Hardware suggestions
-
I really would like to have the wifi devices in their own zone and control their behaviour that's why I liked the idea of an included wifi card. Unfortunatelly my box only has 2 RJ45 interfaces so there is none to connect an AP to.
How do USB interface cards behave under FreeBSD 10.3, would that be an option?
Otherwise which linux fw distribution would anyone recommend, from what I read they're all pretty hungry performancewise.Thanks
Nana
-
Just get a switch that supports VLANs.
Putting the wifi physically on your router is not great for a lot of reasons. You will have much better performance using a separate AP for wifi, whether you use pfSense or not.
Just plug your modem into one port and plug a VLAN capable switch into the other port.
Then plug your AP and whatever else into your switch.
You can get web managed switches starting at around $25 these days.
https://www.amazon.com/TP-Link-Gigabit-Ethernet-Managed-TL-SG108E/dp/B00N0OHEMA?th=1
-
Hardware-wise, you might just as well get one of those cheap intel-based router platforms you get from china. Comes with a wall-mountable chassis, multiple Intel NIC's, DDR3L, SSD support and uses very little power (and is of course fanless). I think most of them are derived from industrial PC's, but even then, they are ideal for small scale or home setups.
https://qotom.aliexpress.com/store/108231
-
I might be mistaken here but maybe someone else can confirm. On the gigabyte page it's not stated how many lanes that pcie port has. It needs to be at least pci2 x2 to handle 1gbit and i'm not sure that's simultaneous, in that case it needs to be x4.
-
No, pcie v 2.x+ at x1 speed = 4 gigabits full duplex
-
Yeah I saw the qotom j1900 but decided against that one because 1. no AES-NI for PfSense 2.5 and 2. I made some very bad experiences with buying hardware directly from china so I'm not doing that anymore.
Now I have the hardware that I bought and would of course like to use it. Since it's brand new hardware the support looks pretty grimm in whatever firewall/utm distribution I looked at. This will of course change with time so I might just need to have some patience.
Using a vlan capable hotspot is an idea BUT there are a few reasons which I rather not use wifi at all:
1. VLANs are an organisational feature but not a security feature so I guess it would be better to get a wifi hotspot and a supported usb-rj45 "card"
2. I was trying to keep the energy footprint of my extra hardware as low as possiblemaybe at some point some of those neat china boxes will make their way officially to europe (of course more expensive but still). For now I can at least use pfsense to protect my lan and my wifi devices are stuck in my wan for the time being (serves them right ;) )
-
Those china boxes are sold on amazon too. The j1900 is old, they sell Core i3 4th gen and Celeron based (all with AES-NI) boxes with Intel NIC's as well. TDP around 15w.
i.e.: https://www.amazon.co.uk/Qotom-Q330G4-Industrial-Fanless-Mini-Storage/dp/B06Y5ZGQJ4/ref=sr_1_1?s=computers&ie=UTF8&qid=1494942008&sr=1-1&keywords=Q330G4
-
What makes you say VLAN isn't a security feature?
Also, NICs consume power too. PRO/1000 consumes a lot. ixxx series are much more efficient.
-
PRO/1000 also gets reasonably hot. If you stick 4 or more of them in a small box you'll need airflow because otherwise the combined head of the motherboard chips, CPU and NICs will ramp up pretty quick.
-
-2 NICs (of course ;) )
The SG-1000 or SG-2220 unit from the pfSense store would be nice matching too!
-my speed requirements are pretty low, my WAN is only 100/40 and of course there will be wifi but again that'll be below 1GBIT/s
Can please clarify what is exactly "below 1 GBit/s"
–"cheap"
Is 200 Euro - 300 Euro ok?
- APU2C4 bundle
- mSATA 30/60/120 GB
- UBNT SR71-E or Compex WLE200NX
- Antennas & Pigtails
- Console cable & USB > Serial adapter
-
What makes you say VLAN isn't a security feature?
Because it's a management feature. It's basically just 'more network domains'. Instead of only having one physical network and one logical network you have many logical networks. While more networks could be used as part of a more secure network setup, they are not 'more' secure by themselves. VLAN technology isn't only implemented using 802.1q, there are other tagging and segmentation technologies out there.
-
@johnkeates:
What makes you say VLAN isn't a security feature?
Because it's a management feature. It's basically just 'more network domains'. Instead of only having one physical network and one logical network you have many logical networks. While more networks could be used as part of a more secure network setup, they are not 'more' secure by themselves.
I agree with the above.
But:
Vlans make (L2 separation) easier & cheaper to implement , and therefore i would say it would be "more probable" to be implemented. And a proper L2 separation would make your network less error prone , both from a broadcast domain perspective , and an "infection" perspective. Especially the latter would count as better security in my book.
Besides it would prob. make the fw rules easier to implement. , less complexity is more secure.@johnkeates:
VLAN technology isn't only implemented using 802.1q, there are other tagging and segmentation technologies out there.
If you want vendor interoperapability .1q would be the only one to use.
I have only ever used ie. Cisco ISL , until .1q was a standard. And nowadays you can't even chose ISL in the newer switches.
Now: If pfsense (BSD) would be made fully VRF aware .. Yummy ….. ;)
-
@johnkeates:
Those china boxes are sold on amazon too. The j1900 is old, they sell Core i3 4th gen and Celeron based (all with AES-NI) boxes with Intel NIC's as well. TDP around 15w.
i.e.: https://www.amazon.co.uk/Qotom-Q330G4-Industrial-Fanless-Mini-Storage/dp/B06Y5ZGQJ4/ref=sr_1_1?s=computers&ie=UTF8&qid=1494942008&sr=1-1&keywords=Q330G4
My 330G4 arrived today and pfsense says that NIC 1 is igb0, NIC 2 is igb2, NIC 3 is igb3, doesn't see NIC four and as you can tell it is "missing" igb1. Not happy and not sure what to do.
-
I am sorry to hear that a nic is not working on your new Qotom. Is it a case that no driver for the nic?
Curious to know if it is listed at all in
pciconf -lvc
-
I am sorry to hear that a nic is not working on your new Qotom. Is it a case that no driver for the nic?
Curious to know if it is listed at all in
pciconf -lvc
Well the funny thing is that I have a couple other people telling me they have the same box without issue, but then also said they are not using all four interfaces on the card. I can plug an active cat5 into all four interfaces and will show the status lights. When I am in pfsense in the CLI and I choose to assign interfaces all four show yet they identify wrong and during the assignment as well if I choose auto then it doesn't see the fourth interface. For grins in the next day or so I am going to try installing Ubuntu on it and Windows 10 for verification for usability for each interface. It could be a pfsense bug or something. I need all four ports so it is important for me to figure it out quickly before my return time expires.
-
I installed Windows 10 and also Ubuntu on my QOTOM-Q330G4 today. I confirmed that they must have performed a defective manufacturing job on the motherboard. So in a nutshell I was able to confirm that they somehow managed to swap Int 2 and 4 on the board so that explains the behavior that I am seeing:
Int 1 –-> ibg0
Int 2 ---> ibg2
Int 3 ---> ibg3
Int 4 ---> ibg1I would contact the seller on Amazon and see about submitting return, but this is the 2nd Qotom box that I have bought in the past month. With them having to ship from/to China it becomes a PITA and then I would have to wait another week or two before I could get my new setup running which would not be good seeing as how I am already a few weeks behind. I am almost out of return time with my Ubiquiti AC Pro from MicroCenter and really need to get my openVPN squared away for work. It sucks, but I guess that I am just going to deal with it being messed up.
-
That's not a fault …. It's a QOTOM "feature" ;)
Mac Phys port BSD name ----------------------------- xx6F 1 igb0 xx70 4 igb1 xx71 2 igb2 xx72 3 igb3That's the layout on my i5 , and a lot of other people reports the same "swap".
Now that you know it, you can just cable accordingly.If it were linux you could swap the ifname vs mac-addr , i don't know if you can on FreeBSD.
But i don't see it as a problem , just a minor inconvenience./Bingo
