Messages

I'm neither a security expert, nor a paranoid dabbler. So for me Sensei protection is optimal.

See https://teklager.se/en/knowledge-base/opnsense-performance-optimization/

You have to edit /boot/loader.conf.local and also set up as parameters through the GUI.

E.g. my file is:

Code Select Expand


#cpu_microcode_load="YES"
#cpu_microcode_name="/boot/firmware/intel-ucode.bin"
# agree with Intel license terms
amdtemp_load="YES"
ahci_load="YES"
aesni_load="YES"
if_igb_load="YES"
flowd_enable="YES"
flowd_aggregate_enable="YES"
legal.intel_igb.license_ack="1"
legal.intel_ipw.license_ack=1
legal.intel_iwi.license_ack=1
# this is the magic. If you don't set this, queues won't be utilized properly
# allow multiple processes for receive/transmit processing
hw.igb.rx_process_limit="-1"
hw.igb.tx_process_limit="-1"
# more settings to play with below. Not strictly necessary.
# force NIC to use 1 queue (don't do it on APU)
# hw.igb.num_queues=1
# give enough RAM to network buffers (default is usually OK)
#kern.ipc.nmbclusters="1000000"
net.pf.states_hashsize=2097152
#hw.igb.rxd=4096
#hw.igb.txd=4096
#net.inet.tcp.syncache.hashsize="1024"
#net.inet.tcp.syncache.bucketlimit="100"
#kern.smp.disabled=1
#hw.igb.0.fc=3
#hw.igb.1.fc=3
#hw.igb.2.fc=3
hw.igb.num_queues=0
#net.link.ifqmaxlen="8192"
hw.igb.enable_aim=1
#hw.igb.max_interrupt_rate="64000"
hw.igb.enable_msix=1
hw.pci.enable_msix=1
hw.igb.rx_process_limit="-1"
hw.igb.tx_process_limit="-1"
#net.inet.ip.maxfragpackets="0"
#net.inet.ip.maxfragsperpacket="0"
#dev.igb.0.eee_disabled="1"
#dev.igb.1.eee_disabled="1"
#dev.igb.2.eee_disabled="1"
vm.pmap.pti = 0
hw.ibrs_disable = 0
hint.p4tcc.0.disabled=1
hint.acpi_throttle.0.disabled=1
hint.acpi_perf.0.disabled=1
hint.p4tcc.1.disabled=1
hint.acpi_throttle.1.disabled=1
hint.acpi_perf.1.disabled=1
hint.p4tcc.2.disabled=1
hint.acpi_throttle.2.disabled=1
hint.acpi_perf.2.disabled=1
hint.p4tcc.3.disabled=1
hint.acpi_throttle.3.disabled=1
hint.acpi_perf.3.disabled=1


Well, I don't do Snort/Suricata since all my ports are closed and stealth by default.

NTP is an IPv6 lover. So, if you don't have a working IPv6 connection and you didn't disable IPv6, then it fails to work.

Have you noticed, there has just been issued a patch for FreeBSD kernel and pf.ko?

https://www.freebsd.org/security/advisories/

Compile the driver yourself. It's not that difficult.

I think it easily handles that speed. I have an 1 GHz processor and it handles around 300 Mbps (maybe 320) with Sensei in normal mode. I found that isn't enough for my 500 Mbps, so I connected two network cables from my modem/router to WAN and OPT1 and I made Sensei bridge OPT1 to LAN.

You may use any DNS server you wish (yes, even DoT and DoH). Sensei does not care about which DNS server you use.

Asus routers have an IPv6 configuration called Passthrough. Maybe Opnsense should get something like that.

Those also have an option called FLET'S IPv6 Service.

If you know Asuswrt Merlin, you may ask Merlin how to do it, he develops third-party firmwares for Asus routers.

Making progress: dropped the USB WiFi, changed the protected bridge to (WAN:igb2,LAN:igb1), i.e. OPT1 is the bridged WAN gateway for LAN. igb0 (normal WAN) remains main WAN gateway.

I no longer have control over APU2 through Ethernet, but Sensei can be stopped remotely (cloud) for performing maintenance tasks upon APU2.

Attached USB WiFi device rsu0_wlan1 , made it a gateway (I have now 3 single gateways on my APU2), edited /etc/wpa_supplicant.conf so that it directly connects to the WiFi of my modem/router, made a script to start wpa_supplicant in daemon mode and give rsu0_wlan1 a fixed IP from the range of my modem/router, started Sensei service, and it works.

The WiFi gateway shows as defunct (upstream), but it does not matter, it works!

Script is:

Code Select Expand

#!/bin/sh
wpa_supplicant -B -i rsu0_wlan1 -c /etc/wpa_supplicant.conf
sleep 15
ifconfig rsu0_wlan1 192.168.180.2 255.255.255.0 192.168.180.1


https://sunnyvalley.cloud/firewalls/ shows "Node not connected".

Made OPT1 a gateway, so I restored internet access. But after starting Sensei in bridged mode I can no longer access APU2.

So, my APU2 seems no longer working without Sensei in bridge mode.

I tried everything, including restoring older config files.

And the APU2 no longer connects to the internet, not even for updating Sensei.

In the hosted mode, I got about 300 Mbps download speed with Sensei enabled, on an APU2C4.

I switched to bridged mode and I get 518 Mbps download speed (my connection is 500 Mbps nominally, so I cannot test higher speeds).