Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PC Engines apu2 experiences

    Scheduled Pinned Locked Moved Hardware
    711 Posts 73 Posters 902.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      daemonix
      last edited by

      fast-io
      sndbuf 524288
      rcvbuf 524288

      added this, changed my PIA client to GCM (my server was already GCM) and I already had just the hardware acceleration only...
      Gone from 45-sih mbit to 70-70mbit in both PIA and my server!!!

      1 Reply Last reply Reply Quote 0
      • K
        kevindd992002
        last edited by

        @Qinn said in PC Engines apu2 experiences:

        https://pcengines.github.io/

        Does this mean that "AES-NI CPU-based acceleration" is better than the "AES-NI and BSD Crypto Device" option? I'm still confused what the difference between those two are.

        fireodoF 1 Reply Last reply Reply Quote 0
        • fireodoF
          fireodo @kevindd992002
          last edited by

          @kevindd992002 said in PC Engines apu2 experiences:

          Does this mean that "AES-NI CPU-based acceleration" is better than the "AES-NI and BSD Crypto Device" option? I'm still confused what the difference between those two are.

          Yes! The Apu2 does not have a dedicated Crypto-Device, the Crypto-Functions are integrated in the CPU (much faster). IMHO

          Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
          SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
          pfsense 2.8.0 CE
          Packages: Apcupsd, Cron, Iftop, Iperf, LCDproc, Nmap, pfBlockerNG, RRD_Summary, Shellcmd, Snort, Speedtest, System_Patches.

          K 1 Reply Last reply Reply Quote 0
          • K
            kevindd992002 @fireodo
            last edited by

            @fireodo said in PC Engines apu2 experiences:

            @kevindd992002 said in PC Engines apu2 experiences:

            Does this mean that "AES-NI CPU-based acceleration" is better than the "AES-NI and BSD Crypto Device" option? I'm still confused what the difference between those two are.

            Yes! The Apu2 does not have a dedicated Crypto-Device, the Crypto-Functions are integrated in the CPU (much faster). IMHO

            I see. But won't it use AES-NI anyway if the latter option is selected?

            Also, in the OpenVPN settings you should chhose None in the Hardware Acceleration field, correct?

            fireodoF 1 Reply Last reply Reply Quote 0
            • fireodoF
              fireodo @kevindd992002
              last edited by

              @kevindd992002 said in PC Engines apu2 experiences:

              I see. But won't it use AES-NI anyway if the latter option is selected?

              Freebsd will look for the Crypto-Device wich is not existent and will not fallback to AES-NI CPU based.

              Also, in the OpenVPN settings you should chhose None in the Hardware Acceleration field, correct?

              I admit I dont know. Sorry.

              Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
              SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
              pfsense 2.8.0 CE
              Packages: Apcupsd, Cron, Iftop, Iperf, LCDproc, Nmap, pfBlockerNG, RRD_Summary, Shellcmd, Snort, Speedtest, System_Patches.

              D 1 Reply Last reply Reply Quote 1
              • D
                daemonix @fireodo
                last edited by

                @fireodo said in PC Engines apu2 experiences:

                @kevindd992002 said in PC Engines apu2 experiences:

                I see. But won't it use AES-NI anyway if the latter option is selected?

                Freebsd will look for the Crypto-Device wich is not existent and will not fallback to AES-NI CPU based.

                Also, in the OpenVPN settings you should chhose None in the Hardware Acceleration field, correct?

                I admit I dont know. Sorry.

                Yes this is it. I did all the possible test combinations.
                Indeed ONLY AES-NI should be selected

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Yes, the only thing to avoid here is enabling both aes-ni and bsd crypto. Doing that will cause the aes device to register for crypto acceleration via the framework which adds a load of additional steps. It's much faster to use the available CPU instructions directly. As long as it's enabled in the BIOS openssl, and hence openvpn, should use aes-ni.

                  Steve

                  QinnQ 1 Reply Last reply Reply Quote 0
                  • QinnQ
                    Qinn @stephenw10
                    last edited by

                    @stephenw10 said in PC Engines apu2 experiences:

                    Yes, the only thing to avoid here is enabling both aes-ni and bsd crypto. Doing that will cause the aes device to register for crypto acceleration via the framework which adds a load of additional steps. It's much faster to use the available CPU instructions directly. As long as it's enabled in the BIOS openssl, and hence openvpn, should use aes-ni.

                    Steve

                    So you have to select AES-NI in pfSense and not in OpenVPN, then why is this option (Hardware crypto) present in OpenVPN config within pfSense? Could you please clarify this?

                    Cheers Qinn

                    Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                    Firmware: Latest-stable-pfSense CE (amd64)
                    Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      I have personally never used that setting. But I have also never had a device with a specifically supported hardware crypto device which is where I would expect it to apply.
                      In testing I did when we went to OpenVPN 2.4 it was better to leave that set to None in every case.

                      Steve

                      QinnQ jahonixJ 2 Replies Last reply Reply Quote 2
                      • QinnQ
                        Qinn @stephenw10
                        last edited by

                        @stephenw10 kudos for clearing that one up!

                        Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                        Firmware: Latest-stable-pfSense CE (amd64)
                        Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                        1 Reply Last reply Reply Quote 0
                        • jahonixJ
                          jahonix @stephenw10
                          last edited by

                          @stephenw10 said in PC Engines apu2 experiences:

                          But I have also never had a device with a specifically supported hardware crypto device which ...

                          Don't want to crush this topic (and can't PM you) but lemme ask how far crypto in the SG-1100 has come? Last thing I know is that HW is present and waits for the software to follow. Anything changed in this regard?

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            That is still basically the status. I'm not sure how far along that work is, I did see some discussion of it a few days ago.

                            But that's a good point. On the SG-3100 where the crypto hardware is supported via the CESA driver I am currently running with BSD Crypto device set in both OpenVPN and as the system crypto device.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • QinnQ
                              Qinn
                              last edited by Qinn

                              Although it is not downloadable at the moment, did anyone tried the new v4.10.0.0?

                              https://pcengines.github.io/
                              

                              Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                              Firmware: Latest-stable-pfSense CE (amd64)
                              Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                              fireodoF 1 Reply Last reply Reply Quote 0
                              • fireodoF
                                fireodo @Qinn
                                last edited by

                                @Qinn said in PC Engines apu2 experiences:

                                Although it is not downloadable at the moment, did anyone tried the new v4.10.0.0?

                                https://pcengines.github.io/
                                

                                There isnt any 4.10.0.0 version - look here:
                                https://3mdeb.com/open-source-firmware/pcengines/

                                Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
                                SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
                                pfsense 2.8.0 CE
                                Packages: Apcupsd, Cron, Iftop, Iperf, LCDproc, Nmap, pfBlockerNG, RRD_Summary, Shellcmd, Snort, Speedtest, System_Patches.

                                1 Reply Last reply Reply Quote 0
                                • VeldkornetV
                                  Veldkornet
                                  last edited by Veldkornet

                                  Here it is: https://pcengines.github.io/#mr-25

                                  v4.10.0.0
                                  
                                  Release date: '2019-08-09'
                                  
                                  Fixed/added:
                                  - rebased with official coreboot repository commit 2a20d13
                                  - enable basic ACPI support for GPIOs
                                  
                                  fireodoF 1 Reply Last reply Reply Quote 0
                                  • fireodoF
                                    fireodo @Veldkornet
                                    last edited by

                                    @Veldkornet said in PC Engines apu2 experiences:

                                    Here it is: https://pcengines.github.io/#mr-25

                                    v4.10.0.0
                                    
                                    Release date: '2019-08-09'
                                    
                                    Fixed/added:
                                    - rebased with official coreboot repository commit 2a20d13
                                    - enable basic ACPI support for GPIOs
                                    

                                    Have you download it?

                                    Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
                                    SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
                                    pfsense 2.8.0 CE
                                    Packages: Apcupsd, Cron, Iftop, Iperf, LCDproc, Nmap, pfBlockerNG, RRD_Summary, Shellcmd, Snort, Speedtest, System_Patches.

                                    K 1 Reply Last reply Reply Quote 0
                                    • K
                                      kevindd992002 @fireodo
                                      last edited by kevindd992002

                                      Do you guys have any issues with the download links for v4.10.0.0? They're all "404 page not found" for me. Or were they removed intentionally?

                                      QinnQ 1 Reply Last reply Reply Quote 0
                                      • QinnQ
                                        Qinn @kevindd992002
                                        last edited by Qinn

                                        @kevindd992002 Yes, I don't think it's build

                                        https://github.com/pcengines/coreboot/compare/v4.9.0.7...v4.10.0.0
                                        

                                        Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                        Firmware: Latest-stable-pfSense CE (amd64)
                                        Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          psp
                                          last edited by

                                          Just updated. Link is properly working. No issues so far.

                                          fireodoF QinnQ 2 Replies Last reply Reply Quote 1
                                          • fireodoF
                                            fireodo @psp
                                            last edited by

                                            @psp said in PC Engines apu2 experiences:

                                            Just updated. Link is properly working. No issues so far.

                                            Thanks!

                                            Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
                                            SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
                                            pfsense 2.8.0 CE
                                            Packages: Apcupsd, Cron, Iftop, Iperf, LCDproc, Nmap, pfBlockerNG, RRD_Summary, Shellcmd, Snort, Speedtest, System_Patches.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.