Installing pfSense on brand new hardware – no drivers?
-
TL-SG3210 - Ohhhhhh yeah. That will do it. Looks like a nice small switch.
I'm sure you can conquer VLANs in a a hour or two then you will be all set.
-
if you need a new system right away: go old.
8111E's should work fine and were/are on a ton of consumer matx to full atx boards. not pretty, but you could just lay the hardware out on boxes and whatnot just to have it function
Or, find older generation Supermicro/Tyan server boards (Ivy Bridge or older), for which the newest Intel NIC should be the 82574.w.r.t. your current board: you may or may not be able to find an mPCIE ethernet card. it'd be a horribly ugly hack but it could work. they're also painfully rare.
w.r.t. an nc360t: have you tried looking through whatever classifieds are popular locally? the nc360t just seems to be the most popular card I've noticed with the 82571.
-
So, you now have a working more than sufficiently powerful, low wattage pfsense box and will soon have all the WAN and LAN you need via VLAN… Problems solved.
Maybe you can keep and eye on that SSD of yours and post back letting people know how well and reliable it works over the life of your box. Those are very inexpensive SSDs and finding any rating on them is difficult. If it keeps working well for you it might make for a nice cheap option for people in the future.
-
So, you now have a working more than sufficiently powerful, low wattage pfsense box and will soon have all the WAN and LAN you need via VLAN… Problems solved.
Maybe you can keep and eye on that SSD of yours and post back letting people know how well and reliable it works over the life of your box. Those are very inexpensive SSDs and finding any rating on them is difficult. If it keeps working well for you it might make for a nice cheap option for people in the future.
Well the SSD has been running in that box 24/7 since May 2012 (actually, the end of April), and still seems to be doing fine. Here's the SMART status from it:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE 12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 13 9 Power_On_Hours 0x0032 100 100 000 Old_age Always - 0 194 Temperature_Celsius 0x0007 032 100 000 Pre-fail Always - 0 229 Unknown_Attribute 0x0002 100 000 000 Old_age Always - 589585213484 232 Available_Reservd_Space 0x0002 100 049 000 Old_age Always - 4626505281584 233 Media_Wearout_Indicator 0x0002 100 000 000 Old_age Always - 0 234 Unknown_Attribute 0x0002 100 000 000 Old_age Always - 94489281280 235 Unknown_Attribute 0x0002 100 000 000 Old_age Always - 4127259151
(I'm amused that 32C is considered "pre-fail")
-
SMART is pretty worthless for knowing the true health and true remaining life of SSDs. I call SSDs either working or not and pretty much ignore the smart reports. That switch is also pretty much unrated but seems like it will be very nice. Thats something else you might make posts about once you get its VLANs configured and get the pfsense VLANs working with it. Its a solid looking piece of hardware.
I'm running one of these in my old home box:
=== START OF INFORMATION SECTION ===
Device Model: SAMSUNG MCCOE64G5MPP-0VA
Serial Number: SE816A2746SMART Attributes Data Structure revision number: 1
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
9 Power_On_Hours 0x0032 097 097 000 Old_age Always - 10711
12 Power_Cycle_Count 0x0032 097 097 000 Old_age Always - 2045
175 Program_Fail_Count_Chip 0x0032 100 100 011 Old_age Always - 0
176 Erase_Fail_Count_Chip 0x0032 100 100 011 Old_age Always - 0
177 Wear_Leveling_Count 0x0013 099 099 023 Pre-fail Always - 15
178 Used_Rsvd_Blk_Cnt_Chip 0x0013 087 087 011 Pre-fail Always - 21
179 Used_Rsvd_Blk_Cnt_Tot 0x0013 094 094 010 Pre-fail Always - 315
180 Unused_Rsvd_Blk_Cnt_Tot 0x0013 094 094 010 Pre-fail Always - 4901
181 Program_Fail_Cnt_Total 0x0032 100 100 010 Old_age Always - 0
182 Erase_Fail_Count_Total 0x0032 100 100 010 Old_age Always - 0
183 Runtime_Bad_Block 0x0013 100 100 010 Pre-fail Always - 0
187 Reported_Uncorrect 0x0033 099 099 000 Pre-fail Always - 4
195 Hardware_ECC_Recovered 0x001a 199 199 000 Old_age Always - 4
198 Offline_Uncorrectable 0x0030 100 100 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x003e 253 253 000 Old_age Always - 2 -
Hmmm… I found that I might be able to get the GA-H77N-WIFI motherboard... which would allow me to avoid the hassle of returning the CPU (the part I fear most about returning this hardware) -- it has dual Realtek GigE ethernet.
My only concerns with this would be whether the chipset is supported, and also I've heard some people pan Realtek around here -- I know they're not Intel, but are they really that bad?
-
GA-H77N-WIFI will work with 2.1 but I think the wifi will not. That board has been tried out here before. I spent some time in a thread with a different guy with that board. All running except the wifi if I remember correctly.
-
Running Nano on that SSD it should last forever.
That switch seems expensive compared with, say, this: http://www.newegg.com/Product/Product.aspx?Item=N82E16833122397 which would also do the job. That Netgear might be more difficult to setup though, it requires a Windows only setup program. This one doesn't though and many people are using it: http://www.newegg.com/Product/Product.aspx?Item=N82E16833122381
However if that's available today and others aren't it should be fine.
Steve
-
I got the distinct impression that speed of purchase and functionality mattered more than cost to this guy. Thats why I didn't get into the price bit. I don't know though. The TL-SG3210 is advertising alot of function for a sorta not too high price. I'm interested to see how he rates it if he gets it.
-
Hmmm… I found that I might be able to get the GA-H77N-WIFI motherboard... which would allow me to avoid the hassle of returning the CPU (the part I fear most about returning this hardware) -- it has dual Realtek GigE ethernet.
My only concerns with this would be whether the chipset is supported, and also I've heard some people pan Realtek around here -- I know they're not Intel, but are they really that bad?
that board will work. no clue about the wifi, I've always ignored pfsense's wifi capabilities.
Realtek NICs are bad in the sense that you're unlikely to get the "full" throughput available to you from the GigE spec and tend to have higher CPU utilization vs Intel NICs. -
Holly crap its almost as if I already just said that… Good god.
-
Thanks for the feedback everyone! I will be taking the hardware back to Microcenter tonight; they have the switch in stock so it shouldn't be too painful to do an exchange – it looks like their return policy is fairly liberal and the only note about CPUs is that they have a shorter return period.
As much as I want to build a new box (I enjoy putting together new computers, and haven't done so in a while), the significant cost savings of slapping in a managed switch vs. building a whole new box can't be overlooked. There's also the time savings (more critical at this point) of being able to drop in something that's almost guaranteed to work and doing a little configuration vs. building another box, setting up pfSense, copying the configuration over, and tweaking/tuning until things work right.
One side note: I assume throughput in this setup is (theoretically) restricted, since both WAN and LAN traffic share the same port on the pfSense box? 99.999% of the time this won't be a problem since the WAN is only 50mbit (100mbit if we upgrade our connection), but just want to make sure I understand the limitations.
-
Correct, all the traffic has to share the one NIC. However most of the time that isn't an issue since if you are downloading a large file, for example, that traffic comes in via the WAN and goes out via the LAN. The NIC should be capable of 1Gbps full duplex, in and out simultaneously. You do have some return traffic but at a much lower level. This will never be an issue for you since an Atom can't get close to saturating a Gigabit link anyway.
Steve
-
Correct, all the traffic has to share the one NIC. However most of the time that isn't an issue since if you are downloading a large file, for example, that traffic comes in via the WAN and goes out via the LAN. The NIC should be capable of 1Gbps full duplex, in and out simultaneously. You do have some return traffic but at a much lower level. This will never be an issue for you since an Atom can't get close to saturating a Gigabit link anyway.
Steve
Hah, good to know >_<
What sort of max throughput should I expect from the Atom (D525)? If it can keep an upgraded 100mbit WAN link saturated, or nearly so, I'll be happy for a year or two more :)
-
~550Mbps. It can vary depending on your NIC. Packages slow that down of course.
Steve
-
The only package I have installed is File Manager, so that shouldn't significantly affect throughput, right? I assume the packages that have a higher impact on throughput would be ones that interactively manage traffic e.g. Squid?
550Mbps should be fine for my needs for the next 2-3 years… and by that time there will be better, cheaper solutions that I can build when I have time to research the hardware (and subsequently employ hardware that can handle my throughput needs).
EDIT: Apologies, my system actually seems to have a D425, not a D525. Does this significantly impact my throughput, or am I still safely above the 400mbit mark?
-
Ok, you really need to do better research before buying…
After doing some brief research on hardware while I was at work today, I settled on the Gigabyte GA-Z87N-WIFI
Staring intently at the motherboard, I found the Atheros chip, marked "8161-8L3A" – this seems to indicate the AR8161 chipset. I have also found what I believe to be the Intel chip, marked "WG1217V" -- a Google reveals many non-English pages that have just enough Latin characters to suggest that this is indeed the Intel ethernet chipset. Is there any way to get drivers for this beast, or should I just accept defeat, pack everything back up, and get a "canned" router?All Haswell boards with intel nics come with i21x, this is still not supported in 2.1.
Ivy/Sandy bridge boards with intel will have either 82574L, 82579V and/or 82579LM which will work.The atheros is not supported. When people say "buy atheros" they are talking about WLAN, and it really only applies to old PCI chipsets. Until 2.1 zero pci express (aka minicard) were supported, and even now my 9280 which is the first (oldest) one they made isn't quite right still. N isn't supported either, don't even think about AC.
To be perfectly honest, pfsense sucks at wifi because the drivers are way too old and freebsd isn't the greatest at wifi to begin with. Get a nice and/or cheap standalone access point (aka consumer router flashed with better firmware from your choice of _wrt distros) and hang it off another interface.
Hmmm… I found that I might be able to get the GA-H77N-WIFI motherboard... which would allow me to avoid the hassle of returning the CPU (the part I fear most about returning this hardware) -- it has dual Realtek GigE ethernet.
My only concerns with this would be whether the chipset is supported, and also I've heard some people pan Realtek around here -- I know they're not Intel, but are they really that bad?
That is a different socket (1155 sandy/ivy vs 1150 haswell), you will need a different CPU. Realtek does suck, and that board might even have the E/F/G or whatever revision isn't supported in 2.1 yet anyways.
Pretty much all your problems would be solved with a cheap 1155 board (like one of those $50 microcenter itx), the $35 celeron and a dual/quad intel nic off fleabay and some $20 router. Don't try to get it all onboard, it doesn't exist.
Don't put trust a single port w/ vlan switch to keep your internet and lan apart.
-
EDIT: Apologies, my system actually seems to have a D425, not a D525. Does this significantly impact my throughput, or am I still safely above the 400mbit mark?
I think the D425 is just a single-core version of the D525. Since pf doesn't support multiple cores, I doubt it would make a measurable difference.
-
Don't put trust a single port w/ vlan switch to keep your internet and lan apart.
Care to elaborate? As long as the switch properly handles VLANs (as opposed to just passing through tagged frames), I don't see how this is any cause for concern!?
-
Ok, you really need to do better research before buying…
Pretty much all your problems would be solved with a cheap 1155 board (like one of those $50 microcenter itx), the $35 celeron and a dual/quad intel nic off fleabay and some $20 router. Don't try to get it all onboard, it doesn't exist.
Except time is of the essence for this – I had a few hours to do my research, and ordering a NIC off eBay is right out (getting any of those overnighted costs a ridiculous amount on top of the price of the card itself). Fortunately I managed to fudge a script that auto-cycles the interface when it detects the IP drop, so I have a little bit of breathing room (VoIP calls cut out for a few seconds, but don't drop entirely). I was trying to get it all onboard because I was building it with off-the-shelf parts I could drive down to the store and pick up.
To be perfectly honest, pfsense sucks at wifi because the drivers are way too old and freebsd isn't the greatest at wifi to begin with. Get a nice and/or cheap standalone access point (aka consumer router flashed with better firmware from your choice of _wrt distros) and hang it off another interface.
The problem with hanging an access point off it is that I would then lose my guest network (unless I hang two off there, maybe?). That's really something I'd rather not lose. pfSense has been doing quite well with wifi on my current Atom box using an Atheros wifi card. Sure it's not blazing fast, but the most demanding thing we do on any of our wireless devices is watch YouTube videos, and we spend most of our time on the wired systems anyways.
-
The problem with hanging an access point off it is that I would then lose my guest network (unless I hang two off there, maybe?). That's really something I'd rather not lose. pfSense has been doing quite well with wifi on my current Atom box using an Atheros wifi card. Sure it's not blazing fast, but the most demanding thing we do on any of our wireless devices is watch YouTube videos, and we spend most of our time on the wired systems anyways.
If you get an access point that supports a guest network (or, more generally, multiple SSIDs), chances are this is exposed as a separate VLAN, which pfSense can easily deal with. Point in case, I have an Airport Extreme attached to my pfSense box, and the built-in guest network feature works just fine once you figure out what VLAN tag it uses.
-
The single core CPU will be slower. Although the pf process is single threaded the other processes can be run by the second core. You'll still be far faster than 100Mbps.
I would have no worries relying on VLANs to separate wan from lan, at least not with a half reliable switch.
Steve
-
I like that little router… I think that plus the switch will be excellent. Better than average.
-
I think when he gets the switch, he should:
Take 1 of the ports on either the far left or right and make it the WAN by making that port untagged vlan10 (for instance) but also include tagged vlan10 in that port. Then label the port with a sticky as WAN. (Don't include vpid1 here)
Then take port right next to it and make it a trunk vlan tagged to include vlans 10 and 20 (but not vpid1) and plug that into pfsense.
Put a sticky label on that as pfsense connection.Then make several ports right next to that as vlan untagged vlan20 to act as LAN ports and do include tagged vlan20 + vpid1
And label l those all as LAN.Maybe leave a couple ports at the other end of the switch to later use as vlans 30 and 40 for guest networks or whatever.
Label them.Then go into pfsense and set up those vlans and firewall rules.
What do you think? Further suggestions stephenw10? Anyone? I don't think OP has done this before.
-
What is "vpid1"? Is this referring to the management VLAN?
This is what I would do on something like a Dell PowerConnect 28xx:
- create VLAN "WAN" with VLAN ID 10
- create VLAN "LAN" with VLAN ID 20
WAN port:
- make member of VLAN "WAN" only, in untagged mode
- set PVID (the default VLAN that incoming untagged frames on a given port get assigned to) to 10
- set ingress filter to allow untagged frames only
LAN ports:
- make member of VLAN "LAN" only, in untagged mode
- set PVID to 20
- set ingress filter to allow untagged frames only
pfSense port:
- make member of both VLANs, both in tagged mode (plus possibly whatever VLAN the switch has its management interface on)
- PVID doesn't matter (unless the management VLAN has to be untagged)
- set ingress filter to allow tagged frames only (unless the management VLAN has to be untagged)
So I guess the main difference is that I see no reason to allow incoming tagged frames on any of the non-trunk ports, and I wouldn't allow LAN ports to access any other VLANs (directly, that is – they could of course still do so through the pfSense box if the firewall rules permit).
-
a vpid is a typo of pvid… 1 is usually the default for management.
On my switch I include pvid1 on the LAN side so I can access my management gui.
I also have to allow tagged traffic from the trunk to the untagged ports.tagged vlan10 to untagged vlan10 etc...
-
make it the WAN by making that port untagged vlan10 (for instance) but also include tagged vlan10 in that port.
Not sure I agree with that, you don't want any tagged packets coming out of the WAN port. :-\
There are always terminology issues when dealing with VLANs, manufacturers seem to use different terms for the same thing. It's only going to be confusing speculating here. The only helpful thing to do would be to read the manual for that specific switch and write something based on that. Otherwise I'll just wait for questions.
http://www.tp-link.com/resources/document/TL-SG3210_V1_User_Guide.pdf
Steve
-
:DYeah - VLAN terninology varies from device to device.
On the port we will call WAN, anything that enters that port should be considered VLAN 10 (assuming he decides to call wan vlan10)
For me, that is done by assigning that port untagged vlan10 and must also allow tagged vlan10.
I'll read the manual to see if its same for him.
The relevant bits start at: "Link Types of ports" in that manual. Its same as mine.
The ports connected to non-vlan capable things (that all but 1 port) all get type "access" and are untagged. Then 1 is "trunk" and tagged and its connected to pfsense. Simple. I like the "MAC VLAN" function. I don't need it, but can see where it would be useful.
I think I see your issue with me including "tagged" packets… On my switch I can make a port untagged vlan10, but unless I include tagged vlan ID 10 access, it will ignore the traffic that came from the tagged trunk. That may vary from switch to swith, so yeah - maybe better to try it without first.
-
On my switch I include pvid1 on the LAN side so I can access my management gui.
If you allow your clients to talk to the VLAN that the management interface is on, why not just use that VLAN for your LAN in the first place?
I think I see your issue with me including "tagged" packets… On my switch I can make a port untagged vlan10, but unless I include tagged vlan ID 10 access, it will ignore the traffic that came from the tagged trunk. That may vary from switch to swith, so yeah - maybe better to try it without first.
I was specifically talking about ingress filtering of tagged packets, so that wouldn't apply to traffic from other ports.
-
He seems like a smart guy. I'm sure he will figure it out. ;)
-
Well unfortunately given my zero prior experience with VLANs, I was unable to make this work. Since I have the venerable WRT54G running my network now, I at least have the stability I need.
At this point I now have the time to either rebuild a new box or futz with the VLAN thing until I get it working. If someone would have the time and patience to help me figure out what I'm doing wrong with the VLAN setup, I'd love to learn how to do it… otherwise, the hardware build I'm currently considering is so:
http://www.amazon.com/gp/product/B00B2D7QU6/ - Jetway mini ITX motherboard with Atom D2550 and dual onboard RTL8111E NIC
http://www.amazon.com/gp/product/B003Y3RWV0/ - Jetway daughterboard with 3x Intel 82541 NIC
http://www.amazon.com/gp/product/B0065SMVVW - 4GB DDR3-1066 CL7 RAMExisting SSD
Existing Mini PCIe WiFi card (though I plan to consider hanging an access point off this eventually, for 802.11n or ac joy)Thoughts, either way?
-
Since you already have the switch I would try to get VLANs working first.
What have you tried? What did it do? What did you expect it to do?Steve
-
Time to get that experience with VLANS now. Could you post your VLAN switch setup as it is now? You might need to post a couple of screens to show the whole configuration.
-
I'll have to get those tonight. The gist is:
Port 1: ACCESS VLAN 10 only (cable modem goes here)
Port 2: TRUNK VLAN 10,20 (pfsense box goes here)
Port 3-7: GENERAL VLAN 20 (misc LAN connections)
Port 8: GENERAL VLAN 1,20 ("management" port for web GUI access)IIRC, all ports except 2 are set to UNTAG, and 2 is TAG.
In pfsense, I created two VLAN interfaces on re0 (the physical port), one with VLAN ID 10 and one with VLAN ID 20, then set those as the appropriate WAN/LAN networks.
Does this sound about right, or does something sound terribly wrong with it? I was able to plug into port 8, and access the pfsense box on port 2, but pfsense wasn't getting a WAN IP.
-
Thye call those "general" and not untagged "access"?
-
(on this switch, anyways:) "ACCESS" can only be assigned to one VLAN, and I believe is UNTAG only.
The big problem I ran into is that the router's WAN VLAN wouldn't get an IP address from the cable modem… and then I just kinda stopped there because without a WAN IP this setup isn't going to do me much good.
-
You can get an IP, I'm pretty sure. You just need to figure out how.
-
See this is exactly why there's always confusion using VLANs. ::)
I confess I always kind of muddle through when setting up VLANs, there always seem to be at least three ways of doing the same thing. The concept of the PVID seems completely superfluous when you can set the ID tag specifically. I am open to be corrected here and I imagine in a much more complex network may require (or at least utilise) these features.The settings you have made don't look obviously wrong. I'll re-read the manual while waiting for screen shots.
Steve
-
Well - He would have to have the pfsense set up properly and the switch in order to get an IP. I really do think this is just a temporary setback. It makes no sense that someone would make a switch that could't have more than 1 untagged access vlan. It did take me a couple minutes to wrap my mind around it, but only a couple. Someone could also set this up via teamviewer and let him watch how its done once. I've done that a few times also.
-
If someone would be willing to do the Teamviewer thing, I'd greatly appreciate it. I could plug the switch's WAN port into the WRT54G's LAN so we can play with it without interrupting the network for everyone else in the house. Both my cable connection and the WRT54G LAN give DHCP-assigned IP addresses, and the WRT54G's range (192.168.1.x) is completely different from where I have my pfSense box set (10.0.x.x) so that shouldn't conflict.
Even if I could get someone in IM or IRC so we could discuss what's going on live instead of spamming the forums, that'd probably go a long ways :)
(BTW, I got home late last night and basically just fed the cats and passed out, so I didn't get to set up the hardware or get screenshots – sorry)