Messages

I'm thinking maybe the best approach would be to set up a HE.net IPv6 tunnel ONLY for the phone system, and reverting the rest of the network back to IPv4 only until such time as the ISP get their act together on IPv6.

L2TP is indeed present in the webUI, and GRE is what I used for the HE.net tunnelbroker back when I used it before, and I wouldn't be opposed to using it again, if I can get IPv6 addresses/prefix that geolocate to the UK and are registered to a UK entity to avoid sites getting upset that I appear to be in America (primarily online banking and can also affect streaming like iplayer)

Hi Forumites,

I'm looking into getting FTTP at home, however there is only one single provider at this location (v. rural postcode in North West England, the FTTP provider is an altnet that deployed with public money because we aren't 'commercially viable' for Openreach or anybody else). Unfortunately this provider uses the abomination known as CGNAT, which can be avoided on their business packages by taking the static IP option, but they do not (yet, they said it's planned but they can't give a timeframe) offer IPV6, which I need because the house phone system doesn't work over IPv4 NAT.

I have in the past used HE.net tunnelbroker for IPv6, however it caused quite a few different sites to have tantrums because the IPv6 address geolocated to America and not the UK.

There is a small 'specialist/enthusiast' ISP in the UK that offers an L2TP tunneling service for the express purpose of allowing customers of other ISPs to bypass CGNAT and also gain IPv6 connectivity when they can't otherwise.

My query is, therefore, given that the FTTP provider almost certainly uses PPPoE authentication (UK ISPs seem to love it rather than use the superior more modern alternatives), is it possible to set up an L2TP tunnel such that it runs over the top of the PPPoE WAN link, and if so do I need to do anything special to make it happen?

Alternatively, if anyone knows of a tunnelbroker that can provide UK geolocated IPv6 addresses, then that would certainly be an option.

Thanks all.

well an update: (very late but i've had so much else going on...)

I obtained the necessary packages (drm-61-kmod and gpu-firmware-intel-kmod-alderlake) from pkg on my FreeBSD server, SCPed them to my Opnsense box, put them in the pkg cache directory and then installed them using pkg with local file paths (firmware first). kldload drm-kmod then worked, and resulted in an immediate decrease in power draw (measured at the dc jack) of half a watt before any tuning.

As suspected, the 127 'dependencies' are mostly unnecessary, as is the firmware metapackage. Only the relevant firmware package is required.

Still need to play with tuning and also whether the vesa driver makes any difference.

I haven't been able to get the intel driver to compile on opnsense so far, and I'm actually very limited in what testing I can do at present due to being in the middle of a home office renovation, so I'm primarily working from online documentation etc at the moment, but I see nothing related to gpu in kldstat so I don't think there's any sort of driver loaded currently.

this isn't an atom, it's an alder lake refresh, so basically 12th gen but only e-cores, no p-cores. It's a substantially changed microarch since previous gens so that might be playing into it also

unfortunately, I would never consider virtualising a firewall appliance, it's something that's always been a kind of red line for me, My approach and belief is that it needs to always be a bare metal, dedicated machine that runs nothing else in order to have the minimal attack surface possible.

I do have a UK type AC inline meter (I believe what Americans know as a 'kill-a-watt', other brands are available), but even better, I have an Odroid Smartpower3, which is a power supply and meter specifically for low voltage DC such as SBCs. It can actually be quite surprising how different the readings are from the AC in-line once the actual wall-wart/brick is removed from the equation (ultimately my FW will be on PoE, powered upstream by a very high efficiency PSU, as part of my dad's drive to reduce the number of Chinese made wall-wart power supplies in the house, as they're very often a fire risk), and of course the AC in-line meters are generally considered to be less accurate at very low wattages. If nothing else the Smartpower shows way more variation than the AC meter. TBH I think I would trust the Smartpower more than the AC meter for this sort of task.

Hmm on my n100 unit I have seen an option to disable the GPU, but honestly I don't remember if it was for iGPU or eGPU as you mentioned.

It's entirely possible, bios options vary wildly between systems and even bios versions

Maybe I am missing something, but

Why not disable the GPU in BIOS?
For OPNsense you don't need the GPU.

Regards,
S.

BIOS doesn't allow disabling IGPU unless there's a discrete card present, and in any case I don't want it completely disabled in case I need console access.

hmm, having looked at the freshports entry for gpu-firmware-kmod, all the dependencies are firmwares for individual gpu cards. So it *SHOULD* only need the one that's appropriate for the system it's being built on, with the rest being completely irrelevant. Wonder if that might be a way forward,

Would it possible to add the Intel i915 GPU drivers/firmware(DRM-KMOD) to Opnsense, either as a plugin or as part of the base install? I completely understand how ridiculous it sounds wanting GPU drivers on a headless FW appliance, but please bear with me.

I have been trying to get my firewall power usage as low as possible, and trawling the net, it would appear that the GPU driver and firmware are required in order to put the GPU into a low power state, otherwise it just burns power (anecdotal evidence on the net suggests up to 3W, which on my N-series appliances could be as much as a third of the total power draw) for no reason.

This matters to me because, as a Brit, I am lucky (HA) enough to live in the country with the most expensive electricity in the world (apparently), and it's only going to get worse. 3W 24x7 over a month is just over 2kW, which is an additional £0.50p+ a month on an electric bill for absolutely no benefit. Multiply by 12 months and it starts to get a bit ridiculous considering that 3W is doing absolutely nothing useful.

Secondly, my firewall appliances are passively cooled. The GPU is putting extra load onto the heatsink for no good reason. Being able to tell it to go away or at least sleep could well bring the system temperature down by a few degrees, which is good for the longevity of the hardware, and would also be beneficial for people living in places with relatively higher ambient temperatures where passive cooling isn't as effective.

I've tried to add drm-61-kmod using ports but the build failed part way through with a nonspecific error.