pfSense - Netgate RCE-V 2440 thread

[kvic]

My pings were wired. From an ArchLinux GbE integrated-NIC, through my RT-N66U, to my pfSense GbE Intel NIC.

Over wire makes more sense but still much faster than my wire ping.

My thinkpad (broadcom GbE) connects to RT-AC56U over wire. In Debian Jessie, ping time is about 0.3ms.

 

[sfx2000]

You guys have fast ping...about as fast as my ping over wire if not faster. Does pfSense really make such a difference? Hmm..

I didn't think it was all that fast - just have a reasonably designed network in the first place and not a lot of unneeded stuff on it...

 

[oletuv]

Now that every man and his dog is converting to pfSense as firewall/router I´m following this thread with great interest. SFX is an experienced and knowledgeable IT guy and it´s exciting to share his experience with implementing a pfSense configuration.

I´d like to buy a pfSense box from pfsense.org or netgate.com myself to support the project, but living in Norway I find it better to shop locally with local guaranty. Therefore I´m looking into buying a Supermicro A1SRi-2758F (Atom Rangeley SoC) prebuilt Mini-ITX pc. I can get it from Nextron, the official Norwegian Supermicro distributor, fully assembled and tested with 5 years warranty.

 

[sfx2000]

I wouldn't suggest every man and his dog to jump into pfSense - seriously - there's a lot of knobs and levels to tune and tweak, well beyond what most folks want to know or care about... and a lot of ways to get into trouble and have a poor end-user experience...

The Netgate solutions are bare bones and well engineered - rightly sized and ideal for pfSense or other solutions (perhaps), especially tailor made for pfSense deployment.

I do encourage folks to go for the branded solution, pfSense as the pfSense branded devices do directly support the pfSense community effort - and they're a more "turn-key" solution - same hardware, but pfSense is pre-installed, and there's an entitlement for professional support, which the Netgates don't have - don't get me wrong, but Netgate is more focused on the development side of the house - and there, the Netgate is a good option.

 

[kvic]

Now that every man and his dog is converting to pfSense as firewall/router I´m following this thread with great interest.

I only saw a handful of people who run or intend to run pfSense here. For home use, I would think ER-X/ER-L or a <$300 mikrokit are better suited.

But I'm interested in pfSense 3.0 for multi-gigabit home internet.

 

[sfx2000]

I was using latency in the general sense. It would be nice to have a pfsense compared on the router graphs here since they are our standard. The faster the clock the less latency between clock tics. This is small but there are lots of things which impact latency. I guess you can add instruction set and the quality of programming, etc. By instruct set I mean some CPUs can preform an operation in one clock tic whereas other CPUs may take several clock tics. Over all it makes a difference. The end result is what they can do on the router graphs which is the sum of all things for that device.

Does this help? Took a little while for the network to settle, but things are looking ok...

 

[sfx2000]

I only saw a handful of people who run or intend to run pfSense here. For home use, I would think ER-X/ER-L or a <$300 mikrokit are better suited.

But I'm interested in pfSense 3.0 for multi-gigabit home internet.

Any FOSS router distribution - pfSense, OpenWRT - with great power, comes a steep learning curve, and very fine grained control over the network.

For a turn-key solution - I would agree - ERL/ERX, along with MicroTik, these are also good solutions...

 

[oletuv]

I wouldn't suggest every man and his dog to jump into pfSense - seriously - there's a lot of knobs and levels to tune and tweak, well beyond what most folks want to know or care about... and a lot of ways to get into trouble and have a poor end-user experience...

I guess some of the add-on packages can be tricky, but honestly the basic/general setup seems straightforward and the web GUI interface looks very nice to me, especially the new 2.3 (RC) version.

I find Mark Furneaux´s YouTube videos an excellent introduction to pfSense for new users.

 

[coxhaus]

I just upgraded to pfsense 2.3. It took about 3 minutes. Everything seems normal.

 

[sfx2000]

I just upgraded to pfsense 2.3. It took about 3 minutes. Everything seems normal.

Saw that - can't do it right now, as it's a reboot, and will disrupt services...

 

[sfx2000]

2.3 upgrade/update/fresh install comments should go here...

[Talk] - pfSense 2.3 release/upgrades

 

[sfx2000]

Saw that - can't do it right now, as it's a reboot, and will disrupt services...

Was thinking about it last night, but had a broadband outage that was a bigger problem..

in any event, I'll probably wait a bit - but feel free to relate any experiences on the [Talk] thread I set up.

 

[sfx2000]

The Sophos UTM community seem to like the RCC-VE 2440 as well...

https://community.sophos.com/products/unified-threat-management/f/52/t/30022

Anyways, pfSense 2.2.6 on the 2440 is running great here at the house... I really have no complaints so far regarding the HW - Netgate/ADI did a very nice job on this one...

 

[sfx2000]

Fun stuff - I typically don't B1T0rr3nt (sorry, avoiding keyword traps here) - pulling down and sharing/seeding the 16.04 ISO...

No impact to downstream/upstream traffic... states table, you can see a fair amount of connections there...

 

[sfx2000]

Lot's of folks feeding at the trough... It's the Ubuntu 16.04 release, so pretty popular - but pfSense, as you've seen above, it's just fine... at these loads, many consumer Router/AP's just fall over, or need to be rebooted after the firehose to recover...

(and yes, overall, I could do better with t0rr3nts, but so very rarely do I do this...)

Going into the shell on pfSense - no sweat...

 

[coxhaus]

I noticed you are not using resolver for DNS but DNS forwarder. When I tried DNS resolver my wife's iPhone 6s had issues of slow downs. Did you try it?

I also noticed you have pfsense setup to answer all DNS requests regardless of which DNS server is requested. Do you like this feature? I locked my pfsense to only 2 DNS servers. You don't work unless you use my DNS servers. Of course my preferred DNS servers are handed out by DHCP so as long as you don't change them they will work.

 

[coxhaus]

If you look under your system information, I am looking at the one you posted, has 127.0.0.1 under DNS which is there to accept all DNS requests and forward to your Google DNS servers. I don't have the 127.0.0.1 defined on my system. I removed it. You may have it defined and not working. You can test it by defining some other external DNS server on a client and do a DNS lookup. If pfsense answers then it is working. If it times out then it is not working which means there is a problem with your config in pfsense.

You may not want this feature if you want to override DNS entries with a client. It depends.

 

[sfx2000]

If you look under your system information, I am looking at the one you posted, has 127.0.0.1 under DNS which is there to accept all DNS requests and forward to your Google DNS servers. I don't have the 127.0.0.1 defined on my system. I removed it. You may have it defined and not working. You can test it by defining some other external DNS server on a client and do a DNS lookup. If pfsense answers then it is working. If it times out then it is not working which means there is a problem with your config in pfsense.

You may not want this feature if you want to override DNS entries with a client. It depends.

Works fine here - and I had to double check - Resolver is Enabled, and Forwarder is disabled in my config...

dig smallnetbuilder.com from my laptop here - explicitly set to override DNS provided by DHCP...

dig smallnetbuilder.com

; <<>> DiG 9.8.3-P1 <<>> smallnetbuilder.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51236
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;smallnetbuilder.com.        IN    A

;; ANSWER SECTION:
smallnetbuilder.com.    300    IN    A    104.25.62.25
smallnetbuilder.com.    300    IN    A    104.25.63.25

;; Query time: 33 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Fri Apr 22 05:32:31 2016
;; MSG SIZE  rcvd: 69

 

[Nullity]

I originally added 127.0.0.1 because it (sometimes...) fixed a bug where pfSense could not resolve DNS for the pfSense update check. I think it was fixed, but I left it anyway, partly because I use NAT to force all DNS queries to dnsmasq.

 

[coxhaus]

I

Works fine here - and I had to double check - Resolver is Enabled, and Forwarder is disabled in my config...

dig smallnetbuilder.com from my laptop here - explicitly set to override DNS provided by DHCP...

dig smallnetbuilder.com

; <<>> DiG 9.8.3-P1 <<>> smallnetbuilder.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51236
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;smallnetbuilder.com.        IN    A

;; ANSWER SECTION:
smallnetbuilder.com.    300    IN    A    104.25.62.25
smallnetbuilder.com.    300    IN    A    104.25.63.25

;; Query time: 33 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Fri Apr 22 05:32:31 2016
;; MSG SIZE  rcvd: 69

So you are using DNS resolver not DNS forwarder. I think there is some kind of contradiction in your setup or my understanding. Resolver works from the root DNS servers. You should not have it pointed to Google DNS servers if you use DNS resolver. If you want to lock pfsense to google DNS servers you need to use DNS forwarding not DNS resolver. I could be all wrong about this but this is my understanding reading on pfsense forum. Maybe this is why I had trouble with DNS resolver.
PS
I will post a link in a minute from pfsense forum. Interesting I can't link to pfsense.org right now.


Non-authoritative answer:
Name: pfsense.org
Addresses: 2610:160:11:11::69
208.123.73.69


C:\Users\lee>ping 208.123.73.69

Pinging 208.123.73.69 with 32 bytes of data:
Reply from 208.123.73.4: Destination host unreachable.
Reply from 208.123.73.4: Destination host unreachable.
Reply from 208.123.73.4: Destination host unreachable.
Reply from 208.123.73.4: Destination host unreachable.

Ping statistics for 208.123.73.69:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Anybody else seeing this?