parts refurbished!

                  I still need to do an iperf test, but I believe I will get very close to 1gbps over my LAN. Therefore, CPU is your bottleneck when using VPN. The previous test shows how fast your CPU can encrypt information and backs into a mbps theoretical max.

                  Set up at the LAN interface a subnet likes 192.168.xx and on the other LAN interface another one likes
                  172.xx.xx and then iPerf client to server test, you can repeat it through the WAN interface by setting up there
                  a small GB switch and set up outside the AN interface the iPerf server.

                  ill do a few different tests for iperf in the next few days. I already have my DHCP server cloning my G1100 MAC and DHCP request so that I can run the FIOS MoCA G1100 Quantum Router in parallel to my pfSense box - this eliminates a double NAT situation, allows me to use my own router, and keep all of the FIOS services (Remote DVR, VoD, CallerID, etc) without the need for my backend "three router" setup.

                  To setup a new vlan to test a fake WAN will be a piece of cake after that  :P

                  This whole setup only cost me $400 USD + $30 USD for a Dell PowerConnect 2716 Managed Switch from eBay. For the price, I dont think it can be beat!

                  pfSense i5-4590
                  940/880 mbit Fiber Internet from FiOS
                  BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                  Netgear R8000 AP (DD-WRT)

                  1 Reply Last reply Reply Quote 0
                  • A
                    aGeekhere
                    last edited by

                    What speed do you get from the squid cache?
                    Download a file
                    Test files here
                    http://mirror.internode.on.net/pub/test/
                    Then once it is downloaded try redownloading and check the speed from the squid cache

                    Never Fear, A Geek is Here!

                    1 Reply Last reply Reply Quote 0
                    • P
                      Paint
                      last edited by

                      @aGeekHere:

                      What speed do you get from the squid cache?
                      Download a file
                      Test files here
                      http://mirror.internode.on.net/pub/test/
                      Then once it is downloaded try redownloading and check the speed from the squid cache

                      http://mirror.internode.on.net/pub/test/ this link does not work….

                      pfSense i5-4590
                      940/880 mbit Fiber Internet from FiOS
                      BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                      Netgear R8000 AP (DD-WRT)

                      1 Reply Last reply Reply Quote 0
                      • A
                        asterix
                        last edited by

                        Use this for enabling TRIM.

                        https://gist.github.com/mdouchement/853fbd4185743689f58c

                        You don't need to do enable AHCI by adding ahci_load="YES" … it works for me without this.

                        1 Reply Last reply Reply Quote 0
                        • A
                          aGeekhere
                          last edited by

                          this link does not work….

                          Must be location blocked, try a Ubuntu iso or any large file that will cached.

                          Never Fear, A Geek is Here!

                          1 Reply Last reply Reply Quote 0
                          • P
                            Paint
                            last edited by

                            @Asterix:

                            Use this for enabling TRIM.

                            https://gist.github.com/mdouchement/853fbd4185743689f58c

                            You don't need to do enable AHCI by adding ahci_load="YES" … it works for me without this.

                            thanks. that worked:

                            [2.3.1-RELEASE][root@pfSense.lan]/root: tunefs -p /
tunefs: POSIX.1e ACLs: (-a)                                disabled
tunefs: NFSv4 ACLs: (-N)                                   disabled
tunefs: MAC multilabel: (-l)                               disabled
tunefs: soft updates: (-n)                                 enabled
tunefs: soft update journaling: (-j)                       enabled
tunefs: gjournal: (-J)                                     disabled
tunefs: trim: (-t)                                         enabled
tunefs: maximum blocks per file in a cylinder group: (-e)  4096
tunefs: average file size: (-f)                            16384
tunefs: average number of files in a directory: (-s)       64
tunefs: minimum percentage of free space: (-m)             8%
tunefs: space to hold for metadata blocks: (-k)            6408
tunefs: optimization preference: (-o)                      time
tunefs: volume label: (-L)

                            migrated my entire network over to pfsense as the main router with two AP running DDWRT. I have done a lot of tweaking, but will finalize some stuff over the weekend. I hope to then post some performance benchmarks.

                            Next on to snort and traffic shaping  8) 8) 8)

                            pfSense i5-4590
                            940/880 mbit Fiber Internet from FiOS
                            BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                            Netgear R8000 AP (DD-WRT)

                            1 Reply Last reply Reply Quote 0
                            • ?
                              Guest
                              last edited by

                              You don't need to do enable AHCI by adding ahci_load="YES" … it works for me without this.

                              I must consider to this, I would recommend to shorten this line in the boot/loader.conf.local file, it is not
                              really needed for your pfSense machine.

                              1 Reply Last reply Reply Quote 0
                              • P
                                Paint
                                last edited by

                                @BlueKobold:

                                You don't need to do enable AHCI by adding ahci_load="YES" … it works for me without this.

                                I must consider to this, I would recommend to shorten this line in the boot/loader.conf.local file, it is not
                                really needed for your pfSense machine.

                                I dont use ahci_load="YES" in my /boot/loader.conf.local file.

                                I have made many System Tunable changes and loader.conf.local changes. Below are my /boot/loader.conf.local changes:

                                
legal.intel_ipw.license_ack=1
legal.intel_iwi.license_ack=1
aio_load="YES"
pf_load="YES"
pflog_load="YES
if_em_load="YES"
hw.em.rxd=4096
hw.em.txd=4096
#ahci_load="YES"
cc_htcp_load="YES"
net.inet.tcp.hostcache.cachelimit="0"
hw.em.num_queues="2"
kern.ipc.nmbclusters="1000000"

                                pfSense i5-4590
                                940/880 mbit Fiber Internet from FiOS
                                BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                Netgear R8000 AP (DD-WRT)

                                1 Reply Last reply Reply Quote 0
                                • A
                                  asterix
                                  last edited by

                                  Why do u need traffic shaping on a 100MBit line?

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    Paint
                                    last edited by

                                    @Asterix:

                                    Why do u need traffic shaping on a 100MBit line?

                                    QoS for buffer float? Would you suggest otherwise?

                                    pfSense i5-4590
                                    940/880 mbit Fiber Internet from FiOS
                                    BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                    Netgear R8000 AP (DD-WRT)

                                    1 Reply Last reply Reply Quote 0
                                    • W
                                      whosmatt
                                      last edited by

                                      @Paint:

                                      This whole setup only cost me $400 USD + $30 USD for a Dell PowerConnect 2716 Managed Switch from eBay. For the price, I dont think it can be beat!

                                      Please tell me that switch is fanless.  If it is and has the regular Dell CLI, I want one now.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        Paint
                                        last edited by

                                        @whosmatt:

                                        @Paint:

                                        This whole setup only cost me $400 USD + $30 USD for a Dell PowerConnect 2716 Managed Switch from eBay. For the price, I dont think it can be beat!

                                        Please tell me that switch is fanless.  If it is and has the regular Dell CLI, I want one now.

                                        It is fanless, but unfortunately it only has WebGUI configuration - no CLI

                                        pfSense i5-4590
                                        940/880 mbit Fiber Internet from FiOS
                                        BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                        Netgear R8000 AP (DD-WRT)

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          Paint
                                          last edited by

                                          • Impersonation of G1100 FIOS DHCP Packet

                                            • (updated instructions for the FiOS Quanum Gateway, coming soon)

                                          • he.net IPv6 Tunnel

                                          • Snort

                                          • pfBlockerNG + DNSBL

                                          • Traffic Shaper (CODELQ)

                                          • ntopng

                                          http://pastebin.com/DpzEjg5h

                                          iperf -c 192.168.1.1 -w 64KB
------------------------------------------------------------
Client connecting to 192.168.1.1, TCP port 5001
TCP window size: 64.0 KByte
------------------------------------------------------------
[  3] local 192.168.1.50 port 8911 connected with 192.168.1.1 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec  1.11 GBytes   949 Mbits/sec

                                          pfSense i5-4590
                                          940/880 mbit Fiber Internet from FiOS
                                          BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                          Netgear R8000 AP (DD-WRT)

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            aGeekhere
                                            last edited by

                                            Speed from the squid cache? Also did you setup pfsense to act as your DNS server? Here is a video on it https://m.youtube.com/watch?v=s3VXLIXGazM

                                            Never Fear, A Geek is Here!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post