Re: Suggestions for low-power gigE firewall?

On Tue, Jun 17, 2014 at 5:03 PM, Tom Evans <[e-mail]> wrote:

> On Sun, Jun 15, 2014 at 10:08 AM, Peter Jeremy <[e-mail]> wrote:
> > On 2014-Jun-13 08:17:33 -0400, Chris Nehren <
> [e-mail]> wrote:
> >>Speaking of Soekris elsethread, I'm presently interested in
> >>picking up a small device to use as a router + firewall for my
> >>home network.
> >
> > One thing to keep in mind is that 'gigE firewall' is fairly meaningless
> by
> > itself.  Most of the load is per-packet and GigE could be anywhere
> between
> > (roughly) 80kpps and 1.5mpps.
> >
> > That said, since you mention 'home network', I presume you don't need
> complex
> > packet manipulation at wire-speed.  Note that whilst the re(4) driver
> doesn't
> > have the same comments as the rl(4) driver, you will still need
> significantly
> > more CPU power to get the same thruput from a RTL8111 as (eg) an em.
>
> This is quite interesting to me; I'm very fortunate in that my ISP
> provides synchronous gigabit, which comes in to my block of flats as
> fibre and then is presented to me as ethernet.
>
> The ISP provided a router; they also noted that the router was not
> capable of utilizing the whole connection, and the most that I could
> achieve out of it would be ~ 800-900Mbit. Plus, although it's a pretty
> good router, I want to run my own dhcpd settings, configure tunnels
> and VPNs etc.
>
> Ideally, I'd replace it with my home server, but there is not enough
> space in the "comms room" (aka the washing machine closet) to put that
> there, and not enough wiring to route the WAN connection to where the
> server is now and then back to the patch panel in the comms room to
> distribute throughout the flat.
>

Without knowing the exact cabling arrangement, have you considered buying a
small switch that understands vlan? Then you could do some trickery with
that to have your server elsewhere (with just one ethernet cable)?

>
> The next best would be to replace it with a small Soekris style box
> running BSD that can fit in the comms room - but how to know what will
> be sufficient, or even where the bottlenecks would be - is it pps that
> is the issue, or is NAT at high throughput going to be a problem? And
> how to measure my current usage?
>
We haven't done any testing of the different NAT solutions available so I
can't give any specific numbers there. But I don't think it will help
throughput, especially old school natd in userspace.

A colleague of mine also has 1Gbit/s home, and he hade to tweak the
settings and buy a decent intel card to get 900+Mbit/s on his old dell
entry level desktop.

>
> If I'm "filling" my GigE, then it is probably because I am downloading
> something, which means it's unlikely to be hundreds of thousands of
> small packets, right?
>

Sure, they shouldn't be.

Best regards
Andreas


> Talk about first world problems!
>
> Cheers
>
> Tom
> _______________________________________________
> [e-mail] mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "[e-mail]"
>
_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[e-mail]"