Help with hardware build
-
You can absolutely get official hardware that will meet your needs! It will also come with a year of Gold Subscription, official support, and automated backups. Those are very useful things especially if you are looking to really learn pfSense.
In general, you will pay more for less with official hardware than DIY but this is true in just about any market.
You are paying for a guarantee that it will work out of the box and all of the above mentioned features, so if those have value to you then by all means, the pfSense store has excellent products!If you do decide for DIY over official, you can still get a Gold Subscription for $99/yr. you'll get access to the updated pfSense book and all of their monthly hangout videos. Very cool stuff, probably worth checking out even if you only do it for the first year to learn the product!
Heck, if they are half as helpful as you have been, it is well worth the $99…
Thanks for all the info. The DIY option seems like it will be the best. Now to find a nice case and triple check which parts I want.
-
@teh:
Heck, if they are half as helpful as you have been, it is well worth the $99…
Thanks for all the info. The DIY option seems like it will be the best. Now to find a nice case and triple check which parts I want.
haha thanks! I'm glad I could be helpful.
I promise you they are WAY better than me!
-
If I was in your shoes I would get a J3455 ITX board and carefully remove the back wall of the PCIe port, knowing full well that if I screwed it up I would have to buy a new board.
If you are comfortable with voiding the warranty and modifying either the board or the card, or buying the micro-ATX size board then yes I would say J3455 will be better for you as it will give you more headroom to play with packages and figure out what you do and don’t want to use.
Hmm, I might go to the micro-ATX. It will be a bigger case, but at least I won't have to do any modding.
-
@teh:
Hmm, I might go to the micro-ATX. It will be a bigger case, but at least I won't have to do any modding.
Definitely the better choice if you are OK with the size.
One more option I'll throw out is a PCIe riser. You can get a passive PCIe x1 to PCIe x4 riser and it will work fine. The problems with it are that it can be difficult to mount the card in your case with a riser, it just depends on the case and the riser. Also I don't know of any good quality ones to recommend.
I hesitate to even mention this option because if you get a crappy one it could cause issues, just getting the micro-ATX is the most reliable way to go. -
Definitely the better choice if you are OK with the size.
One more option I'll throw out is a PCIe riser. You can get a passive PCIe x1 to PCIe x4 riser and it will work fine. The problems with it are that it can be difficult to mount the card in your case with a riser, it just depends on the case and the riser. Also I don't know of any good quality ones to recommend.
I hesitate to even mention this option because if you get a crappy one it could cause issues, just getting the micro-ATX is the most reliable way to go.Size isn't a huge issue for me. It makes it so I can be lazier about fitting cables :D .
I found a few Intel I350 NICs on eBay, is that the normal place to get them? They seem too cheap and are "refurbished". They do claim to be Intel chips from an OEM…
-
I personally would go for an i340 server pull over a refurb i350 (unless you need SR-IOV or Ethernet Power Management).
That's really just a matter of opinion though, I've read about plenty of people using obvious knockoff i340/i350's with great results. I've bought plenty of things used and refurbished and I've never had an issue.
One thing to watch out for on i350's is that it's an i350v2. Apparently there was some sort of power spike issue on the original and they discontinued it. I don't know how serious the problem is for home use though, probably negligible but I just don't know.
-
I personally would go for an i340 server pull over a refurb i350 (unless you need SR-IOV or Ethernet Power Management).
That's really just a matter of opinion though, I've read about plenty of people using obvious knockoff i340/i350's with great results. I've bought plenty of things used and refurbished and I've never had an issue.
One thing to watch out for on i350's is that it's an i350v2. Apparently there was some sort of power spike issue on the original and they discontinued it. I don't know how serious the problem is for home use though, probably negligible but I just don't know.
I'll have to poke around at the eBay deals. They definitely seem a bit sketchy…. Would any Intel PCIe NIC work?
I was thinking of getting two SSDs for a mirrored ZFS array. Probably overkill, but would help if a disk dies. This means I can't get one of those picoPSUs, since they appear to only have one SATA power cable. Any recommendations for a decent PSU? I assume the lower the wattage, the better, since it starts hurting efficiency at the wattages I am sitting at.
-
Yeah, intel NICs are solid. The three main PCIe NICs for gigabit are in PRO/1000, i340 and i350.
In the quad port configuration at least, the PRO/1000 can consume more power than a J3455, almost three times as much as an i340. i340 also supports virtualization if you ever go that route. Finally, the PRO/1000 is PCIe v 1.0, so if you want to fully utilize a quad port unit you must have a slot at x4 speeds.
For all of those reasons I recommend searching around for a good used i340-t4. You can find them fairly regularly in the $35-$40 range, the best I've seen is I think $25.I personally would say that SSD's in a mirror for home use is totally unnecessary. You will almost certainly not see your SSD fail in the lifetime of the firewall. In the event that it does fail, so long as you have a config.xml backed up, you can reinstall to just about any thumb drive you have lying around and restore your config file. Your machine would be back up in minutes and then you could order a replacement SSD.
However, if you are more comfortable with SSDs in a mirror, then you can still keep the picoPSU, just use a SATA splitter or MOLEX to SATA cable.
https://www.newegg.com/Product/Product.aspx?Item=N82E16812119010
https://www.amazon.com/StarTech-com-Power-Splitter-Adapter-PYO4SATA/dp/B0086OGN9E -
Thanks again for all the info and help pfBasic. You rock!
I haven't hit order just yet, but I settled on these parts:
CPU/Mobo: ASUS Intel Celeron Quad-Core SoC fanless MicroATX Motherboard (J3455M-E)
RAM: Corsair Vengeance 8 GB (2 x 4 GB) DDR3 1600 MHz PC3 12800 240-Pin DDR3 Dual Channel Memory Kit 1.5V
SSD: Kingston Digital 120GB SSDNow V300 SATA 3 2.5 (7mm height) Desktop Bundle Kit with Adapter Solid State Drive SV300S3D7/120G
Case: Thermaltake CORE V21 Black Extreme Micro ATX Cube Chassis CA-1D5-00S1WN-00
PSU: picoPSU-120 + 120W Adapter Power Kit
NIC: Intel i340-T4The case is a bit bigger than I originally thought, but the extra convenience of tons of room, and not having to mod the NIC or motherboard to fir in ITX is a plus. With no fans, I can also just dump that anywhere, it isn't a huge issue as long as it gets some natural airflow.
Edit: Fixed the links because BBcode is basically the worst :P
-
I think that will work out great for you! Please let us know how it goes once you get it up and running and feel free to ask any questions yo may have in the configuration process.
You can definitely use the picoPSU 80(non-WI) with 60W AC/DC Converter kit for that build, you will probably pull less than 30W from the wall under max load on everything.
-
I think that will work out great for you! Please let us know how it goes once you get it up and running and feel free to ask any questions yo may have in the configuration process.
You can definitely use the picoPSU 80(non-WI) with 60W AC/DC Converter kit for that build, you will probably pull less than 30W from the wall under max load on everything.
I just ordered my parts. Managed to get the i340-T4 for ~$35 on eBay. Not too shabby!
Any "standard" benchmarks I should run so I can share info?
-
Congrats!
Maxing out the VPN connection for a little while (Steam downloads and 5k youtube videos are an easy way to do this) with IDS/IPS, packages on/off and posting up your RRD graphs for the time period are very useful!
Also just your general performance in real world day to day usage is valuable for others to know!
There a home brew VPN benchmark on here that seems to be reasonably accurate for some but is by no means definitive. It's still fun to see how different CPUs stack up if nothing else.
https://forum.pfsense.org/index.php?topic=105238.msg616743#msg616743
# openvpn --genkey --secret /tmp/secret# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-128-cbc# time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-128-gcm( 3200 / execution_time_seconds ) = Projected Maximum OpenVPN Performance in Mbps
-
One dumb hardware question for you. Will I use one of the four ports on the Intel NIC as a WAN port and the other three as WAN? Or would I use the onboard NIC as the WAN port and keep the Intel NIC for LAN?
-
The on board NIC for that motherboard (and most motherboards) is a crappy realtek NIC.
You can use that NIC if you need it, they aren't the end of the world they just aren't quality products. I would relegate it to something low priority like a Guest LAN or IOT LAN though. I have my guest LAN running on a cheap WAP with 100Mbps ethernet ports, it was connected to pfSense via a realtek NIC for awhile and there were no issues. Its on intel now but there's no noticeable improvements since I never had any issues.
Definitely use an Intel NIC for your WAN, and for anything you care about performance on.
-
The on board NIC for that motherboard (and most motherboards) is a crappy realtek NIC.
You can use that NIC if you need it, they aren't the end of the world they just aren't quality products. I would relegate it to something low priority like a Guest LAN or IOT LAN though.
Definitely use an Intel NIC for your WAN, and for anything you care about performance on.
Oo, maybe I can turn that into my LAN for my WiFi network…
I will tinker around with it. Now to wait for my parts to get delivered. Everything should be here before the end of the week!
-
The on board NIC for that motherboard (and most motherboards) is a crappy realtek NIC.
You can use that NIC if you need it, they aren't the end of the world they just aren't quality products. I would relegate it to something low priority like a Guest LAN or IOT LAN though. I have my guest LAN running on a cheap WAP with 100Mbps ethernet ports, it was connected to pfSense via a realtek NIC for awhile and there were no issues. Its on intel now but there's no noticeable improvements since I never had any issues.
Definitely use an Intel NIC for your WAN, and for anything you care about performance on.
Actually, to save myself some ports, would the onboard NIC be OK for my DNS server? I was thinking of keeping the Pi-Hole (DNS server / ad-blocker) since it is configured and working well for what I need.
-
I would imagine that it would work fine for that. Some have reported realtek NICs being flaky in general.
I've only ever used one for a few months on a Guest network but had no issues. So I'd say check it out, it will probably work without any problems. If not then you can use Unbound with DNSBL to replace the pi-hole or use an intel NIC.
-
Put stuff together tonight. Looks like I got unlucky with the eBay hardware pull, dmesg is reporting that the NIC is "<intel(r) 1000="" pro="" network="" connection,="" version="" -="" 2.5.3-k="">" instead of an i340… Any reason I should issue a return other than the power usage?
I saw a few people say that using port one as WAN and the other three ports bridged as WAN was not a good idea. Is that old or is that still the case? I think I have a gigabit switch floating around...</intel(r)>
-
@teh:
Put stuff together tonight. Looks like I got unlucky with the eBay hardware pull, dmesg is reporting that the NIC is "<intel(r) 1000="" pro="" network="" connection,="" version="" -="" 2.5.3-k="">" instead of an i340… Any reason I should issue a return other than the power usage?
I saw a few people say that using port one as WAN and the other three ports bridged as WAN was not a good idea. Is that old or is that still the case? I think I have a gigabit switch floating around...</intel(r)>
hmmm, I'm not sure that this is telling you that you have a PRO/1000.
when you run dmesg what driver does it list? if it's "igb" then it's an i340, if it's "em" then it's a PRO/1000.
Also check this output and see what chipset it's using:
pciconf -lv -
hmmm, I'm not sure that this is telling you that you have a PRO/1000.
when you run dmesg what driver does it list? if it's "igb" then it's an i340, if it's "em" then it's a PRO/1000.
Also check this output and see what chipset it's using:
pciconf -lvigb0@pci0:1:0:0: class=0x020000 card=0x12a28086 chip=0x150e8086 rev=0x01 hdr=0x00 vendor = 'Intel Corporation' device = '82580 Gigabit Network Connection' class = network subclass = ethernet