What are people using as there pfsense firewall/router?
-
@bingo600 said in What are people using as there pfsense firewall/router?:
@work
I'll "inherit" 4 x Cisco 9300 in Q1 2021I've managed to get an unused Cisco 2960x 24 port POE switch FOC.
Looking at flood the rooms with ethernet at some point.
Andy
1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22
-
@johnpoz I was going to ask if there was a paypal donation link for PFSense or something like that for home users, or people who bring their own device for pfsense, like me. I would gladly and quite happily donate $100.00 per year to pfsense directly.
If that's not in the cards and you say FreeBSD donation is good enough for Netgate - then until I need another hardware device I can send that $100 to FreeBSD instead?
Why not bring back the $100.00 Gold "donation", make it voluntary, do not give anything more for it. The donation or $100 a year gold should be for us users to show our appreciation for both the software and the experience that is given freely when ever we have issues or questions. I download, install and use PFSense and have been doing that for the past what 5-6 years? I've learned shitloads from this community and not one person has ever made me feel like an idiot (on purpose that is...:-). NOT all open source communities are as friendly or responsive as this one. That's worth more than $100 a year, but it's what i can afford...sigh...
-
This post is deleted! -
@nogbadthebad said in What are people using as there pfsense firewall/router?:
I've managed to get an unused Cisco 2960x 24 port POE switch FOC.
Looking at flood the rooms with ethernet at some point.
Watch out for power usage , those guyzz often use a lot of "Idle power" due to the 370 W PoE capability , and the fans are not "silent".
I went (at home) for a fanless D-Link DGS-1210-24 , and a fanless DGS-1210-10P (PoE).
I have also used the fanless DGS-1100-08P (PoE) (cheap)/Bingo
-
@johnpoz said in What are people using as there pfsense firewall/router?:
I would guess, all 3 of my AP together prob cost me $1 a month or something to run.
Same. I have three Unifi AP-AC-LR WAP's.
I have a Kill-A-Watt but I have never even bothered measuring them, as I can't imagine typical power use is noteworthy.
-
@hintslara82 said in What are people using as there pfsense firewall/router?:
I've been running my pfsense box from an old computer and I'm considering to get maybe a smaller unit or a rackmount unit which uses less power.
What are people using these days are the watchguard red boxes still any good.
Almost four years ago now, I built myself a pfSense box with one of those beefy little newly launched Kaby Lake i3-7100's:
Here is what I paid at the time (pricing for something similar will of course be lower today)
Intel Core i3-7100 ($119.96 w. Prime)
ASRock H270M-ITX/ac Mini-ITX motherboard with dual Intel NIC's ($96.98)
Crucial 8GB (2x4GB) DDR4-2133 kit ($55.49 w. Prime)
BiWin 60GB M.2 Sata SSD ($40.98)
PicoPSU-80 + 60W Adapter Power Kit ($35)
M350 Universal Mini-ITX enclosure ($39.95)
Molex to P4 power adapter ($4.95)Some notes:
1.) The i3-7100 is complete overkill. I got it because I wanted good OpenVPN performance (I funnel my entire network through a VPN at the firewall). With AES-NI optimizations enabled, I am able to hit over 600Mbps over VPN with only 10-15% CPU use, likely limited on the remote end.
2.) I started with the M350 case from Mini-Box. It is a fantastic tiny little case. The Intel box cooler just BARELY fits inside.
3.) The RAM is also overkill. I wanted to take advantage of both channels, as I was unaware of how much OpenVPN hits the RAM bandwidth, and I couldn't find any DDR4 modules smaller than 4GB.
4.) I used the Pico-PSU from mini box as for a low power drawing system like this, it will be much more efficient at the wall. With pfsense "HiDaptive" power settings, I measure 8w at the wall at idle, where is where this thing spends most of its life. If I ever load it up (which seems unlikely) I have measured a high of 46W using a mprime load test in linux. This is the PSU kit I used. it doesn't have a 12v power connector, so I needed to pick up a molex to motherboard 12V adapter for it. (normally I don't trust adapters, but with how low power this thing uses, it is safe)
5.) A few months ago I moved, and finally have enough space for a rack, so I bought one. Once I had a rack, I - of course - wanted a rack mountable case for the pfSense box, so I transplanted the thing out of the M350 case into an iStar USA 2U rackmountable case I got on sale at Newegg.
6.) I also had a spare Intel x520 dual SFP+ 10Gig NIC kicking around, so for shits and giggles I threw it in there. Seems to perform well, but I doubt it really adds any real value, considering my WAN speed is "only" gigabit.
7.) Since then I have also hacked together dual power supplies for the thing using another PicoPSU and one of these. It's totally a hack, and I was really just curious if it would work, and it does, and it is surprisingly rock solid. I can now have the pfSense router/firewall hooked up to both my UPS:es so it stays up until the last one goes down in case of a power outage, which is nice.
Figured I'd share my slightly unorthodox setup for your consideration to show that these things come in many sizes and shapes.
I love my setup, but it is not for everyone.
YMMV.
-
I have the following
HP Elite 8200 Intel Core i5-2400 X4 3.1GHz
16GB Ram
250gb ssd
HP 593743-001 NC365T 4-Port ETHERNET NIC Card -
Like @johnpoz I also run a Netgate SG-4860 at home. At work I've got 2x Netgate SG-8860 boxes.
Jeff
-
I like the Pico-PSU's , but prefer the "Red WI" (Wide input)
That way i can use Laptop PSU's for feeding it (Lenovo , Toshiba etc).
Laptop switchers , usually last a long time , and are less noisy (DC wise), than normal "China" 12v switchers.And are easily "begged" from the IT-Dept's scrap heap ....
How did you implement the dual PSU stuff ?
Is that "magic" happening in the "black box" that the PicoPSU's are connected to ?Did that "black box" come with the chassis ?
/Bingo -
@bingo600 said in What are people using as there pfsense firewall/router?:
How did you implement the dual PSU stuff ?
Is that "magic" happening in the "black box" that the PicoPSU's are connected to ?Yep, it happens in the "black box".
It is a consumer Phanteks product.
http://www.phanteks.com/PH-PWCOB.html
I bought it from Amazon here:
https://www.amazon.com/Phanteks-combine-Redundant-Function-PH-PWCOB_2P1M/dp/B01E9YMX4I/It is unclear to me exactly what it does. It was marketed as a way for people to combine two consumer power supplies for higher output, but as long as you don't need to connect any devices (like drives, etc, which I didn't because mine uses an M.2 drive) it seems to work well as a redundancy solution.
Goes without saying, it is by no means "enterprise level validated" but it has worked really well for me. it was a nice way to get the firewall to take power from both of my PSU's for both servers, and thus stay up until the last one goes down, in case of an outage.
There are some negative reviews where people have melted or set the thing on fire, but from what I can tell, this is because they disregarded the max rating of the thing (1170W) and connected two big power supplies together.
-
@bingo600 said in What are people using as there pfsense firewall/router?:
I like the Pico-PSU's , but prefer the "Red WI" (Wide input)
I hadnt heard of these "Red Wi" units before. I will have to look them up.
I'm guessing the big difference there is that they take the (typically) 19VDC laptop chargers, and pull that down to 12V instead of using a 12VDC AC adapter?
-
See here
https://www.mini-box.com/DC-DC -
Last year I purchased two watchguard XTM 520 firewalls on ebay to use as my primary gateway and a backup firewall gateway for a new server rack in my home office. I also purchased two used Pentium Xeon cpu's as upgrades for it. I managed to install pfsense 2.4.4 community edition on them using some videos on youtube. They sat idle and unused in my server rack until my existing ZyWALL 310 firewall started to act all screwy on me. I purchased the ZyWALL three years ago for about $1000. It was more than I wanted to pay and I hated the software interface and the fact that I had to continue to fork out money for things that are already included in pfsense. That is the reason I decide to switch to pfsense in the first place.....cost was lower. So earlier this week the ZyWALL started to freeze up on me and I scrambled to pull one of the old watchguard xtm 520 from the new rack and put it into my old rack. For the record I work in software engineering from home and so my home office is my primary work place. I need reliable internet and reliable firewalling all the time. To complete my story I managed to upgrade the firmware on the ZyWALL 310 and stabilize it for now. But I vowed to never again find myself in such a precarious position so I promptly started to work on configuring the backup watchguard unit to backup the zywall. During my testing I was shocked at how fast pfsense was. The interface was quick and snappy but the performance of the switching is what really impressed me. It ran circles around the zywall despite the fact that the latter has a 6 core mips cpu and the watchguard a dual core pentium xeon. I am about ready to move over to the watchguard xtm 520 as my permanent firewall in a week or so. Right now I don't VPN into my home office network but if I ever needed to I would seriously just go buy a netgate XG-1541 appliance. For a small to medium sized business the price to performance of a netgate appliance is superb.
-
I recently bought a Qotom Q350G4 4200U mini PC, with i5 CPU, 4 GB memory, 64 GB SSD and 4 Ethernet ports.
-
I am very happy with my SG-1100. I have been running it for about nine months. Before that I was using an old PC and didnāt realize that itās built-in Ethernet port was only 100Base-T and therefore throttling my ISPās speed.
I have not seen any performance degradation that would lead me to believe that the SG-1100 is overloaded. Some of the other posters have mentioned their SG-2100 and SG-3100 appliances, but even those may be overkill for a home network. Mine got a pretty good workout with two to three of my kids doing Zooms concurrently, when schools were still on a hybrid model. There was never any slowdown for anything else, either.
-
@dominikhoffmann said in What are people using as there pfsense firewall/router?:
even those may be overkill for a home network
While I agree with you to a point, depends on what your "home" internet speeds are.. While I believe the sg1100 would suite many a home user for sure.. Prob not going to cut it if your on gig/gig home internet connection. Which is becoming more an more popular.
What is your isp plan you are paying for X/Y down/up in mbps? Just curious..
I would be first to admit my 4860 is a bit overkill for my 500/50 connection.. That might not always be my plan.. I am waiting for 1000/1000 for sure, and I like having the multiple physical interfaces because I have many local networks that I route between.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
i5-3470 with 8GB of RAM and 3 ethernet interfaces for my 100/6 service.
-
@johnpoz said in What are people using as there pfsense firewall/router?:
I am waiting for 1000/1000 for sure, and I like having the multiple physical interfaces because I have many local networks that I route between.
I have seen over 800 Mb down on my 500/20 connection, with my Qotom computer & CLI speedtest. Here's the best I've done using a browser, on a computer behind pfsense. I never saw anything close to that with the old HP computer I had been using.
-
@johnpoz: I have a 75/75 for $90/mo, and I just measured 65/72. When the āpandemicā started they took speed caps off for all customers without charging any extra, until the 2020 spring semester ended and did that again starting in the late fall. I saw speeds in the 400s both up and down. Alas, they are back to normal.
Where it would matter would be, if I had the desire to achieve LAN-like speeds between sites, for file server access. I donāt really have such applications. I do do cloud backups, but those are bottlenecked at the server end, anyway.
Should the need for higher throughput arise, I would love to be able to borrow an SG-2100 or SG-3100 to see, whether those would improve it. Not sure, whether Netgate could accommodate that.
