(Part 2) Best products from r/PFSENSE

Kind of need to know your WAN throughput and intended use of the router to give recs.

Anything made in the past 10 years should be able to handle most modern WAN services without issue. It's only if you're planning on running a VPN on 1Gbps at full speed, or doing extensive Snort/Suricata logging (or similar) that you need to start looking for something "special."

The multiple NICs becomes more of a problem, at that point you're looking at specialized stuff if you want small form factor. OTherwise, just pick up a used / off-lease desktop PC and throw a few NICs in it.

Supermicro has some Atom-based boards with multiple NICs that you can dump into a super small ITX case and power with an external PSU brick if you want.

The only real reason to go with one of these instead of Netgate hardware is if you dislike something specific about their stuff, because you're not going to save much money, especially not if your time has value.

Personally, I still went with a Supermicro setup, because I wanted out of band / IPMI console on the box. My router is in a crawlspace and under my stairs, not a place I want to spend time tethered to it with a laptop via USB (which is Netgate's solution for console access to their boxes). I also gained the side benefit of ECC RAM support... probably not much actual benefit there, but I used it because I could.

I'm using this case

And this board which has the advantage of built-in 12V PSU support, meaning you don't need to use a PicoPSU and can just run the whole system from an external brick.

I've had a great experience with my Protectli box; Brent over there is extremely helpful, too.

I have this specifically: Firewall Micro Appliance with 6X... https://www.amazon.com/dp/B0741F634J?ref=ppx_pop_mob_ap_share

And added my own ram and storage:

Crucial 8GB Kit (4GBx2) DDR4 2400... https://www.amazon.com/dp/B019FRD3SE?ref=ppx_pop_mob_ap_share

Transcend 64GB SATA III 6Gb/s MSA370 mSATA Solid State Drive (TS64GMSA370) https://www.amazon.com/dp/B00K67E5DA/ref=cm_sw_r_cp_apa_i_pGWyDbF9HNGY3

Check out the Shuttle XPC Slim DS68U. Mine has been rock solid, the Skylake Celeron 3855U is about the same total performance as J1900 but almost double single-threaded performance, so great for VPN. The physical box is super industrial too.

Amazon: https://smile.amazon.com/gp/product/B01JZJ581C

Not totally against picking up the SG-3100; not sure what my initial reservation was. I do like the form factor.

Also, i considered getting a couple of these: https://www.amazon.com/dp/B0781YXFBT/ to serve as APs throughout my home. Shouldn't have any issues with those, right?

Thank you all!

PS: The current Netgears are 802.11n - hoping to upgrade to ac (or better?) as part of all this...

in case you haven't already pulled the trigger this looks like a good config for you:

mini-itx

2.0Ghz, Latest Goldmont AES-NI

VT-X&D

ebay i340-t4

PCIe v2.0 x2 mode = 8.0Gbits/s bidirectional for 4x gigbit NICs

8GB DDR3L 1866 SODIMM

2xSATA

No moving parts at all if you go pico-psu

https://www.newegg.com/Product/Product.aspx?Item=N82E16813157726

http://www.ebay.com/itm/IBM-Intel-I340-T4-Ethernet-Quad-Port-Adapter-94Y5167-49Y4241-/172489524601?hash=item28292d4579:g:1XgAAOSwt5hYfV9W

https://www.newegg.com/Product/Product.aspx?Item=N82E16820233581&cm_re=ddr3l-_-20-233-581-_-Product

http://www.ebay.com/itm/PicoPSU-80-12V-DC-DC-ATX-Power-Supply-w-60W-AC-Adapter-/191942916682?hash=item2cb0b07a4a:g:hqsAAOSw0UdXrdzB

or

https://www.newegg.com/Product/Product.aspx?Item=9SIA24G3RH5343

https://smile.amazon.com/Silverstone-Computer-Front-Panel-SG13B/dp/B00U8IS89E/ref=sr_1_13?s=pc&ie=UTF8&qid=1486056019&sr=1-13&keywords=mini+itx

https://smile.amazon.com/Transcend-Half-Slim-Solid-State-TS16GHSD370/dp/B00OPHX8XK/ref=sr_1_11?s=pc&ie=UTF8&qid=1486056413&sr=1-11&refinements=p_n_feature_three_browse-bin%3A14027456011%2Cp_n_feature_keywords_two_browse-bin%3A4929543011

or with 2.4 coming out your could mirror a pair of USB's in ZFS

https://smile.amazon.com/SanDisk-SDCZ33-016G-B35-2PK-Everything-Stromboli-Lanyard/dp/B00DTZA5S0/ref=sr_1_8?ie=UTF8&qid=1486056220&sr=8-8&keywords=sandisk+cruzer+fit

Whole system, assuming you don't have any parts laying around you can reuse: $222 - $252 depending on whether you want pico-PSU v PSU and USBx2 v SSD.

If you have stuff lying around that you can repurpose then you can save some $ and get a great system. Generally if you sacrifice on the ultra-small form factors that require boards with embedded NICs you will get a lot more performance for a lot less money by using a server pull enterprise grade PCIe NIC.

https://www.amazon.com/gp/product/B004F34ONC/ref=oh_aui_detailpage_o01_s00?ie=UTF8&psc=1

Above is the card I'm using and the below motherboard is the one I'm operating off

https://www.newegg.com/Product/Product.aspx?Item=N82E16813157729

[EDIT] So I get the Newegg board has a Realtek - is the Rosewill ok? The Amazon reviews had people saying that it worked well with pfsense. Note I can only use certain size PCI cards with the board

I just bought this to fit into a 9020:


https://www.amazon.co.uk/gp/product/B01HH5YEKC/ref=ppx_yo_dt_b_asin_title_o00_s01?ie=UTF8&psc=1

​

Got it off ebay but easier to find the item on amazon.

Awesome. I put a build together and will be using the following hardware.

Motherboard

CPU

Memory

PSU

USB Boot Drive

This is my pfsense board. I think it idles around 12w. Peak at boot is something like 20w. Handles my 100mbps down easily.

Intel D2500CCE Atom D2500 Dual LAN & Dual COM Mini-ITX Motherboard, BLKD2500CCE https://www.amazon.com/dp/B006ICQ3FK/ref=cm_sw_r_cp_apa_kOCiybBSPWW79

My server is a supermicro 8 core Avoton with quad gigabit NICs. There is a 4 core version as well.

Supermicro Atom C2758 64GB DDR3 PCIE SATA USB Mini ITX DDR3 1333 NA Motherboards MBD-A1SRI-2758F-O https://www.amazon.com/dp/B00FM4M7TQ/ref=cm_sw_r_cp_apa_gTCiyb913EVZA

Both have been absolutely solid performers and low power consumers.

Your build is way overkill if you ask me and stupidily expensive. You will never see CPU usage above 25%, even with running a VPN as the AES-NI takes care of most of the CPU overhead.

Your mobo is kinda meh, as its a consumer PC board. You should be looking at server grade boards that a built for networking like some of the Supermicro ones.

The 8GB RAM is fine, although you will never see RAM usage anywhere close to 30%, even with running Suricata.

The 250GB SSD is MEGA overkill. The pfSense install is only 4 GB. I have a 30GB SSD and im at only 14% capacity. And thats only because im doing some heavy logging.

And that 400W power supply is gonna kill you on eletricity cost for a 24/7 running firewall.

Have a look at the specs on some of the Firewalls at the pfSense store to get an idea of whats good and fast but not like killing a fly with a bazooka type of system.

Here's my system:

Supermicro A1SRi-2558
Amazon $270


2x4GB RAM @ $90



Supermicro 32GB SataDOM @ $63



M350 enclosure w/ 80 watt picoPSU @ $90

All that came out to $513

I have a 200/20 ISP connection, im running all my traffic over OpenVPN with Suricata on 2 LAN interfaces and my WAN, as well as pfBlocker.

My CPU never goes over 50% and my RAM never goes over 30%.

The one issue with my board is that the although its a quad core, the single core power is kinda weak and ive heard that OpenVPN (which is single threaded) will top out around 300-400 Mbps.

If I was you I would go with this:
Supermicro Motherboard w/ Xeon-D 1508 dual core processor

The single core performance is what will get you to a gigabit VPN performance. Plus it comes with 10G NICS.

Here's a thread I made recently inquiring about that last board I mentioned. Im looking to upgrade sometime in the future when I go gigabit

EDIT: I take that back about VPN speed limit on my mobo. I just upped my ISP speed to 300/30 and I got full speed with only 50% CPU.

Point being, you're going overkill

You need a media converter like this one: https://www.amazon.ca/TP-Link-MC220L-Converter-supporting-mountable/dp/B003CFATL0/ref=sr_1_1?keywords=TP-Link+MC220L&qid=1556187347&s=gateway&sr=8-1

​

My setup is: Bell fiber -> Media Converter -> PFsense . By removing the HH3K, I did loose on download speed a bit (about 80 Mbps of my gigagit) but retained my upload speed at 750 MBps.

​

Hope this will help.

Anyone ever use or know if this would be a good alternative?
Firewall Micro Appliance

I'd like the SG-2440 but price wise :\

Thoughts?

I'm building something similar. I'm currently running pfSense in a VM, but I'm looking to move it to its own hardware (for better reliability, since my network depends on it now).

One thing that comes to mind with your build is that the Celeron 847 does not have AES-NI (http://ark.intel.com/products/56056/Intel-Celeron-Processor-847-2M-Cache-1_10-GHz). I don't know if it could keep up with AES OpenVPN connections at 175/175 without it? (unless you're not using AES for encryption, then AES-NI is irrelevant)

I usually use Intel, but I started looking at AMD for this project because lower-end Intel CPUs don't usually have AES-NI, but lower-end AMDs generally do.

I'm looking at this Motherboard/CPU combo:

http://www.newegg.com/Product/Product.aspx?Item=N82E16813130759

http://www.amazon.com/dp/B00IOMFAQ0/

I use this Protectli system and love it

Firewall Micro Appliance with 6X Intel Gigabit Ports, Intel Celeron E3865U, AES-NI, Barebone https://www.amazon.com/dp/B0741F634J/ref=cm_sw_r_cp_tai_bQ2SBbVQ4Y6CB

I use a Netgear LB1120 ( https://www.amazon.com/gp/product/B01N5ASNTE/) in bridge mode for my LTE failover WAN. Words flawlessly. On the other hand, I have tried USB LTE sticks on a few other things in the past and never had anything ever work the way it should.

Thanks, I meant to include that as well. I was looking at this one, $250 seems reasonable for what the hardware is: https://www.amazon.com/gp/product/B071WFM5RJ/

There are MOCA adapters, just do a MOCA to Ethernet. I use this (got it cheaper then the listed price...on sale) https://www.amazon.com/Actiontec-Bonded-Ethernet-Adapter-ECB6200K02/dp/B013J7O3X0 It works perfectly.

*you want BONDED adapters

You only need ONE MOCA on the pfsense end, I used 1 there and had 3 in other rooms, for a total of 4 MOCA's.

FIOS ONT -> pfSense -> Switch -> MOCA _0 --> [ in wall coax] -> Br1 MOCA -> computer

--> [ in wall coax] -> Br2 MOCA -> Switch -> 4xDevices

--> [ in wall coax] -> Br3 MOCA -> Switch -> 4xDevices

All were getting gig speeds.

​

Even if you used multiple MOCA's on the pfSense end, it would all still be limited by the COAX in the wall, if it didn't conflict.

Actually I was planning on setting the new r710 as a pure pfsense build. While my current one could, I feel like using a headless server to run your network infirstructure can be, well, very bad. Since you need to access it VIA LAN to even make changes. So I do want a dedicated box for it. Currently looking at a this thing though, another user suggested it and I'm just trying to justify a $260 router to myself.

I recently purchased this mini PC for that exact reason. It's small, silent and packs a punch for its size. I was going to get the SG-3100 but I like the fact that this one actually has 4 physical ports in pfSense.


https://www.amazon.com/gp/product/B07FKMJGD6/ref=ppx_yo_dt_b_asin_title_o08_s00?ie=UTF8&psc=1

Connect your computer to the router via an Ethernet cable and do something that causes a bad connection. If you still have problems when you're not using WiFi, it's your router (or ISP). If the problems go away, get a better WiFi AP.

Generally, it's a good idea to have separate devices for your router/gateway, Ethernet switch, and WiFi AP. If one of them breaks, you aren't 100% screwed, and you can easily replace, upgrade, or move one part without worrying about the others (like repositioning/upgrading your WiFi AP, adding a second AP for better coverage, or getting a larger switch for more devices).

If you do have issues with your router, you can buy an old Dell Optiplex 755 desktop on eBay for under $30. Throw in a second $12 Ethernet card for a WAN port, install OPNSense (it's forked from PFSense, but isn't dropping support for slightly older CPUs), connect an Ethernet switch (they're cheap, but be sure to get a gigabit one) and a WiFi AP of your choice, and you have a business-grade network for under $100.

I do not run snort but i can say that the ram is easily upgrade-able. You could also get this version that has 4gb of ram and a quad core.

https://www.amazon.com/Firewall-micro-appliance-Gigabit-pfSense/dp/B01JHJGG5M/ref=sr_1_3?ie=UTF8&qid=1487516929&sr=8-3&keywords=pfsense

Ended up going with this:

BLKD2500CCE Intel Desktop Board D2500CC Innovation Series BLKD2500CCE

M350 Universal Mini-ITX PC enclosure PicoPSU compatible;

Mini Box PicoPSU-150-XT 12V DC-DC ATX power supply

192w AC-DC Power Adapter, 12v 16A


Edit: and grabbed this... cause ya know... maybe 8gb will work, maybe i'll use it for my sophos build after this. aw yeah.

http://www.newegg.com/Product/Product.aspx?Item=N82E16820231294

Edit:

I should def go x64 2.2 right?

Thanks, i thought I had added ECC. Changed it to this.

 

Looking into the cooling issue, seems the case supports 2x 40x40x10 fans. Not much but should be enough?

Would http://www.amazon.com/Supermicro-Atom-C2758-Motherboards-MBD-A1SRI-2758F/dp/B00FM4M7TQ fit the bill?