Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    hardware suggestions (again i know)

    Scheduled Pinned Locked Moved Hardware
    31 Posts 4 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thething
      last edited by

      hello everybody!
      i´m new here so please be gentle ;) i searched and found a few posts on the topic but most are old ones.
      i've got a 1gb/1gb internet connection. i want to put pfSense to work and it needs to support at least a 1gb ethernet (going to 10Gb probably) network with 6 workstations and 6 simultaneous remote users over OpenVPN. I also want to run pfBlockerNG and some other packages.
      i need some hardware, from case (mini-itx or 1u rackmount), motherborard, processor, ram, nics, etc, suggestions/inputs from you please.
      i want something powerfull and future proof (as much as it’s possible) so I can use OpenVPN at full throttle, pfBlockerNG, etc with no constrains what so ever regarding performance and compatibility.

      thanks in advance for your time and patience :)

      p.s.: the budget is not unlimited ;) and it´s always a problem

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        The XG-7100 or the XG-7100 1U.. if you plan on going to 10ge..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • NollipfSenseN
          NollipfSense
          last edited by NollipfSense

          Seconded what John said...you'll have fun with this puppy!

          Screen Shot 2020-02-12 at 3.02.21 PM.png

          pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
          pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Anyone would have fun with that! I would go with the desktop version for my home setup.. But I have not been able to tax my 4860 as of yet.. So it would be just overkill - but yeah it would be nice to have! ;)

            If I was seriously considering going to 10ge, other than my wishful thinking I would for sure go with the 7100..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • T
              thething
              last edited by

              Hello guys :) thank you for your replies.

              A portuguese IT supplier told me one thing I though weird. They told me that till 3 simultaneous remote connections I could go with SG-3100 with no problem even if I need OpenVPN, at full throttle like I said, pfBlockerNG, etc.

              I think I'll have serious trouble if I go that way, not to mention I cannot upgrade the SG-3100 appliance. Am I right?

              I know this is a Netgate forum but since people talk freely here about other hardware besides Netgate may I ask: any DIY hardware suggestions?

              Netgate appeals to me as a proved solution. DIY appeals to me because of the flexibility, easy to upgrade and escalate.

              Thanks in advance

              NollipfSenseN 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                While others might talk about it - I just stay stick with what works! There is one thing if you have some hardware laying about you can leverage. But going to buy something for work... Go with actual appliance.. 3100 while sure it can prob push gig.. Not going to be able to do 10ge if that is on near future roadmap for you.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • T
                  thething
                  last edited by

                  I understand your point perfectly but having options to choose from is always a good thing, I think

                  1 Reply Last reply Reply Quote 0
                  • NollipfSenseN
                    NollipfSense @thething
                    last edited by

                    @thething If it's for a business, I would recommend Netgate appliances just because it comes with support...maybe the SG4860 for the future requirements. I can share my DIY, which is in my signature. I am an Apple person and already had hardware setup with the future in mind. So I used a 2011 Apple mini server with thunderbolt2 enclosure that I can easily add a 10Gbe later.

                    pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                    pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                    1 Reply Last reply Reply Quote 1
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      Well pretty much anything will work with pfsense.. Just get good nics, and you should be fine.. Problem is boxes like that like to suck a lot of juice.. So while you might save a bit of $ up front - you will loose it all just creating heat while the thing sits idle.

                      Electricity in Portugal is pretty expensive is not... So something that uses minimal would be best. Not some best of a PC sucking 100watts idle ;)

                      Isn't your electric like 3rd highest cost in all of the EU?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • T
                        thething
                        last edited by

                        If something goes wrong with Netgate hardware how will I solve it?
                        Since Netgate does not have any representation in Portugal my downtime would be just huge, no?
                        Isn't it possible to get a diy appliance done without it sucking too much juice?
                        ok good NICs (the best 4 port), like?
                        sorry about all this questions but I'm no an IT guy and questions arise. ohh and the "client" is my wife's accounting office, so you see my problem ;) :)

                        NollipfSenseN 1 Reply Last reply Reply Quote 0
                        • NollipfSenseN
                          NollipfSense @thething
                          last edited by NollipfSense

                          @thething said in hardware suggestions (again i know):

                          I'm no an IT guy

                          That's the problem recommending DIY although being one is unnecessary as long as you're at least computer literate. For the peace of mind, I would go with Netgate...you could always get SG-4860 and SG-3100 as a backup...that way, you're not too far from the nearest Netgate Europe support center should one goes down. The two appliances would be about the same cost as the XG-7100IU or pretty close.

                          pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                          pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            Why would an accounting office need 10ge? Just curious.. Must be some really large spreadsheets ;)

                            How many people in this office?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            T 1 Reply Last reply Reply Quote 0
                            • T
                              thething @johnpoz
                              last edited by

                              @NollipfSense I'm literate enough to understand I'll be probably be in trouble with 3 simultaneous remote OpenVPN (AES256 encrypted) connections (and I need 6), pfBlockerNG, Suricata, Squid, SquidGuard and so on with the SG-3100 even when the IT guy is telling me it will be ok. I do not "buy" it. and they want me to pay 470 plus VAT for the 3100.

                              I even doubt the 4860 can do it at full speed without a glitch. They both lack processing power specially if we put pfBlockerNG running. Internet reports about this issue are abundant. Besides I hate underpowered hardware causing me trouble oe slowing things down.

                              @johnpoz it probably doesn't.

                              NollipfSenseN johnpozJ 2 Replies Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                @thething said in hardware suggestions (again i know):

                                Besides I hate underpowered hardware causing me trouble oe slowing things down.

                                And what are you using now? ;)

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • NollipfSenseN
                                  NollipfSense @thething
                                  last edited by NollipfSense

                                  @thething said in hardware suggestions (again i know):

                                  I'm literate enough to understand I'll be probably be in trouble with 3 simultaneous remote OpenVPN (AES256 encrypted) connections (and I need 6)

                                  Good...honestly, I believe the Netgate XG-7100IU in this case would be the best five-year business investment in terms of a robust hardware that comes with support. You can modify what you currently have, like upgrade processor and memory, to use as a backup. A DIY, I am a little bias on using Apple Mac Mini because of the lovely form factor...a used 2012 Mac Mini quad core i7 16GB RAM about $550/eBay in the U.S. Coupled with a used thunderbolt two PCI enclosure and a quad port i350 NIC for around $200. Power consumption with the Mac Mini is not much...I run two Mac Mini servers 24/7/365. Adding the 10gbe NIC would be easy as removing the i350 later.

                                  pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                                  pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                                  T 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @thething
                                    last edited by

                                    @thething said in hardware suggestions (again i know):

                                    They both lack processing power specially if we put pfBlockerNG running.

                                    Not sure why you think that is going to be process intensive - other than parsing through the lists, which is done every now and then when they update - it doesn't do anything after that..

                                    You can do lots of openvpn vpns connections - its just not going to be at wire speed.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      What exactly do you mean by 'full speed' here?

                                      The SG-3100 will pass at or close to 1Gbps if it's just clients behind it downloading.

                                      But if you want, say, 1Gbps OpenVPN that's a whole new level of processing required. More than even the XG-7100 will provide.

                                      The total number of VPN remote users is not that important it's the total encrypted bandwidth that counts.

                                      Steve

                                      T 1 Reply Last reply Reply Quote 0
                                      • T
                                        thething @stephenw10
                                        last edited by

                                        @stephenw10 I mean as close as possible to 1Gbps OpenVPN

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          thething @NollipfSense
                                          last edited by

                                          @NollipfSense thank you so much for your suggestions

                                          NollipfSenseN 1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Then you need as much CPU power as possible. OpenVPN is single threaded, you likely won't get 1Gbps with any single connection unless you have a very fast device but you probably will with several connections at ~200Mbps each.
                                            The 3100 will pass ~125Mbps OpenVPN total so not even close for what you're trying.

                                            You might consider using mobile IPSec instead if you really need that encrypted throughput.

                                            Steve

                                            T 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.