pfSense Firewall Plus Appliance Guidance

The following outlines the best practices for choosing the appliance best suitable for your environment.

pfSense Firewall Feature Considerations

Most features do not factor into hardware sizing, although a few will have a significant impact on hardware utilization:

VPN – Heavy use of any of the VPN services included in the pfSense software will increase CPU requirements. Encrypting and decrypting traffic is CPU intensive. The number of connections is much less of a concern than the throughput required. AES-NI acceleration of IPsec significantly reduces CPU requirements on platforms that support it.

Captive Portal – While the primary concern is typically throughput, environments with hundreds of simultaneous captive portal users (of which there are many) will require slightly more CPU power than recommended above.

Large State Tables – State table entries require about 1 KB of RAM each. The default state table size is calculated based on 10% of the available RAM in the firewall. For example, a firewall with 1 GB of RAM will default to 100,000 states which when full would use about 100 MB of RAM. For large environments requiring state tables with several hundred thousand connections, or millions of connections, ensure adequate RAM is available.

Packages – Some of the packages increase RAM requirements significantly. Snort and ntop are two that should not be installed on a system with less than 1GB RAM.

pfSense Firewall Hardware Requirements and Guidance

The following outlines the minimum hardware requirements for pfSense software version 2.x. Note the minimum requirements are not suitable for all environments. You may be able to get by with less than the minimum, but with less memory you may start swapping to disk, which will dramatically slow down your system.

pfSense Firewall Network Card Selection

Selection of network cards (NICs) is often the single most important performance factor in your setup. Inexpensive NICs can saturate your CPU with interrupt handling, causing missed packets and your CPU to be the bottleneck. A quality NIC can substantially increase system throughput. When using pfSense software to protect your wireless network or segment multiple LAN segments, throughput between interfaces becomes more important than throughput to the WAN interface(s).

NICs based on Intel chipsets tend to be the best performing and most reliable when used with pfSense software. We therefore strongly recommend purchasing Intel cards, or systems with built-in Intel NICs up to 1Gbps. Above 1Gbps, other factors, and other NIC vendors dominate performance.

pfSense Firewall CPU Selection

The numbers stated in the following sections can be increased slightly for quality NICs, and decreased (possibly substantially) with low quality NICs. All of the following numbers also assume no packages are installed.

Remember if you want to use your pfSense installation to protect your wireless network, or segment multiple LAN segments, throughput between interfaces must be taken into account. In environments where extremely high throughput through several interfaces is required, especially with gigabit interfaces, PCI bus speed must be taken into account. When using multiple interfaces in the same system, the bandwidth of the PCI bus can easily become a bottleneck.

pfSense Firewall Hardware Compatibility List

As pfSense is based on FreeBSD, its hardware compatibility list is the same as FreeBSD’s. The pfSense kernel includes all FreeBSD drivers.

Get support from the team who knows pfSense^® software best. With Netgate^® Global Support, we have more than just an expert knowledge of pfSense solutions. The Netgate team is the host of the open source pfSense firewall project and contributes leadership, engineering, test, and infrastructure assets to the project. We have the most informed and capable people to help you with any pfSense installation, deployment, or configuration issue. If you purchase your hardware appliance directly from us, our support team will be more empowered to provide end-to-end solutions which encompass the hardware or the firewall application.

PROFESSIONAL SERVICES

We know the challenges you face are complicated. Netgate staff can help you implement effective solutions to solve those problems. We will help you plan, design, implement, operate, and manage the right technology strategy to improve the way you do business. From network security to high-availability to firewall conversions, we provide effective solutions so you can focus on running your business. Find out more at the Netgate website.