Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Upgrading my APU2C4 pfsense box

    Scheduled Pinned Locked Moved Hardware
    21 Posts 5 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kevindd992002
      last edited by

      It's time to upgrade my very old APU2C4 pfsense box to something more recent and powerful. I use pfsense with 2 wireguard s2s tunnels, 1 wireguard remote access tunnel, dhcp server, dns resolver (unbound), and want to experiment with suricata. I can buy an HP ProDesk 400 G4 with an i3-7100 CPU and 4GB of RAM for just $75 shipped in eBay but I feel that the CPU is too old, no? I can easily upgrade the RAM to 8GB and add an SFP+ PCIe NIC.

      bingo600B 1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Too old for what? It's massively more powerful than the APU. And you probably don't need 8GB of RAM, though it will make playing with Suricata easier.
        The only concern I would have is power consumption compared to an APU which will be significantly higher and hence more expensive.

        Steve

        K 1 Reply Last reply Reply Quote 1
        • K
          kevindd992002 @stephenw10
          last edited by

          @stephenw10 too old since it's 7th gen. Is it better to go with maybe a 10th gen? Probably a Celeron G5900 or something? I was about to ask power consumption too.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Define 'better'.
            Are 10th gen CPUs better than 7th gen for a given TDP or clock rate? Yes.
            Is a 7th gen CPU more powerful than you could ever need for a pfSense install. Probably!

            Also that's not a good comparison. An i3-7100 is superior to a G5900 in every way that matters:
            https://www.cpubenchmark.net/compare/Intel-i3-7100-vs-Intel-Celeron-G5900/2924vs3761

            Comparing it to an entry level 10th gen i3 would be better IMO.

            K 1 Reply Last reply Reply Quote 0
            • K
              kevindd992002 @stephenw10
              last edited by

              @stephenw10 said in Upgrading my APU2C4 pfsense box:

              Define 'better'.
              Are 10th gen CPUs better than 7th gen for a given TDP or clock rate? Yes.
              Is a 7th gen CPU more powerful than you could ever need for a pfSense install. Probably!

              Also that's not a good comparison. An i3-7100 is superior to a G5900 in every way that matters:
              https://www.cpubenchmark.net/compare/Intel-i3-7100-vs-Intel-Celeron-G5900/2924vs3761

              Comparing it to an entry level 10th gen i3 would be better IMO.

              I see. It's probably a wash with pfsense when choosing these CPU's.

              Yeah, I wasn't really comparing both. You brought up a good point about power consumption and so I'm thinking if the G5900 woud be more suitable in my use case since the 7100 is more power hungry. Another option is maybe go with a T processor.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Yup you will save some power with a 'T' variant but probably not as much as you think. Remember the TDP value merely indicates the size of the cooling solution required and not the actual power consumption of the CPU for a given load. The G5900 actually has a higher TDP than the i3-7100.

                The T variant CPUs usually do run cooler at idle though in my experience so if your firewall CPU is mostly idle that counts.

                Steve

                K 1 Reply Last reply Reply Quote 0
                • K
                  kevindd992002 @stephenw10
                  last edited by

                  @stephenw10 said in Upgrading my APU2C4 pfsense box:

                  Yup you will save some power with a 'T' variant but probably not as much as you think. Remember the TDP value merely indicates the size of the cooling solution required and not the actual power consumption of the CPU for a given load. The G5900 actually has a higher TDP than the i3-7100.

                  The T variant CPUs usually do run cooler at idle though in my experience so if your firewall CPU is mostly idle that counts.

                  Steve

                  I see. Yeah, there's really no way to compare the actual power consumption of different CPU's using TDP alone.

                  The only problem I have with the T variants is that they are mostly on uSFF all-in-one desktops. That's all and good except for the fact that you can't install half-height PCIe NICs on them and I need an SFP+ NIC in there.

                  Speaking of SFP+ NICs, which are known to work flawlessly with pfsense? Mellanox ConnectX-3's? I'm reading that the Intel SFP+ NICs are picky with transceiver modules.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    The Mellanox NICs, particularly the older ones, present strangely in pfSense. I have one I bought just to test and whilst I did get it working it was always odd. Hard to recommend it.
                    The ix supported Intel NICs, so X500 series, are still what I'd recommend.
                    Bare in mind that either of those NICs probably use as much power as the APU just by being in the system. 😉

                    Steve

                    K 1 Reply Last reply Reply Quote 0
                    • K
                      kevindd992002 @stephenw10
                      last edited by

                      @stephenw10 said in Upgrading my APU2C4 pfsense box:

                      The Mellanox NICs, particularly the older ones, present strangely in pfSense. I have one I bought just to test and whilst I did get it working it was always odd. Hard to recommend it.
                      The ix supported Intel NICs, so X500 series, are still what I'd recommend.
                      Bare in mind that either of those NICs probably use as much power as the APU just by being in the system. 😉

                      Steve

                      But those Intel NICs are picky with transceivers, correct?

                      Lol, really? That much power, huh.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by stephenw10

                        Well maybe only a dual (or quad) port card. 😉
                        But, yeah, they have big heatsinks on for a reason.

                        I have never found the Intel SFP NICs to be that bad, especially in separate cards.
                        The 10G NICs built into the C3K SoC are more so because of the missing coms lines used to detects the module connection data.
                        The advice is still to use modules intended for Intel NICs though if you can.

                        Steve

                        K 1 Reply Last reply Reply Quote 1
                        • K
                          kevindd992002 @stephenw10
                          last edited by

                          @stephenw10 got it.

                          Does pfsense prefer more cores? I'm looking at the comparison between the i3-7100 (2 cores, 4 threads) and i3-8100 (4 cores, 4 threads). Will the 8100 have an advantage over the 7100 in pfsense or not at all?

                          ? 1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Yes. 1 thread per core means far less switching and pfSense can usefully use 4 threads easily given the right NICs. The must support multiple queues.
                            4 cores uses more more power than 2 of course.
                            And note that the 7100 is actually faster than the 8100 for single threaded applications. So, Snort or OpenVPN for example.

                            Steve

                            K 1 Reply Last reply Reply Quote 0
                            • ?
                              A Former User @kevindd992002
                              last edited by

                              @kevindd992002
                              Your smaller APU2C2 can be changed against another APU4D4 or APU6B4 double of the CPU core and double
                              of the RAM. Also low power using.

                              Intel 7th gen. CPUs are not more bad than others or older ones? What a firewall does? Pushing Packet from a to b.

                              (LGA 1150) Mini ITX Motherboard ~100 €
                              Intel i350-4 it is a 4 Port 1 GBit/s NIC ~50 €
                              Small MiniITX Case with PSU ~50 €
                              16 GB DDR3 ECC RAM 40 €
                              Intel Xeon E3-1231v3 4C/8T - 3,40 to max. 3,80GHz
                              Compex WLE200NX
                              128 GB mSATA ~40 € (snort / suricata and/or squid)
                              CPU Cooler 10 €

                              pfBlocker-ng, Squid & SquidGuard, Snort, ClamAV, apcupsd, HotSpot with voucher and certificates, FreeRadius, Tinc and much others.

                              It runs what ever you want with pfSense until today!
                              The CPU is from 2014, RAM was used and cheap.

                              1 Reply Last reply Reply Quote 0
                              • K
                                kevindd992002 @stephenw10
                                last edited by kevindd992002

                                @stephenw10 said in Upgrading my APU2C4 pfsense box:

                                Yes. 1 thread per core means far less switching and pfSense can usefully use 4 threads easily given the right NICs. The must support multiple queues.
                                4 cores uses more more power than 2 of course.
                                And note that the 7100 is actually faster than the 8100 for single threaded applications. So, Snort or OpenVPN for example.

                                Steve

                                Right, that's what I've been thinking. So if using Suricata (which uses multi thread) and Wireguard (instead of OpenVPN), would you personally pick the 8100 over the 7100?

                                Also, would an nvmE SSD (with a PCIe to M.2 nvmE converter) make sense with pfsense?

                                @dobby_ said in Upgrading my APU2C4 pfsense box:

                                @kevindd992002
                                Your smaller APU2C2 can be changed against another APU4D4 or APU6B4 double of the CPU core and double
                                of the RAM. Also low power using.

                                Intel 7th gen. CPUs are not more bad than others or older ones? What a firewall does? Pushing Packet from a to b.

                                (LGA 1150) Mini ITX Motherboard ~100 €
                                Intel i350-4 it is a 4 Port 1 GBit/s NIC ~50 €
                                Small MiniITX Case with PSU ~50 €
                                16 GB DDR3 ECC RAM 40 €
                                Intel Xeon E3-1231v3 4C/8T - 3,40 to max. 3,80GHz
                                Compex WLE200NX
                                128 GB mSATA ~40 € (snort / suricata and/or squid)
                                CPU Cooler 10 €

                                pfBlocker-ng, Squid & SquidGuard, Snort, ClamAV, apcupsd, HotSpot with voucher and certificates, FreeRadius, Tinc and much others.

                                It runs what ever you want with pfSense until today!
                                The CPU is from 2014, RAM was used and cheap.

                                Yeah, I don't know. I'm still skeptical in going with another APU because of how they are not customizable to an extent, plus the fact that they are more expensive overall compared to getting a lower power SFF desktop in eBay.

                                stephenw10S 1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator @kevindd992002
                                  last edited by

                                  @kevindd992002 said in Upgrading my APU2C4 pfsense box:

                                  So if using Suricata (which uses multi thread) and Wireguard (instead of OpenVPN), would you personally pick the 8100 over the 7100?

                                  It would probably come down to the cost or availability. There's not much in it in performance terms. What's your WAN speed though? Either CPU is probably fine.

                                  @kevindd992002 said in Upgrading my APU2C4 pfsense box:

                                  Also, would an nvmE SSD (with a PCIe to M.2 nvmE converter) make sense with pfsense?

                                  Drive speed is generally not important in pfSense so probably not.

                                  Steve

                                  K 1 Reply Last reply Reply Quote 0
                                  • K
                                    kevindd992002 @stephenw10
                                    last edited by

                                    @stephenw10 said in Upgrading my APU2C4 pfsense box:

                                    @kevindd992002 said in Upgrading my APU2C4 pfsense box:

                                    So if using Suricata (which uses multi thread) and Wireguard (instead of OpenVPN), would you personally pick the 8100 over the 7100?

                                    It would probably come down to the cost or availability. There's not much in it in performance terms. What's your WAN speed though? Either CPU is probably fine.

                                    @kevindd992002 said in Upgrading my APU2C4 pfsense box:

                                    Also, would an nvmE SSD (with a PCIe to M.2 nvmE converter) make sense with pfsense?

                                    Drive speed is generally not important in pfSense so probably not.

                                    Steve

                                    I see. Current Internet speed is 800/800 but I want to prepare this system for multi-Gig speeds in the near future. As usual, I'm probably overthinking this but I just want to get a system that makes most sense since the price differences are not that big.

                                    Ok, so I'll stick with m.2 sata or sata 3 ssd's then.

                                    1 Reply Last reply Reply Quote 0
                                    • ?
                                      A Former User
                                      last edited by

                                      Ok, so I'll stick with m.2 sata or sata 3 ssd's then.

                                      If you "play" around with squid for caching, ids and much of his rules sets that must be decompressed and or pfblocker-ng with many lists inserted, it might be the best sorted with a greater HDD/SSD like the normal 16GB oder 32GB ones.

                                      If you will only run those applications in "small footprint" or less usage the it goes also with the smaller ones.
                                      mSATA and or M.2 mostly are only better regarding to the
                                      electric power usage and/or heating inside of you pfSense box.

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        sledge
                                        last edited by

                                        I’m trying to decide if I want to build or buy a Netgate unit. Here is a thread I found interesting as it had some speed tests for various processors under both single and multi core conditions.

                                        This was provided with Lenovo tiny machines in mind but should be a fair reference for others. First post and scroll down to CPU comparisons.

                                        Apologies in advance if cross linking is frowned on.

                                        https://forums.servethehome.com/index.php?threads/lenovo-thinkcentre-thinkstation-tiny-project-tinyminimicro-reference-thread.34925/

                                        1 Reply Last reply Reply Quote 0
                                        • bingo600B
                                          bingo600 @kevindd992002
                                          last edited by

                                          @kevindd992002
                                          I'm using I3-7130U in my "Qotom firewall boxes" at work (8G Ram .. But usually have 30..60% utilization)

                                          c47c7ae6-2a8d-47bf-b669-84c9559ef5e9-image.png

                                          They're powerfull enough to do Gbit routing , and i have no performance issues.

                                          For $75 , get it ... use it , and when a bigger box (multi Gbit) is needed.
                                          Demote it to Backup/Test box .... And get a better box.

                                          For the time being i'm sticking on 1Gbit at home , as i think the 2.5Gbit/10Gbit switches are too expensive... You can get a vlan capable 8-port 1Gbit switch for $45 , no such luck for a "decent brand" 2.5Gb (I won't touch TP-Link)

                                          /Bingo

                                          If you find my answer useful - Please give the post a 👍 - "thumbs up"

                                          pfSense+ 23.05.1 (ZFS)

                                          QOTOM-Q355G4 Quad Lan.
                                          CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                          LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                          K 1 Reply Last reply Reply Quote 0
                                          • K
                                            kevindd992002 @bingo600
                                            last edited by

                                            @bingo600 said in Upgrading my APU2C4 pfsense box:

                                            @kevindd992002
                                            I'm using I3-7130U in my "Qotom firewall boxes" at work (8G Ram .. But usually have 30..60% utilization)

                                            c47c7ae6-2a8d-47bf-b669-84c9559ef5e9-image.png

                                            They're powerfull enough to do Gbit routing , and i have no performance issues.

                                            For $75 , get it ... use it , and when a bigger box (multi Gbit) is needed.
                                            Demote it to Backup/Test box .... And get a better box.

                                            For the time being i'm sticking on 1Gbit at home , as i think the 2.5Gbit/10Gbit switches are too expensive... You can get a vlan capable 8-port 1Gbit switch for $45 , no such luck for a "decent brand" 2.5Gb (I won't touch TP-Link)

                                            /Bingo

                                            I just pulled the trigger on a $105 Dell OptiPlex 5050 with an i5-7600 CPU, 8GB RAM, and 128GB SSD. I think it's a good deal and would serve me for my needs.

                                            The only concern I have now is which SFP+ NIC to buy off of eBay. I'm reading in another forum that the Mellanox ConnectX-3 (CX312) is a good choice. Another one is the SolarFlare SFN7002 (which needs sfxge_load="YES" to /boot/loader.conf.local, so the driver would load). @stephenw10 do you reckon any issues in adding that to the bootloader to make it work?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.