Should I turn off Kernel PTI & MDS Mitigation on a bare-metal pfSense server ?

[Upper Deck]

Hi there,

I just did some searches on this issue. Don't have any conclusion.

Any consensus about it?

U.D.

[gabacho4]

@upper-deck netgate turns them off on their hardware. The assessment was that those exploits require physical access to the router and that if a bad actor can touch your router physically, you’ve already lost.

[Upper Deck]

@gabacho4

Just disabled these two options. Got noticeable IPsec VPN performance improvements on a Intel J1900 platform (140Mb/s -> 160Mb/s), and slight performance changes on a Intel E3-1280 v5.

[FrankM]

@gabacho4

Thank you for explaining, I too wondered about those settings.