Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Pfsense bridging?

    Firewalling
    4
    10
    4055
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wyn last edited by

      Hello all,

      Is it correct that pfsense no longer supports bridging modus?
      I'm trying to create a bridging firewall that can handle approx. 1.000.000 concurrent connections, any ideas?

      Best regards,

      Wyn

      1 Reply Last reply Reply Quote 0
      • GruensFroeschli
        GruensFroeschli last edited by

        Where did you read that pfSense doesn't support bridging?

        If you expect 1e6 connections i would see to it that the machine has a lot of RAM.

        @http://www.pfsense.org/index.php?option=com_content&task=view&id=52&Itemid=49:

        Large state tables - State table entries require about 1 KB of RAM each.  The default state table, when full at 10,000 entries, takes up a little less than 10 MB RAM. For large environments requiring state tables with hundreds of thousands of connections, ensure adequate RAM is available.

        1 Reply Last reply Reply Quote 0
        • W
          wyn last edited by

          Thanks for your reply GruensFroeschli!

          I'm not sure where i read this, i thought someone recommended m0n0wall for bridging.
          Any idea how to set it up? Do i need 3 network interfaces to get it working? (One NIC for the web interface?)

          Also, how many RAM would you recommend for 1.000.000 concurrent connections?

          Thanks,

          Wyn

          1 Reply Last reply Reply Quote 0
          • GruensFroeschli
            GruensFroeschli last edited by

            The reasons behind recommending m0n0wall are usually: "less ressource hungry".

            The optimum would be to set it up with 3 interfaces.
            2 work also, but you have to bind the webinterface to one.

            Did you read the link i posted above?
            If you expect 1e6 concurrent connections i would add 2GB of RAM.
            1GB is used for the states, 512 MB for states going over the expected 1e6 connections, about 128MB for the system itself, leaves 384 MB free for packages and other stuff.
            What kind of traffic are you expecting to push?
            100Mbit? 1Gbit?
            Don't forget to have an adequate CPU.
            Make sure you have proper NICs (realtek is crap).
            Try to get some Intel NICs.

            1 Reply Last reply Reply Quote 0
            • W
              wyn last edited by

              Thanks again! you helped me a great deal..
              I'm running some tests now on old hardware.. when it's working fine i'm gonna think about purchasing an appliance (http://www.applianceshop.eu/index.php/firewalls/opnsense-hd-rack-edition-19-pfsense-appliance.html).

              1 Reply Last reply Reply Quote 0
              • GruensFroeschli
                GruensFroeschli last edited by

                What you posted is an ALIX in a rackmount case.
                Underpowered by about a factor of 10.
                From your descriptions you're looking for a full-blown multi GHz server.

                Can you maybe elaborate what you're trying to achieve?
                It sounds to me as if you're not clear yourself what you want.

                1 Reply Last reply Reply Quote 0
                • W
                  wyn last edited by

                  Hello GruensFroeschli,

                  I'm trying to replace an existing FreeBSD filtering bridge with an 'out of the box' solution like pfsense. The reason i want to replace the existing bridge is because alot of downtime was caused last year because of typos in (IPFW) rule sets.

                  The current box has a throughput of about 60mb/s continously. So my goal is to replace this machine with a more easy to manage interface, with hardware that performs the same or better as the current box.

                  Thanks,

                  Wyn

                  1 Reply Last reply Reply Quote 0
                  • valnar
                    valnar last edited by

                    You should be looking at a modern Core2Duo server with Intel NIC's to achieve that many connections.

                    1 Reply Last reply Reply Quote 0
                    • jimp
                      jimp Rebel Alliance Developer Netgate last edited by

                      At a minimum, 1,000,000 states would be about 1GB of RAM, which rules out most embedded devices. And since other processes need RAM too, you can't just use 1GB of RAM, you'd be better off with 2GB (since RAM is cheap these days).

                      Depending on the throughput, you may need a more powerful CPU. If you're just talking about 100Mbit or so, an atom-based box might do the job. If you want to push closer to 1Gbit, you might need something with a couple GHz to it.

                      1 Reply Last reply Reply Quote 0
                      • W
                        wyn last edited by

                        Thanks all,

                        Now i'm still struggling with trying to create a bridge..  :/

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post

                        Products

                        • Platform Overview
                        • TNSR
                        • pfSense Plus
                        • Appliances

                        Services

                        • Training
                        • Professional Services

                        Support

                        • Subscription Plans
                        • Contact Support
                        • Product Lifecycle
                        • Documentation

                        News

                        • Media Coverage
                        • Press
                        • Events

                        Resources

                        • Blog
                        • FAQ
                        • Find a Partner
                        • Resource Library
                        • Security Information

                        Company

                        • About Us
                        • Careers
                        • Partners
                        • Contact Us
                        • Legal
                        Our Mission

                        We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                        Subscribe to our Newsletter

                        Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                        © 2021 Rubicon Communications, LLC | Privacy Policy