Do Threads Work Like Cores for pfsense?



  • Hi, just a quick question for now, may I know whether the threads in an Intel CPU work like a core too (like how each thread is seen as a virtual CPU in virtualisation hypervisors) and therefore be treated like one for the purpose of pfsense?

    Thanks!



  • In past days it was more a single threaded thing, but now some functions, options packets or
    features are more and more multi-threaded in pfSense, but in the version 3.0 of pfSense I
    would imagine that the most stuff will be really multi-threaded.



  • @BlueKobold:

    In past days it was more a single threaded thing, but now some functions, options packets or
    features are more and more multi-threaded in pfSense, but in the version 3.0 of pfSense I
    would imagine that the most stuff will be really multi-threaded.

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads



  • @darkarn:

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads

    Threads are just a way to improve utilization of a core. It will speed up some workloads, slow down others, and not make any difference at all for many. I'd focus more on single thread performance (MHz) for this application. It may be possible to get a 2 core i3 clocked faster than a 4 core i5, and that would likely perform better for this.



  • @darkarn:

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads

    So…we can't tell you that.  As noted, the core functionality of pfsense is mostly single-threaded.  It's mostly add-on modules and such that can take advantage of multiple cores/threads.  So, the i3 itself having less cores or threads isn't really an issue.  As long as the processor will keep up with the throughput you need, you'll be fine.

    However, how much is enough?  If all you're doing is running pfsense as a router and that's it...not much.  The higher speeds will require a faster processor, not more cores.  If you're adding on packages/functionality, doing VPN services, that will dramatically increase the load and depending on the functionality, it may or may not benefit from more cores or higher processing power/speed.  It just depends.

    To get an estimate you'd need to tell everyone:  1)  the throughputs you want to achieve and how they'd connect(direct, any authentication methods, via VPN....which is hopefully slower than the full throughput) 2)  the number of connections  3)  any special functionality you want to enable such as add ons...and for some add ons, information about how it will be used, as their demands can vary substantially based upon options.



  • @darkarn:

    … for a WAN Gigabit (1GBps up/down) build ...

    Wiil your WAN be PPPoE?



  • @jahonix:

    @darkarn:

    … for a WAN Gigabit (1GBps up/down) build ...

    Wiil your WAN be PPPoE?

    well that's a horrifying thought :D



  • @darkarn:

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads

    If by "work the same" you mean pfsense will see four processors, yes.  But the extra two logical processors won't be as fast as the extra two physical cores in the i5.  But… depending on your workload, pfSense may not care.  In general, though, the i5 will be faster.

    *Edited to restore formatting



  • @whosmatt:

    In general, though, the i5 will be faster.

    It really depends on the workload. The i3's tend to have a higher base frequency because they're dual core and draw less power. For a workload that's not heavily threaded, an i3-6100 @3.7GHz will be faster than an i5-6500 and faster than an i5-6600 if the load is sustained (while costing literally half as much).



  • Wow, thanks for the responses, let me answer as much as I can…

    @VAMike:

    @darkarn:

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads

    Threads are just a way to improve utilization of a core. It will speed up some workloads, slow down others, and not make any difference at all for many. I'd focus more on single thread performance (MHz) for this application. It may be possible to get a 2 core i3 clocked faster than a 4 core i5, and that would likely perform better for this.

    I see, this is actually the crux of the issue; faster i3 with less cores or slightly slower i5 with more cores despite both processors having same number of threads?

    @tullnd:

    @darkarn:

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads

    So…we can't tell you that.  As noted, the core functionality of pfsense is mostly single-threaded.  It's mostly add-on modules and such that can take advantage of multiple cores/threads.  So, the i3 itself having less cores or threads isn't really an issue.  As long as the processor will keep up with the throughput you need, you'll be fine.

    However, how much is enough?  If all you're doing is running pfsense as a router and that's it...not much.  The higher speeds will require a faster processor, not more cores.  If you're adding on packages/functionality, doing VPN services, that will dramatically increase the load and depending on the functionality, it may or may not benefit from more cores or higher processing power/speed.  It just depends.

    To get an estimate you'd need to tell everyone:  1)  the throughputs you want to achieve and how they'd connect(direct, any authentication methods, via VPN....which is hopefully slower than the full throughput) 2)  the number of connections  3)  any special functionality you want to enable such as add ons...and for some add ons, information about how it will be used, as their demands can vary substantially based upon options.

    Ah, sorry, I forgot to put out my requirements, let's see if this is ok:

    1. 5 permanent users (me + family members); need to be able to scale up to 25 users in case of visitors
    2. 20 permanent devices (7 PC/laptops, 13 mobile devices); need to be able to scale up to 50 devices in case of visitors
    3. Undecided on packages due to inexperience with pfSense; pending further evaluation
    4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see: https://www.starhub.com/personal/broadband/dual-broadband-plan/price-plans.html#Dual-Broadband) => Dual WAN features like failover required
    5. Possibility of VPN usage (e.g. outside computer connecting to a certain PC in network)
    6. Possibility of cryptography features if any => AES-NI desired
    7. LAN: 1 8-port TP-Link Smart Switch (TL-SG2008), Wifi: Asus AC66u as Wireless Access Point (connected via Sineoji PL1800EP as it will be placed in a different room for house-wide access)

    @VAMike:

    @jahonix:

    @darkarn:

    … for a WAN Gigabit (1GBps up/down) build ...

    Wiil your WAN be PPPoE?

    well that's a horrifying thought :D

    Good question guys, thankfully it is not (I hope); heard that the requirements are way higher for these connections

    @whosmatt:

    @darkarn:

    Thanks! I am asking as I am planning for a WAN Gigabit (1GBps up/down) build too; I am unsure if an i3 with 2 core and 4 threads will work the same as an i5 with 4 cores and 4 threads

    If by "work the same" you mean pfsense will see four processors, yes.  But the extra two logical processors won't be as fast as the extra two physical cores in the i5.  But… depending on your workload, pfSense may not care.  In general, though, the i5 will be faster.

    *Edited to restore formatting

    Ah I see, so one of the deciding factors is what packages will I be using?

    Sidenote: I wonder if the same applies to virtualisation; this may mean I need to re-plan my NAS-cum-VM-server but that's another thread for another forum I guess?

    @VAMike:

    @whosmatt:

    In general, though, the i5 will be faster.

    It really depends on the workload. The i3's tend to have a higher base frequency because they're dual core and draw less power. For a workload that's not heavily threaded, an i3-6100 @3.7GHz will be faster than an i5-6500 and faster than an i5-6600 if the load is sustained (while costing literally half as much).

    Thanks for the example, that made things a bit clearer



  • One more thing: I decided to come up with the question considering this from https://www.pfsense.org/hardware/ :

    CPU Selection

    The numbers stated in the following sections can be increased slightly for quality NICs, and decreased (possibly substantially) with low quality NICs. All of the following numbers also assume no packages are installed.

    10-20 Mbps We recommend a modern (less than 4 year old) Intel or AMD CPU clocked at at least 500MHz.
    21-100 Mbps We recommend a modern 1.0 GHz Intel or AMD CPU.
    101-500 Mbps No less than a modern Intel or AMD CPU clocked at 2.0 GHz. Server class hardware with PCI-e network adapters, or newer desktop hardware with PCI-e network adapters.
    501+ Mbps Multiple cores at > 2.0GHz are required. Server class hardware with PCI-e network adapters.

    I was unsure whether this refers to threads too, hence this thread (pun unintended. Really! :D )



  • 3. Undecided on packages due to inexperience with pfSense; pending further evaluation
    4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see:

    3. Should be clear before starting or starting with a powerful quad core CPU to be sure then!
    4. Dual or Quad Core CPU @3,0GHz is then the best way to be able to realize it.

    It makes many sense to know before starting if only a pure firewall + VPN connections are in the game
    or a fully sorted UTM device should be in the game play. (firewall & VPN + http-Proxy, IDS,
    AV Scan, pfBlockerNG)



  • @BlueKobold:

    3. Undecided on packages due to inexperience with pfSense; pending further evaluation
    4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see:

    3. Should be clear before starting or starting with a powerful quad core CPU to be sure then!
    4. Dual or Quad Core CPU @3,0GHz is then the best way to be able to realize it.

    It makes many sense to know before starting if only a pure firewall + VPN connections are in the game
    or a fully sorted UTM device should be in the game play. (firewall & VPN + http-Proxy, IDS,
    AV Scan, pfBlockerNG)

    Yep, I am reading up on them now to confirm stuff

    …but I am quite tempted to just get a powerful Quad Core and learn from there! :D (without using too much electrocity I hope)



  • without using too much electrocity I hope)

    That could be reached with ease if you went the road and go with a Intel Xeon E3 CPU! Not
    even the best choice if you are putting even more other single points in that game, but all
    for all it matches at the very best to be better suited with an Intel Core i3, i5 or i7 and let
    you reach also the goal to get 1 GBit/s at the WAN surely! On top you may should get an
    Intel PT Dual or Quad LAN Port NIC to be ensuring from side too, that all will be running
    fine for you.

    Otherwise it could also be the Jetway NF9HG-2930 board that will you bring up to new horizons
    but without a guaranty for the real 1 GBit/s at the WAN port. As an alternative or plain a middle
    based solution you should have a look on that board here, it supports pfSense and is able to get
    real power but also sorted with many ports too! Jetway NF592-Q170 Intel Core Skylake



  • @BlueKobold:

    without using too much electrocity I hope)

    That could be reached with ease if you went the road and go with a Intel Xeon E3 CPU! Not
    even the best choice if you are putting even more other single points in that game, but all
    for all it matches at the very best to be better suited with an Intel Core i3, i5 or i7 and let
    you reach also the goal to get 1 GBit/s at the WAN surely! On top you may should get an
    Intel PT Dual or Quad LAN Port NIC to be ensuring from side too, that all will be running
    fine for you.

    Otherwise it could also be the Jetway NF9HG-2930 board that will you bring up to new horizons
    but without a guaranty for the real 1 GBit/s at the WAN port. As an alternative or plain a middle
    based solution you should have a look on that board here, it supports pfSense and is able to get
    real power but also sorted with many ports too! Jetway NF592-Q170 Intel Core Skylake

    Whoa, Xeons are kinda overkill; I was thinking something more like second hand i5 or i7 CPUs from Sandy Bridge onwards

    I do have an Intel Dual NIC and another Intel Single NIC; I am unsure of their chipsets as they are currently used in my DIY NASes

    And while the Jetway sounds good, I can't ship them back to Singapore (that's where I live) unfortunately I am somewhat wrong about this; see my new post



  • I took a look at packages for pfSense and gotten a rough sensing of what I may need:

    1. Squid
    2. SquidGuard
    3. Darkstat
    4. Snort
    5. HAVP (undecided; I may just stick with the usual antivirus in each PC)
    6. DNS related package; idea is to set my WAN to use multiple DNS servers so that if one DNS provider goes down, others will be used automatically

    Looks like a proper i5 with proper cores may be more for my usage

    As for VPN, seeing that this is mainly for me to connect to my NAS from other computers (or my laptop) in other areas, I will do this on my NAS instead of my router



  • Apparently, I forgot that NewEgg does ship Jetway stuff to Singapore!

    http://www.newegg.com/global/sg/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=Jetway

    The JetWay JNF9HG-2930 and JetWay JNF591-3150 interest me in particular

    Now it's a matter of deciding if going this path is better than building the usual computer



  • @darkarn:

    Apparently, I forgot that NewEgg does ship Jetway stuff to Singapore!

    http://www.newegg.com/global/sg/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=Jetway

    The JetWay JNF9HG-2930 and JetWay JNF591-3150 interest me in particular

    Now it's a matter of deciding if going this path is better than building the usual computer

    N2930 doesn't have AES-NI, so I wouldn't even consider it if you have any interest in VPN or SSL in the future. Otherwise it's a wash.



  • @VAMike:

    @darkarn:

    Apparently, I forgot that NewEgg does ship Jetway stuff to Singapore!

    http://www.newegg.com/global/sg/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=Jetway

    The JetWay JNF9HG-2930 and JetWay JNF591-3150 interest me in particular

    Now it's a matter of deciding if going this path is better than building the usual computer

    N2930 doesn't have AES-NI, so I wouldn't even consider it if you have any interest in VPN or SSL in the future. Otherwise it's a wash.

    Yeah, it's a pity indeed; its 4 Intel NICs (and very new ones!) are indeed a godsend for this price!

    So it's either the 3150 or something else

    Back to the drawing board; there's no Intel NIC on the 3150 :(



  • Looks like a proper i5 with proper cores may be more for my usage

    Jetway NF592-Q170 pending on your budget would this also matching then!

    Yeah, it's a pity indeed; its 4 Intel NICs (and very new ones!) are indeed a godsend for this price!

    Ok, there some differences between you wish and your need or between your need and your budget, or?

    Back to the drawing board; there's no Intel NIC on the 3150

    There are many powerful and small boxes in the wild.

    Whats about your budget??



  • @BlueKobold:

    Looks like a proper i5 with proper cores may be more for my usage

    Jetway NF592-Q170 pending on your budget would this also matching then!

    Yeah, it's a pity indeed; its 4 Intel NICs (and very new ones!) are indeed a godsend for this price!

    Ok, there some differences between you wish and your need or between your need and your budget, or?

    Back to the drawing board; there's no Intel NIC on the 3150

    There are many powerful and small boxes in the wild.

    Whats about your budget??

    Wow thanks for the options, only problem about them is that they don't ship to Singapore directly (except for the E200-9B). This means that I will need to use proxy services which will bump up prices by a bit. Also I will need warranty too.

    I mentioned that it was a pity as there are 4 Intel NICs on that board (which I will need for 2 WANs and 1 LAN; I can use the last port as another LAN I guess) but that the CPU does not have AES-NI, of which I think I should have.

    For my budget, currently I am trying to stick with 500 SGD. I have come up with the following builds based on local prices + what parts do I have left:

    i3-4170
    ASROCKRACK Motherboard H97M WS
    2x 2GB DDR3 RAM (personal)
    SEASONIC S12G-Non MODULAR 450W from PC Themes
    Old Casing (personal)
    Old HDD (personal)
    Single NIC Intel Card (personal)
    Total: 416 SGD

    or

    i3 6100
    ASROCK H110M- ITX/D3
    2x 2GB DDR3 RAM (personal)
    SEASONIC S12G-Non MODULAR 450W from PC Themes
    Old Casing
    Old HDD
    Dual NIC Intel Card (personal)
    Total: 373 SGD



  • For my budget, currently I am trying to stick with 500 SGD.

    Perhaps you should be looking forward and buy the hardware step-by-step!
    ASUS Q87T S$427.20 (SGD)
    Celeron G3260 @3,3GHz ~S$99 (SGD)
    2 x 4 GB RAM DDR3-1600 ~S$82.00 (SGD)
    mSATA 120 GB ~S$89.00 (SGD)
    M350 ~S$116.00 (SGD)

    I got this over www.qoo10.sg and ebay.com.sg all prices are shipping free from the US or Japan



  • @BlueKobold:

    ASUS Q87T S$427.20 (SGD)

    That has one intel and one RTL NIC. That shouldn't matter so much, but is why one of the other platforms was already eliminated. It's a shame that freebsd's history of lousy realtek drivers has lead to writing off most of the low cost boards on the planet.

    Celeron G3260 @3,3GHz ~S$99 (SGD)

    G3260 also doesn't do AES, if he didn't care about that he should just go with the fanless N2930 which is a better fit for purpose. Or at least go with the skylake+aes G3900 or G3920.



  • @BlueKobold:

    For my budget, currently I am trying to stick with 500 SGD.

    Perhaps you should be looking forward and buy the hardware step-by-step!
    ASUS Q87T S$427.20 (SGD)
    Celeron G3260 @3,3GHz ~S$99 (SGD)
    2 x 4 GB RAM DDR3-1600 ~S$82.00 (SGD)
    mSATA 120 GB ~S$89.00 (SGD)
    M350 ~S$116.00 (SGD)

    I got this over www.qoo10.sg and ebay.com.sg all prices are shipping free from the US or Japan

    Hmm. I can find similar motherboards for much cheaper here I am afraid (see my earlier post as example)

    @VAMike:

    @BlueKobold:

    ASUS Q87T S$427.20 (SGD)

    That has one intel and one RTL NIC. That shouldn't matter so much, but is why one of the other platforms was already eliminated. It's a shame that freebsd's history of lousy realtek drivers has lead to writing off most of the low cost boards on the planet.

    Celeron G3260 @3,3GHz ~S$99 (SGD)

    G3260 also doesn't do AES, if he didn't care about that he should just go with the fanless N2930 which is a better fit for purpose. Or at least go with the skylake+aes G3900 or G3920.

    I can get a G4400 that can do AES too. And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]; I may as well just look for motherboards with just one Intel NIC and then get another dual port Intel NIC from Amazon



  • @darkarn:

    And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]

    Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.



  • @VAMike:

    @darkarn:

    And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]

    Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.

    Hmm so in terms of performance, in the context of home usage, are these NICs the same?



  • Hmm. After speaking to some people, I think I will like to hold off the planning for now as Kaby Lake is just next month; I may either use that or at least get Skylake for cheaper

    Meanwhile, let me use a spare XPS 420, one dual port Intel NIC and another single port Intel NIC and see how that goes



  • So far so good, am into my first 24hrs of pfsense now

    The XPS 420's Q6600 (2.40Ghz Quad Core) and 8GB of RAM seems decent but I noticed a slight reduction of net throughput. I have tried some packages but I keep accidentally blocking the entire Internet lol so I decided to remove most of them and then reinstall them on a need-to-use basis (e.g. going with either squid or HAProxy for reverse proxy)

    I noticed that pfsense has a very steep learning curve as compared to other custom router firmwares



  • @darkarn:

    @VAMike:

    @darkarn:

    And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]

    Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.

    Hmm so in terms of performance, in the context of home usage, are these NICs the same?

    Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s with intel desktop LOM from 10 years ago you get 115MB/s, server network interfaces theoretically have lower CPU usage, slightly faster speeds and they of course have more features such as SR-IOV, iSCSI boot and or acceleration, etc.

    You can pick up server pulls nics for cheap on ebay, such as the silicom 6 port intel chipset (no sr-iov fyi) or mellanox-connectx2 - there are a lot of options and not all of them are intel however anything from broadcom or realtek is garbage.

    If you want SRIOV don't buy dell rebrands as they disable that because reasons, and if you want to run it in a vm you want SR-IOV for performance and security (although you need chipset with IOMMU and the like as well, pm me if you want help with finding hardware that works with this)



  • @Taiidan:

    Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s

    That's simply not true, so the rest can be safely ignored.



  • @darkarn:

    Ah, sorry, I forgot to put out my requirements, let's see if this is ok:

    1. 5 permanent users (me + family members); need to be able to scale up to 25 users in case of visitors
    2. 20 permanent devices (7 PC/laptops, 13 mobile devices); need to be able to scale up to 50 devices in case of visitors
    3. Undecided on packages due to inexperience with pfSense; pending further evaluation
    4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see: https://www.starhub.com/personal/broadband/dual-broadband-plan/price-plans.html#Dual-Broadband) => Dual WAN features like failover required
    5. Possibility of VPN usage (e.g. outside computer connecting to a certain PC in network)
    6. Possibility of cryptography features if any => AES-NI desired
    7. LAN: 1 8-port TP-Link Smart Switch (TL-SG2008), Wifi: Asus AC66u as Wireless Access Point (connected via Sineoji PL1800EP as it will be placed in a different room for house-wide access)

    Number of devices doesn't matter as long as your edge devices (access points, switch uplinks etc) can handle the load.

    A Core i5 will easily handle what you need, just get a little more memory (8GB or more depending on the packages you eventually run).
    For reference, I'm using a Pentium G3220 (Haswell Generation Dual Core 3.0GHz) with my ViewQwest 1G connection and it's only loading to about 30% across both cores when I max out my downloads.
    I've previously ran Snort and Suricata (separate occasions) for testing and it still wasn't CPU limited.

    Dual-WAN failover is easy to setup using Gateway group(s) and PBR through the Firewall rules.

    AFAIK, Suckhub doesn't use PPPoE for their residential FTTH. You do need to take note that they deliver IPTV through port 2 on the ONT and it's VLAN tagged traffic (VID 1091 when I did the setup for a customer last month). You don't want to be parsing this through pfSense - let VLAN capable switches handle this or just directly port it to the outlet that the STB will connect to.

    Supermicro is distributed by Taknet here. They do have the SYS-E200-9B but it will set you back a pretty penny - I just deployed one unit for my customer to run pfSense with dual WAN.
    The system with 4GB of RAM, a 120GB mSATA SSD, and 3 years NBD on-site hardware replacement is over S$1000. That's just the hardware and doesn't include any delivery or services of any sort.

    You don't need HAVP if you are running SQUID. SQUID 3 already includes the option for scanning - however, I'd still recommend using a decent antivirus instead. Sophos Home is free and allows you to manage up to 10 devices remotely using the online dashboard.
    Honestly, I wouldn't bother running SQUID with connections as fast as we get here unless there is a need to filter websites.

    There is no need to install any special DNS packages. pfSense already allows you to setup multiple DNS servers and comes with DNS Resolver activated by default. In fact, setting up multiple DNS servers is actually a requirement to run multi-WAN (at least 1 per WAN connection). I'd highly recommend using OpenDNS and/ or Google DNS - lest Suckhub's DNS servers get DDoS into oblivion again.



  • @Taiidan:

    @darkarn:

    @VAMike:

    @darkarn:

    And yeah, too bad that most of the dual-NIC motherboards are just one Intel and one [insert other brand here]

    Most of the newer intel desktop chipsets have an integrated NIC (that's why there are so many intel NICs all of the sudden–they're free; note that this isn't a particularly special NIC, it's functionally identical to a later-model RTL8111.) The second NIC is a discrete component, and in a business where margins are thin the RTL interfaces have a much more attractive price point and most people in the world do not care (since they are functionally equivalent parts). I've heard that freebsd may finally be getting its realtek drivers under control, which would be nice. (Even openbsd hasn't had the stability problems on re(4) that freebsd has.) There's also a driver from realtek itself that some freebsd users have had good success with, but I don't know if anyone's managed to get it to work with pfsense.

    Hmm so in terms of performance, in the context of home usage, are these NICs the same?

    Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s with intel desktop LOM from 10 years ago you get 115MB/s, server network interfaces theoretically have lower CPU usage, slightly faster speeds and they of course have more features such as SR-IOV, iSCSI boot and or acceleration, etc.

    You can pick up server pulls nics for cheap on ebay, such as the silicom 6 port intel chipset (no sr-iov fyi) or mellanox-connectx2 - there are a lot of options and not all of them are intel however anything from broadcom or realtek is garbage.

    If you want SRIOV don't buy dell rebrands as they disable that because reasons, and if you want to run it in a vm you want SR-IOV for performance and security (although you need chipset with IOMMU and the like as well, pm me if you want help with finding hardware that works with this)

    I have heard of SRIOV but I don't think I will need it seeing that after some usage, I prefer pfSense to be by itself and not as a VM

    @VAMike:

    @Taiidan:

    Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s

    That's simply not true, so the rest can be safely ignored.

    Hmm I don't know; I just noticed that an old integrated Atheros NIC can be easily beaten by an Intel NIC on a PCIe card in transferring stuff to and back from a NAS

    @dreamslacker:

    @darkarn:

    Ah, sorry, I forgot to put out my requirements, let's see if this is ok:

    1. 5 permanent users (me + family members); need to be able to scale up to 25 users in case of visitors
    2. 20 permanent devices (7 PC/laptops, 13 mobile devices); need to be able to scale up to 50 devices in case of visitors
    3. Undecided on packages due to inexperience with pfSense; pending further evaluation
    4. Internet Types: 1Gbps up/down fiber internet + 100Mbps up/down cable internet (see: https://www.starhub.com/personal/broadband/dual-broadband-plan/price-plans.html#Dual-Broadband) => Dual WAN features like failover required
    5. Possibility of VPN usage (e.g. outside computer connecting to a certain PC in network)
    6. Possibility of cryptography features if any => AES-NI desired
    7. LAN: 1 8-port TP-Link Smart Switch (TL-SG2008), Wifi: Asus AC66u as Wireless Access Point (connected via Sineoji PL1800EP as it will be placed in a different room for house-wide access)

    Number of devices doesn't matter as long as your edge devices (access points, switch uplinks etc) can handle the load.

    A Core i5 will easily handle what you need, just get a little more memory (8GB or more depending on the packages you eventually run).
    For reference, I'm using a Pentium G3220 (Haswell Generation Dual Core 3.0GHz) with my ViewQwest 1G connection and it's only loading to about 30% across both cores when I max out my downloads.
    I've previously ran Snort and Suricata (separate occasions) for testing and it still wasn't CPU limited.

    Dual-WAN failover is easy to setup using Gateway group(s) and PBR through the Firewall rules.

    AFAIK, Suckhub doesn't use PPPoE for their residential FTTH. You do need to take note that they deliver IPTV through port 2 on the ONT and it's VLAN tagged traffic (VID 1091 when I did the setup for a customer last month). You don't want to be parsing this through pfSense - let VLAN capable switches handle this or just directly port it to the outlet that the STB will connect to.

    Supermicro is distributed by Taknet here. They do have the SYS-E200-9B but it will set you back a pretty penny - I just deployed one unit for my customer to run pfSense with dual WAN.
    The system with 4GB of RAM, a 120GB mSATA SSD, and 3 years NBD on-site hardware replacement is over S$1000. That's just the hardware and doesn't include any delivery or services of any sort.

    You don't need HAVP if you are running SQUID. SQUID 3 already includes the option for scanning - however, I'd still recommend using a decent antivirus instead. Sophos Home is free and allows you to manage up to 10 devices remotely using the online dashboard.
    Honestly, I wouldn't bother running SQUID with connections as fast as we get here unless there is a need to filter websites.

    There is no need to install any special DNS packages. pfSense already allows you to setup multiple DNS servers and comes with DNS Resolver activated by default. In fact, setting up multiple DNS servers is actually a requirement to run multi-WAN (at least 1 per WAN connection). I'd highly recommend using OpenDNS and/ or Google DNS - lest Suckhub's DNS servers get DDoS into oblivion again.

    Wow, nice to see a fellow Singaporean here! Let's see…

    1. Thanks, then I guess my current edge devices are ok for home usage
    2. Hmm my Q6600 is about 12% load at idle... It looks like that an i3 would be sufficient? (I am seeing very interesting deals in Carousell that use i5 though)
    3. I am unsure about Snort and Suricata as of now; I kept accidentally locking my entire home network out of the Internet entirely! I have success with pfBlockerNG though in blocking ads router-side
    4. No worries about the IPTV; my TV and landline are using separate cable modems
    5. Supermicro stuff look really tempting to me too! Too expensive unfortunately... And just wondering, what are you working as?
    6. I just realised that HAVP is not longer available in pfSense. I have also tried SQUID and like what you said, realised that it did not help as the connections are fast enough (and also the websites that me and family members go to are quite diverse anyway). Thanks for recommending Sophos Home, I will take a look at it.
    7. Yep, that DDoS incident was pretty much the last straw. Funny part is, my family is not affected as I have already set up OpenDNS on router-side for years to block out some unwanted websites. I decided to go with pfSense instead of Asus-Merlin to pre-empt situations where OpenDNS will go down, leaving me with no other DNS left. pfSense's ability to use multiple DNSes won me over in this aspect!



  • @darkarn:

    Wow, nice to see a fellow Singaporean here! Let's see…

    1. Thanks, then I guess my current edge devices are ok for home usage
    2. Hmm my Q6600 is about 12% load at idle... It looks like that an i3 would be sufficient? (I am seeing very interesting deals in Carousell that use i5 though)
    3. I am unsure about Snort and Suricata as of now; I kept accidentally locking my entire home network out of the Internet entirely! I have success with pfBlockerNG though in blocking ads router-side
    4. No worries about the IPTV; my TV and landline are using separate cable modems
    5. Supermicro stuff look really tempting to me too! Too expensive unfortunately... And just wondering, what are you working as?
    6. I just realised that HAVP is not longer available in pfSense. I have also tried SQUID and like what you said, realised that it did not help as the connections are fast enough (and also the websites that me and family members go to are quite diverse anyway). Thanks for recommending Sophos Home, I will take a look at it.
    7. Yep, that DDoS incident was pretty much the last straw. Funny part is, my family is not affected as I have already set up OpenDNS on router-side for years to block out some unwanted websites. I decided to go with pfSense instead of Asus-Merlin to pre-empt situations where OpenDNS will go down, leaving me with no other DNS left. pfSense's ability to use multiple DNSes won me over in this aspect!

    1. As long as you are not trying to use powerline adapters. Those things are horrendous in practical use despite the marketing claims. I only deploy these as a pure last ditch effort -  for customers who rent and can't run structure cabling or get any decent wireless connection.

    2. For strict firewalling/ NAT/ traffic shaping, even a C2D would suffice for a 1 Gbps connection. Running the Q6600 is sufficient but it's horrendously power inefficient compared to the current offerings.

    3. When setting up Snort or Suricata, you should not enable blocking initially. Monitor the flags and logs over a period of at least a fortnight to determine what rules and/ or categories you need to disable before you enable the blocking mode.

    4. Starhub is replacing the coax based units with IPTV. Their 20 year lease on the coax infrastructure is coming to an end. New subscribers are now forced to use IPTV provisioned over fibre. As are any old subscribers who need to replace their STB.

    5. I work for an SI. In short, I'm the bao kar liao guy for technical there.



  • @dreamslacker:

    @darkarn:

    Wow, nice to see a fellow Singaporean here! Let's see…

    1. Thanks, then I guess my current edge devices are ok for home usage
    2. Hmm my Q6600 is about 12% load at idle... It looks like that an i3 would be sufficient? (I am seeing very interesting deals in Carousell that use i5 though)
    3. I am unsure about Snort and Suricata as of now; I kept accidentally locking my entire home network out of the Internet entirely! I have success with pfBlockerNG though in blocking ads router-side
    4. No worries about the IPTV; my TV and landline are using separate cable modems
    5. Supermicro stuff look really tempting to me too! Too expensive unfortunately... And just wondering, what are you working as?
    6. I just realised that HAVP is not longer available in pfSense. I have also tried SQUID and like what you said, realised that it did not help as the connections are fast enough (and also the websites that me and family members go to are quite diverse anyway). Thanks for recommending Sophos Home, I will take a look at it.
    7. Yep, that DDoS incident was pretty much the last straw. Funny part is, my family is not affected as I have already set up OpenDNS on router-side for years to block out some unwanted websites. I decided to go with pfSense instead of Asus-Merlin to pre-empt situations where OpenDNS will go down, leaving me with no other DNS left. pfSense's ability to use multiple DNSes won me over in this aspect!

    1. As long as you are not trying to use powerline adapters. Those things are horrendous in practical use despite the marketing claims. I only deploy these as a pure last ditch effort -  for customers who rent and can't run structure cabling or get any decent wireless connection.

    2. For strict firewalling/ NAT/ traffic shaping, even a C2D would suffice for a 1 Gbps connection. Running the Q6600 is sufficient but it's horrendously power inefficient compared to the current offerings.

    3. When setting up Snort or Suricata, you should not enable blocking initially. Monitor the flags and logs over a period of at least a fortnight to determine what rules and/ or categories you need to disable before you enable the blocking mode.

    4. Starhub is replacing the coax based units with IPTV. Their 20 year lease on the coax infrastructure is coming to an end. New subscribers are now forced to use IPTV provisioned over fibre. As are any old subscribers who need to replace their STB.

    5. I work for an SI. In short, I'm the bao kar liao guy for technical there.

    1. I have no choice though; had to put my AC66U in center part of the house for proper coverage but not allowed to do Ethernet drop

    2. That's why I looking around, especially when there are much powerful CPUs for much lower power consumption

    3. Thanks for the tip, I will try this out

    4. Whoa, thanks, I will keep a look out for this issue too

    5. Sorry, what's an SI?



  • @darkarn:

    @VAMike:

    @Taiidan:

    Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s

    That's simply not true, so the rest can be safely ignored.

    Hmm I don't know; I just noticed that an old integrated Atheros NIC can be easily beaten by an Intel NIC on a PCIe card in transferring stuff to and back from a NAS

    I can't sustain a gigabit on my old 3c905 either, which has exactly zero relevance to whether no current realtek or broadcom chipset can achieve more than 70MB/s. That claim is easily disproven and utter nonsense. (Just as ridiculous is continuing the meme that every "realtek" is the same any more than every "intel" is the same. If someone wants to talk about NICs at the very least specify a chipset.)



  • @darkarn:

    1. I have no choice though; had to put my AC66U in center part of the house for proper coverage but not allowed to do Ethernet drop

    2. That's why I looking around, especially when there are much powerful CPUs for much lower power consumption

    3. Thanks for the tip, I will try this out

    4. Whoa, thanks, I will keep a look out for this issue too

    5. Sorry, what's an SI?

    1. Wife/ Parents acceptance factor? If so, tough luck.

    2. I'd just go for the Core i3 Skylake in a Mini-ITX and add on an Intel PCI-e network adapter.

    3. Systems Integrator. Except in my case, we do practically everything with the sole exception of programming. The running joke has been that if it runs on electricity, we can do it or find someone to do it. Even had a case where we sold and installed replacement batteries for our customer's van.



  • @VAMike:

    @darkarn:

    @VAMike:

    @Taiidan:

    Benchmark a "gigabit" realtek or broadcom you get at best 70MB/s

    That's simply not true, so the rest can be safely ignored.

    Hmm I don't know; I just noticed that an old integrated Atheros NIC can be easily beaten by an Intel NIC on a PCIe card in transferring stuff to and back from a NAS

    I can't sustain a gigabit on my old 3c905 either, which has exactly zero relevance to whether no current realtek or broadcom chipset can achieve more than 70MB/s. That claim is easily disproven and utter nonsense. (Just as ridiculous is continuing the meme that every "realtek" is the same any more than every "intel" is the same. If someone wants to talk about NICs at the very least specify a chipset.)

    That 3c905 reminds me of an old Realtek PCI NIC I saw in one of my friends' PCs!

    @dreamslacker:

    @darkarn:

    1. I have no choice though; had to put my AC66U in center part of the house for proper coverage but not allowed to do Ethernet drop

    2. That's why I looking around, especially when there are much powerful CPUs for much lower power consumption

    3. Thanks for the tip, I will try this out

    4. Whoa, thanks, I will keep a look out for this issue too

    5. Sorry, what's an SI?

    1. Wife/ Parents acceptance factor? If so, tough luck.

    2. I'd just go for the Core i3 Skylake in a Mini-ITX and add on an Intel PCI-e network adapter.

    3. Systems Integrator. Except in my case, we do practically everything with the sole exception of programming. The running joke has been that if it runs on electricity, we can do it or find someone to do it. Even had a case where we sold and installed replacement batteries for our customer's van.

    1. Yep, my parents lol

    2. I have actually specced up two different i3 builds but using micro-ATX instead. I may want to wait until next month due to Kaby Lake though

    5. Ah I see, and whoa, I didn't know it's possible for an IT company to do auto repair work too lol