• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

pfSense performance for inter-VLAN routing

M

Meeho

Supreme [H]ardness
Joined
Aug 16, 2010
Messages
6,110
I'm planning a home network with an Ubiquiti 48-port EdgeSwitch and having APs, IP cameras, HTPCs, office computers, printers and two servers (for NAS and ESXi) connected to it. The NAS and ESXi box will be connected to the switch with 2x 1Gbps LACP links each. ESXi will run pfSense among various other VMs.

The network will be segmented with multiple VLANs and I'm planning to do all the security, MAC access, firewall, and Internet and inter VLAN routing on the pfSense. What kind of hardware would the pfSense VM need to not be a limiting factor in the network? I'm planning to have the ESXi run on an i7-5820K. When it comes to CPU recommendations for pfSense all I can find are mentions of Internet connection speeds, but I'm not sure how the LAN traffic and VLAN routing factor into this. Will this mean that all my home network traffic will have to pass through pfSense?

Is there a reason and benefit to do any of this on the switch itself? I know it has some Layer 3 capabilities, but not sure if they slow it down or are limited in some way compared to doing it with pfSense.
 
If your virtualizing pfSense, you can just adjust the number of cores available to it easily. For that amount of network traffic, one core on that 5820 will probably be more than enough.

All of your home traffic going through pfSense depends on how you set up your LAN. It can handle it, if you set it up that way, or it can just handle specific VLANs as you require.

The benefit of having your security on separate hardware is that it can filter out intrusions/malware/etc before it even hits your secure LAN. You can do that with PFSense as well, so long as you have a dedicated NIC, but the "contaminated traffic" is still going to hit your hypervisor hardware in one way or another.

That's probably ok for most people and most situations, as most generic attacks are just going to try to go through pfSense (which can be set up pretty secure). I'm not saying it's not possible, but it would take a pretty specific attack to go around and attack a hypervisor. It's possible, but certainly not your common run-of-the-mill thing.
 
As for the virtualization, it will probably be ok for a home network. It saves me from buying another box and should be secure enough.

I was going by https://www.pfsense.org/hardware/ recommendations where they state multiple cores at > 2.0GHz for 501+ Mbps. My peaks could be over 2 Gbps, though very rare.
 
Are you applying full security for inter vlan routing or just want to use the pf sense as a gateway? If you're only firewalling the Internet from the internal network and just routing the vlans you'll have no problem with bandwidth. You mentioned something in your post but I wasn't clear if you were doing full security on inter vlan traffic
 
Eickst said:
Are you applying full security for inter vlan routing or just want to use the pf sense as a gateway? If you're only firewalling the Internet from the internal network and just routing the vlans you'll have no problem with bandwidth. You mentioned something in your post but I wasn't clear if you were doing full security on inter vlan traffic
Click to expand...

The idea is to have several VLANs for basic security:

  • NAS
  • cameras
  • APs (one VLAN for management, one for my devices, one for guests)
  • HTPC (some of the ethernet ports in the house)
  • main LAN for PCs (the rest of the ethernet ports)
  • office

This way they will be separated from each other and NAS will only be accessible through pfSense. My main concern with this is having the LAN ports throughout the house exposed to guests. That's why I was thinking of adding IP and MAC filtering on pfSense to only allow specific devices on the LAN. That seemed like the max I can do without complicating things further with RADIUS servers and similar.

What specifically do you mean by just routing vs full security and how do they differ regarding bandwidth requirements?
 
Last edited:
For comparison sake, my main pfsense firewall has a Core2 Duo E4500 and it does inter-vlan routing fine. I was testing the other day and getting close to saturating the gig link with iperf. I personally would not virtualize pfsense, that means exposing your VM server directly to the internet. If there's some kind of exploit in the way it operates it could potentially expose internal VMs.
 
You must log in or register to reply here.
Back
Top