What are people using as there pfsense firewall/router?
-
I am using Cisco UCS C210 M2 with 2x x5650 CPUs and 24 GB RAM... In there are also 2x Broadcom 57810 dual port 10G adapters, with every port on different VLAN, no LAGG, Tagging etc... All VLAN stuff is dedicated to Cisco Nexus 6000 :)
-
@kartoff said in What are people using as there pfsense firewall/router?:
I am using Cisco UCS C210 M2 with 2x x5650 CPUs and 24 GB RAM... In there are also 2x Broadcom 57810 dual port 10G adapters, with every port on different VLAN, no LAGG, Tagging etc... All VLAN stuff is dedicated to Cisco Nexus 6000 :)
Outchh ...
Do you have free electricity ?/Bingo
-
Your running pfsense on one of these?
That is nuts! ;)
How much power does that thing use??
Are you running pfsense as VM on that beast.. I couldn't see using that as a firewall/router.. Its a beast.. Old sure - but those things are beasts!!
Thing must use like 150W idle..
-
I used to have free electricity before, but now I don't :( Maybe because of that I still have no habit to pay attention to consumption...
As @johnpoz suggested UCS consumption is about 150w-200w according to CIMC where I can't login now because it require flash which is deprecated now...
But consumption of UCS is less than half of what Nexus switch consume :N6K-C6001-64P# sh env pow in
Power Supply Input:
PS Voltage Current Power Status
(Volt) (Amp) (Watt)1 224.50 1.04 233.27 ok
2 224.00 1.16 259.00 okTotal: 492.27N6K-C6001-64P#
As you see switch consume 500w of power
Depends of point of view UCS C210 is a beast, but also not :) For now it do the trick, but I already considering buying something with LGA2011 and PCI-E Gen3
pfSense run on bare metal, no VM...
I want to try TNSR because it can handle much more traffic and that's why I may need new hardware according to requirements...
BTW I will be happy if pfSense start using VPP DPDK etc... in the future because this will enhance performance of existing hardware significantly :):Edit:
I manage to get in CIMC :
login-to-view -
Haha - I am good ;) hehehe
Talk about calling it pretty damn close..
I am all for enterprise gear.. In the enterprise where cost of electric is a very minor concern.. The only concern we ever had with power was that we had enough.. And if we didn't we put in more..
Thing prob sounds like small plane taxi on the runway with the fans in that thing alone..
-
@work
I'll "inherit" 4 x Cisco 9300 in Q1 2021And I just inherited a "free" HP-DLP360 G9
Now if i can convince the Boss to get 2 x 10G cards .....10G would be a nice upgrade in the TestLab.
Any suggestion for 10G cards for the HP ??
I'm not experienced w. Enterprise servers (ILO etc)
/Bingo
-
I have a completely overpowered Alienware R4 desktop I am using for pfsense now, my old HP died a couple weeks ago-blown motherboard. The Alienware has a 4790 CPU and 16 GB of ram.
I have never seen the CPU go over 6% and never seen the RAM usage over 20%.When this PC running pfsense dies I fully intend on getting the SG3100 or equivalent at minimum from negate. I may even go for something a bit beefier if I upgrade to GB internet by then - I prefer overpowered to "just what's needed" or (gasp) under-powered.
If you run old PC hardware and "free" PFSense I encourage you to pay for a snort subscription at minimum to support Netgate's efforts.
-
@1of1000quadrillion said in What are people using as there pfsense firewall/router?:
pay for a snort subscription at minimum to support Netgate's efforts.
Huh?? You mean a support subscription from netgate? The $30/year rule subscription doesn't support netgate or pfsense that I am aware of..
Where did you see that the rule subscription supports netgate?
-
Srry man, I didn't..I just assumed that since snort was added on to pfsense that the subscription fee or a portion of it went to netgate...is this not true?
-
No I don't see how it could.. If it did I would think they would announce that somewhere.
The best way to support netgate is either buy an appliance, or get a support contract.. Or both ;) But the tac support is a $400 a year.. So it not something your typical home user would get.
Kind of shame they got rid of the 100$ a year gold - which was a way to support..
-
@1of1000quadrillion said in What are people using as there pfsense firewall/router?:
Srry man, I didn't..I just assumed that since snort was added on to pfsense that the subscription fee or a portion of it went to netgate...is this not true?
No, none of the Snort rules subscription money goes to Netgate. The money you pay to the Snort team is for their rules only. To support Netgate, and by extension pfSense, you can buy their hardware appliances and/or subscribe to their hardware and software support offerings.
The actual Snort software is 100% free. And there are some free rules, but they all have limitations. Some of the free rule packages don't cover all the identified threats out there, while other free packages only provide you rules after they are 30 days or more old. That means you don't get protection from the most recently identified threats.
-
@1of1000quadrillion same here, I will definitely buy and recommend Netgate hardware in the future. However, I am currently supporting netgate by trying to help the community on these forums the best I can. If I can help answer one question that is less work for them, and time is money :)
-
If you just have desire to send some money somewhere.. You could always donate direct to freebsd.
Since pfsense is using freebsd.. Good stuff that happens to or for freebsd, will trickle down to pfsense..
https://freebsdfoundation.org/donate/
-
@bingo600 said in What are people using as there pfsense firewall/router?:
@work
I'll "inherit" 4 x Cisco 9300 in Q1 2021I've managed to get an unused Cisco 2960x 24 port POE switch FOC.
Looking at flood the rooms with ethernet at some point.
-
@johnpoz I was going to ask if there was a paypal donation link for PFSense or something like that for home users, or people who bring their own device for pfsense, like me. I would gladly and quite happily donate $100.00 per year to pfsense directly.
If that's not in the cards and you say FreeBSD donation is good enough for Netgate - then until I need another hardware device I can send that $100 to FreeBSD instead?
Why not bring back the $100.00 Gold "donation", make it voluntary, do not give anything more for it. The donation or $100 a year gold should be for us users to show our appreciation for both the software and the experience that is given freely when ever we have issues or questions. I download, install and use PFSense and have been doing that for the past what 5-6 years? I've learned shitloads from this community and not one person has ever made me feel like an idiot (on purpose that is...:-). NOT all open source communities are as friendly or responsive as this one. That's worth more than $100 a year, but it's what i can afford...sigh...
-
This post is deleted! -
@nogbadthebad said in What are people using as there pfsense firewall/router?:
I've managed to get an unused Cisco 2960x 24 port POE switch FOC.
Looking at flood the rooms with ethernet at some point.
Watch out for power usage , those guyzz often use a lot of "Idle power" due to the 370 W PoE capability , and the fans are not "silent".
I went (at home) for a fanless D-Link DGS-1210-24 , and a fanless DGS-1210-10P (PoE).
I have also used the fanless DGS-1100-08P (PoE) (cheap)/Bingo
-
@johnpoz said in What are people using as there pfsense firewall/router?:
I would guess, all 3 of my AP together prob cost me $1 a month or something to run.
Same. I have three Unifi AP-AC-LR WAP's.
I have a Kill-A-Watt but I have never even bothered measuring them, as I can't imagine typical power use is noteworthy.
-
@hintslara82 said in What are people using as there pfsense firewall/router?:
I've been running my pfsense box from an old computer and I'm considering to get maybe a smaller unit or a rackmount unit which uses less power.
What are people using these days are the watchguard red boxes still any good.
Almost four years ago now, I built myself a pfSense box with one of those beefy little newly launched Kaby Lake i3-7100's:
Here is what I paid at the time (pricing for something similar will of course be lower today)
Intel Core i3-7100 ($119.96 w. Prime)
ASRock H270M-ITX/ac Mini-ITX motherboard with dual Intel NIC's ($96.98)
Crucial 8GB (2x4GB) DDR4-2133 kit ($55.49 w. Prime)
BiWin 60GB M.2 Sata SSD ($40.98)
PicoPSU-80 + 60W Adapter Power Kit ($35)
M350 Universal Mini-ITX enclosure ($39.95)
Molex to P4 power adapter ($4.95)Some notes:
1.) The i3-7100 is complete overkill. I got it because I wanted good OpenVPN performance (I funnel my entire network through a VPN at the firewall). With AES-NI optimizations enabled, I am able to hit over 600Mbps over VPN with only 10-15% CPU use, likely limited on the remote end.
2.) I started with the M350 case from Mini-Box. It is a fantastic tiny little case. The Intel box cooler just BARELY fits inside.
3.) The RAM is also overkill. I wanted to take advantage of both channels, as I was unaware of how much OpenVPN hits the RAM bandwidth, and I couldn't find any DDR4 modules smaller than 4GB.
4.) I used the Pico-PSU from mini box as for a low power drawing system like this, it will be much more efficient at the wall. With pfsense "HiDaptive" power settings, I measure 8w at the wall at idle, where is where this thing spends most of its life. If I ever load it up (which seems unlikely) I have measured a high of 46W using a mprime load test in linux. This is the PSU kit I used. it doesn't have a 12v power connector, so I needed to pick up a molex to motherboard 12V adapter for it. (normally I don't trust adapters, but with how low power this thing uses, it is safe)
5.) A few months ago I moved, and finally have enough space for a rack, so I bought one. Once I had a rack, I - of course - wanted a rack mountable case for the pfSense box, so I transplanted the thing out of the M350 case into an iStar USA 2U rackmountable case I got on sale at Newegg.
6.) I also had a spare Intel x520 dual SFP+ 10Gig NIC kicking around, so for shits and giggles I threw it in there. Seems to perform well, but I doubt it really adds any real value, considering my WAN speed is "only" gigabit.
7.) Since then I have also hacked together dual power supplies for the thing using another PicoPSU and one of these. It's totally a hack, and I was really just curious if it would work, and it does, and it is surprisingly rock solid. I can now have the pfSense router/firewall hooked up to both my UPS:es so it stays up until the last one goes down in case of a power outage, which is nice.
Figured I'd share my slightly unorthodox setup for your consideration to show that these things come in many sizes and shapes.
I love my setup, but it is not for everyone.
YMMV.
-
I have the following
HP Elite 8200 Intel Core i5-2400 X4 3.1GHz
16GB Ram
250gb ssd
HP 593743-001 NC365T 4-Port ETHERNET NIC Card