Do Threads Work Like Cores for pfsense?
-
3. Undecided on packages due to inexperience with pfSense; pending further evaluation
4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see:3. Should be clear before starting or starting with a powerful quad core CPU to be sure then!
4. Dual or Quad Core CPU @3,0GHz is then the best way to be able to realize it.It makes many sense to know before starting if only a pure firewall + VPN connections are in the game
or a fully sorted UTM device should be in the game play. (firewall & VPN + http-Proxy, IDS,
AV Scan, pfBlockerNG) -
@BlueKobold:
3. Undecided on packages due to inexperience with pfSense; pending further evaluation
4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see:3. Should be clear before starting or starting with a powerful quad core CPU to be sure then!
4. Dual or Quad Core CPU @3,0GHz is then the best way to be able to realize it.It makes many sense to know before starting if only a pure firewall + VPN connections are in the game
or a fully sorted UTM device should be in the game play. (firewall & VPN + http-Proxy, IDS,
AV Scan, pfBlockerNG)Yep, I am reading up on them now to confirm stuff
…but I am quite tempted to just get a powerful Quad Core and learn from there! :D (without using too much electrocity I hope)
-
without using too much electrocity I hope)
That could be reached with ease if you went the road and go with a Intel Xeon E3 CPU! Not
even the best choice if you are putting even more other single points in that game, but all
for all it matches at the very best to be better suited with an Intel Core i3, i5 or i7 and let
you reach also the goal to get 1 GBit/s at the WAN surely! On top you may should get an
Intel PT Dual or Quad LAN Port NIC to be ensuring from side too, that all will be running
fine for you.Otherwise it could also be the Jetway NF9HG-2930 board that will you bring up to new horizons
but without a guaranty for the real 1 GBit/s at the WAN port. As an alternative or plain a middle
based solution you should have a look on that board here, it supports pfSense and is able to get
real power but also sorted with many ports too! Jetway NF592-Q170 Intel Core Skylake -
@BlueKobold:
without using too much electrocity I hope)
That could be reached with ease if you went the road and go with a Intel Xeon E3 CPU! Not
even the best choice if you are putting even more other single points in that game, but all
for all it matches at the very best to be better suited with an Intel Core i3, i5 or i7 and let
you reach also the goal to get 1 GBit/s at the WAN surely! On top you may should get an
Intel PT Dual or Quad LAN Port NIC to be ensuring from side too, that all will be running
fine for you.Otherwise it could also be the Jetway NF9HG-2930 board that will you bring up to new horizons
but without a guaranty for the real 1 GBit/s at the WAN port. As an alternative or plain a middle
based solution you should have a look on that board here, it supports pfSense and is able to get
real power but also sorted with many ports too! Jetway NF592-Q170 Intel Core SkylakeWhoa, Xeons are kinda overkill; I was thinking something more like second hand i5 or i7 CPUs from Sandy Bridge onwards
I do have an Intel Dual NIC and another Intel Single NIC; I am unsure of their chipsets as they are currently used in my DIY NASes
And while the Jetway sounds good, I can't ship them back to Singapore (that's where I live) unfortunatelyI am somewhat wrong about this; see my new post -
I took a look at packages for pfSense and gotten a rough sensing of what I may need:
1. Squid
2. SquidGuard
3. Darkstat
4. Snort
5. HAVP (undecided; I may just stick with the usual antivirus in each PC)
6. DNS related package; idea is to set my WAN to use multiple DNS servers so that if one DNS provider goes down, others will be used automaticallyLooks like a proper i5 with proper cores may be more for my usage
As for VPN, seeing that this is mainly for me to connect to my NAS from other computers (or my laptop) in other areas, I will do this on my NAS instead of my router
-
Apparently, I forgot that NewEgg does ship Jetway stuff to Singapore!
http://www.newegg.com/global/sg/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=Jetway
The JetWay JNF9HG-2930 and JetWay JNF591-3150 interest me in particular
Now it's a matter of deciding if going this path is better than building the usual computer
-
Apparently, I forgot that NewEgg does ship Jetway stuff to Singapore!
http://www.newegg.com/global/sg/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=Jetway
The JetWay JNF9HG-2930 and JetWay JNF591-3150 interest me in particular
Now it's a matter of deciding if going this path is better than building the usual computer
N2930 doesn't have AES-NI, so I wouldn't even consider it if you have any interest in VPN or SSL in the future. Otherwise it's a wash.
-
Apparently, I forgot that NewEgg does ship Jetway stuff to Singapore!
http://www.newegg.com/global/sg/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=Jetway
The JetWay JNF9HG-2930 and JetWay JNF591-3150 interest me in particular
Now it's a matter of deciding if going this path is better than building the usual computer
N2930 doesn't have AES-NI, so I wouldn't even consider it if you have any interest in VPN or SSL in the future. Otherwise it's a wash.
Yeah, it's a pity indeed; its 4 Intel NICs (and very new ones!) are indeed a godsend for this price!
So it's either the 3150 or something elseBack to the drawing board; there's no Intel NIC on the 3150 :(
-
Looks like a proper i5 with proper cores may be more for my usage
Jetway NF592-Q170 pending on your budget would this also matching then!
Yeah, it's a pity indeed; its 4 Intel NICs (and very new ones!) are indeed a godsend for this price!
Ok, there some differences between you wish and your need or between your need and your budget, or?
Back to the drawing board; there's no Intel NIC on the 3150
There are many powerful and small boxes in the wild.
Whats about your budget??
-
@BlueKobold:
Looks like a proper i5 with proper cores may be more for my usage
Jetway NF592-Q170 pending on your budget would this also matching then!
Yeah, it's a pity indeed; its 4 Intel NICs (and very new ones!) are indeed a godsend for this price!
Ok, there some differences between you wish and your need or between your need and your budget, or?
Back to the drawing board; there's no Intel NIC on the 3150
There are many powerful and small boxes in the wild.
Whats about your budget??
Wow thanks for the options, only problem about them is that they don't ship to Singapore directly (except for the E200-9B). This means that I will need to use proxy services which will bump up prices by a bit. Also I will need warranty too.
I mentioned that it was a pity as there are 4 Intel NICs on that board (which I will need for 2 WANs and 1 LAN; I can use the last port as another LAN I guess) but that the CPU does not have AES-NI, of which I think I should have.
For my budget, currently I am trying to stick with 500 SGD. I have come up with the following builds based on local prices + what parts do I have left:
i3-4170
ASROCKRACK Motherboard H97M WS
2x 2GB DDR3 RAM (personal)
SEASONIC S12G-Non MODULAR 450W from PC Themes
Old Casing (personal)
Old HDD (personal)
Single NIC Intel Card (personal)
Total: 416 SGDor
i3 6100
ASROCK H110M- ITX/D3
2x 2GB DDR3 RAM (personal)
SEASONIC S12G-Non MODULAR 450W from PC Themes
Old Casing
Old HDD
Dual NIC Intel Card (personal)
Total: 373 SGD -
For my budget, currently I am trying to stick with 500 SGD.
Perhaps you should be looking forward and buy the hardware step-by-step!
ASUS Q87T S$427.20 (SGD)
Celeron G3260 @3,3GHz ~S$99 (SGD)
2 x 4 GB RAM DDR3-1600 ~S$82.00 (SGD)
mSATA 120 GB ~S$89.00 (SGD)
M350 ~S$116.00 (SGD)I got this over www.qoo10.sg and ebay.com.sg all prices are shipping free from the US or Japan
-
@BlueKobold:
ASUS Q87T S$427.20 (SGD)
That has one intel and one RTL NIC. That shouldn't matter so much, but is why one of the other platforms was already eliminated. It's a shame that freebsd's history of lousy realtek drivers has lead to writing off most of the low cost boards on the planet.
Celeron G3260 @3,3GHz ~S$99 (SGD)
G3260 also doesn't do AES, if he didn't care about that he should just go with the fanless N2930 which is a better fit for purpose. Or at least go with the skylake+aes G3900 or G3920.
-
@BlueKobold:
For my budget, currently I am trying to stick with 500 SGD.
Perhaps you should be looking forward and buy the hardware step-by-step!
ASUS Q87T S$427.20 (SGD)
Celeron G3260 @3,3GHz ~S$99 (SGD)
2 x 4 GB RAM DDR3-1600 ~S$82.00 (SGD)
mSATA 120 GB ~S$89.00 (SGD)
M350 ~S$116.00 (SGD)I got this over www.qoo10.sg and ebay.com.sg all prices are shipping free from the US or Japan
Hmm. I can find similar motherboards for much cheaper here I am afraid (see my earlier post as example)
@BlueKobold:
ASUS Q87T S$427.20 (SGD)
That has one intel and one RTL NIC. That shouldn't matter so much, but is why one of the other platforms was already eliminated. It's a shame that freebsd's history of lousy realtek drivers has lead to writing off most of the low cost boards on the planet.
Celeron G3260 @3,3GHz ~S$99 (SGD)
G3260 also doesn't do AES, if he didn't care about that he should just go with the fanless N2930 which is a better fit for purpose. Or at least go with the skylake+aes G3900 or G3920.
I can get a G4400 that can do AES too. And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]; I may as well just look for motherboards with just one Intel NIC and then get another dual port Intel NIC from Amazon
-
And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]
Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.
-
And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]
Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.
Hmm so in terms of performance, in the context of home usage, are these NICs the same?
-
Hmm. After speaking to some people, I think I will like to hold off the planning for now as Kaby Lake is just next month; I may either use that or at least get Skylake for cheaper
Meanwhile, let me use a spare XPS 420, one dual port Intel NIC and another single port Intel NIC and see how that goes
-
So far so good, am into my first 24hrs of pfsense now
The XPS 420's Q6600 (2.40Ghz Quad Core) and 8GB of RAM seems decent but I noticed a slight reduction of net throughput. I have tried some packages but I keep accidentally blocking the entire Internet lol so I decided to remove most of them and then reinstall them on a need-to-use basis (e.g. going with either squid or HAProxy for reverse proxy)
I noticed that pfsense has a very steep learning curve as compared to other custom router firmwares
-
And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]
Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.
Hmm so in terms of performance, in the context of home usage, are these NICs the same?
Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s with intel desktop LOM from 10 years ago you get 115MB/s, server network interfaces theoretically have lower CPU usage, slightly faster speeds and they of course have more features such as SR-IOV, iSCSI boot and or acceleration, etc.
You can pick up server pulls nics for cheap on ebay, such as the silicom 6 port intel chipset (no sr-iov fyi) or mellanox-connectx2 - there are a lot of options and not all of them are intel however anything from broadcom or realtek is garbage.
If you want SRIOV don't buy dell rebrands as they disable that because reasons, and if you want to run it in a vm you want SR-IOV for performance and security (although you need chipset with IOMMU and the like as well, pm me if you want help with finding hardware that works with this)
-
Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s
That's simply not true, so the rest can be safely ignored.
-
Ah, sorry, I forgot to put out my requirements, let's see if this is ok:
1. 5 permanent users (me + family members); need to be able to scale up to 25 users in case of visitors
2. 20 permanent devices (7 PC/laptops, 13 mobile devices); need to be able to scale up to 50 devices in case of visitors
3. Undecided on packages due to inexperience with pfSense; pending further evaluation
4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see: https://www.starhub.com/personal/broadband/dual-broadband-plan/price-plans.html#Dual-Broadband) => Dual WAN features like failover required
5. Possibility of VPN usage (e.g. outside computer connecting to a certain PC in network)
6. Possibility of cryptography features if any => AES-NI desired
7. LAN: 1 8-port TP-Link Smart Switch (TL-SG2008), Wifi: Asus AC66u as Wireless Access Point (connected via Sineoji PL1800EP as it will be placed in a different room for house-wide access)Number of devices doesn't matter as long as your edge devices (access points, switch uplinks etc) can handle the load.
A Core i5 will easily handle what you need, just get a little more memory (8GB or more depending on the packages you eventually run).
For reference, I'm using a Pentium G3220 (Haswell Generation Dual Core 3.0GHz) with my ViewQwest 1G connection and it's only loading to about 30% across both cores when I max out my downloads.
I've previously ran Snort and Suricata (separate occasions) for testing and it still wasn't CPU limited.Dual-WAN failover is easy to setup using Gateway group(s) and PBR through the Firewall rules.
AFAIK, Suckhub doesn't use PPPoE for their residential FTTH. You do need to take note that they deliver IPTV through port 2 on the ONT and it's VLAN tagged traffic (VID 1091 when I did the setup for a customer last month). You don't want to be parsing this through pfSense - let VLAN capable switches handle this or just directly port it to the outlet that the STB will connect to.
Supermicro is distributed by Taknet here. They do have the SYS-E200-9B but it will set you back a pretty penny - I just deployed one unit for my customer to run pfSense with dual WAN.
The system with 4GB of RAM, a 120GB mSATA SSD, and 3 years NBD on-site hardware replacement is over S$1000. That's just the hardware and doesn't include any delivery or services of any sort.You don't need HAVP if you are running SQUID. SQUID 3 already includes the option for scanning - however, I'd still recommend using a decent antivirus instead. Sophos Home is free and allows you to manage up to 10 devices remotely using the online dashboard.
Honestly, I wouldn't bother running SQUID with connections as fast as we get here unless there is a need to filter websites.There is no need to install any special DNS packages. pfSense already allows you to setup multiple DNS servers and comes with DNS Resolver activated by default. In fact, setting up multiple DNS servers is actually a requirement to run multi-WAN (at least 1 per WAN connection). I'd highly recommend using OpenDNS and/ or Google DNS - lest Suckhub's DNS servers get DDoS into oblivion again.