Messages

[...]the Samsung Pro 830 SSD[...]

Somewhat OT: Straight out of 2013. I have two in my current, waiting-to-be-retired DNS/web/mail server, running since 2014.

Reinstall was surprisingly smooth from usb drive.[...]

Nice.

Have you tried killing the session on the firewall when the issue occurs? Basically just a data point, but it might help determine the point in the protocol stack where the issue lies.

hi am trying to moving from PFSense to OPnSence[...]

If you have the pfSense installation handy you could grab its raw rule configuration and compare it to what you have on OPNsense. I don't know if it's available in the GUI in pfSense; it is in OPNsense. Or there are various standard pf methods (probably the config files would be easiest).

[...]adding IPS/IDS in the future when I start messing around with hosting my email server[...]

I do have some advice here: If you block traffic with the IPS, see if any of the matches affect your systems and watch for false positives. And performance, of course. I ran various IPSs for years (2004-2024); I stopped running one against my servers as I never saw matches that would affect my systems, but I did see false positives on mail messages. I don't bother with it at all these days (with OPNsense). As always, YMMV.

The Core 3 304 does surprisingly well in Passmark. Apparently the unit includes 16GB of RAM. The base UFS storage is fairly large, slow by NVME standards but faster than SATA; I don't know what its endurance is like. It is possible to add an M.2 SSD. According to meyergru the RTL8127 works now, and you can dig through BrandyWine's i226 thread if necessary. The MediaTek MT7922 Wi-Fi is unlikely to be usable in the near term, but I could be wrong. I wouldn't load the firmware driver thingie. YMMV.

CNX has a review. His benchmarks are interesting - performance is a bit uneven, likely due to the core arrangement (1P 4LPE) and long-term power limit.

I don't have advice, as I have no experience with similar hardware (or Internet service, thus far).

It only counts pass matches... most of the time. I don't think I ever characterized it fully, and I've forgotten the details. How are the aliases you are testing applied?

It appears to be a pf issue. I don't have a convenient way to test UDP (e.g. traceroute, where the application will report unreachables clearly), but TCP returns RST. I'm too lazy to run a capture. ICMP, as you noted, appears to return nothing. I do not know offhand if the "blackhole" sysctls affect this, as I have them... unholed; I don't see an ICMP sysctl offhand that would affect unreachables (other than net.inet.icmp.icmplim).

A search turned up a couple forum posts on the issue (other than this forum); I didn't try to dig into bug reports.

Edit: Ha! lmoore's post - I use bridges, so that appears to be my issue at least. Interesting.

Does "ifconfig -v" show anything different for the SFP when the DDP is loaded vs. not? It's a reach: looking for SFP vendor lock.

Edit: My e810 doesn't appear to have a vendor lock (I don't have anything within reach to plug it into); the ice driver seems to complain more than ixl (so a silent issue seems unlikely... but I could be misremembering the vendor lock behavior).

[...]Could it depend on the SFP+ module I chose?[...]

So long as the interface clocks are sync'd there should not be a silent condition that would affect speed (and async clocking seems unlikely, particularly at 10Gb). You could fall down a component testing rabbit hole... which might be enlightening, but would certainly be expensive.

The "1.9W" spec (for the UACC-CM-RJ45-MG) looks decent. I wonder what chippie they use (guessing RealTek). I don't think "ifconfig -v" would give anything more than the product ID.

Speaking of "silent", how does netstat look? Anything untoward?

[...]Modern motherboards show no signs of life if the battery goes below 2.5V.[...]

I haven't had a problem with mine (a few Asrock, Asus, Gigabyte, and Supermicro boards). I've noticed that most eat batteries when powered off (5 year life at best), and one Asrock Rack board eats them in no time (perhaps a year). It boots fine, though - the only obvious symptom is the time (it has few meaningful configuration options).

I wish the bloody things used flash for configuration (active as opposed to backup, and some of mine are old enough to lack even that). A (convenient, supported) bigger battery option would be nice, too (e.g. 2 AA). Oh, context: I like to use systems for 10+ years these days. Advances in compute just aren't as exciting as they were 25+ years ago.

it's shocking to me that i'm the only one experiencing this samplicate issue.[...]

You may have just hit an edge case for your particular platform. There are many possible aspects to this; two are code design and optimization. The latter is less of an issue, but pretty simple - I don't know what target architecture the OPNsense team compiles against, but I doubt it's "Excavator". The former just evolves. Intel began adding read/write ports and branch units with Haswell; AMD didn't catch up until Zen 3. These (in particular) can have an outsized effect with some code. I can run (much) modern (x86-64) software on my old Opteron from 2008 - slowly - but it's pretty easy to find edge cases that just flatten it. I imagine your AM4 A12 is a lot more common (older HP/Dell/etc. boxes are generally a good value option)... but in relative terms only.

[...]Instead, I have an AppleTV4K and a Chromecast
[...]
I have zero trust in any of the smart TV's native operating systems nor the apps that run on them.

Heh. The lesser of two evils? (I imagine your practical choices are limited; I don't pay attention to that class of devices.)

Thanks, Steve.

Sure, just run all connections through the firewall. I do this. In general you just need enough compute power in your firewall (varies by application) and appropriate connectivity (e.g. lots of ports on the firewall and/or virtual ports via one or more managed Ethernet switches).

I jail my TV (connect it to a port on the firewall that does not allow outbound communication), as I do not use any "smart" features. I connect it (to Ethernet) to try to dissuade it from connecting to open wi-fi... which may or may not be effective (I believe it is, as my TV is fairly old). I'd remove the wi-fi module, but that effectively disables the remote (which I use occasionally).

I'd expect a log like that to be due to "Firewall: Settings: Normalization" -> "Disable interface scrub", also visible under "Firewall: Diagnostics: Statistics" -> "rules", "rules" -> "filter rules", usually the top entry. I believe you can allow options via rules: check "allow options" under "Advanced features".

Support Documents and Downloads

Edit: Verifying... Sheesh, the lousy search, "download agreement" and file format (tgz inside zip)... painful.