Are software LAN bridges a bad thing to do with OPNsense vs external switch

[logi]

I ask, because with Intel x86 devices, each ethernet port is independent, as opposed to ARM devices where all the ethernet ports internally are connected as a switch, so for an x86 appliance (Protectli VP2420), OPNsense will have to build a software bridge with all the Ethernet ports, that will have a CPU cost, vs using an external hardware switch (Netgear GS108Ev3), they are cheap and efficient, thoughts? Thanks

[Patrick M. Hausen]

They will work fine unless you want to get all fancy with VLANs etc. If you simply want to replace a consumer router with OPNsense and have e.g. 1 WAN and 3 LAN ports without an extra switch, the FreeBSD bridge just works.

Its performance was improved by a factor of 5 or greater and with gigabit interfaces the bridge will not be your limiting factor.

https://freebsdfoundation.org/blog/500-if_bridge-performance-improvement/

[mattlach]

Bridges work.

They may not perform quite as well as a switch, which has a lot of hardware acceleration specifically for the switching task, but from a functional perspective they are not a problem.

You may just see:

1.) Slightly higher latency than you would with a hardware switch
2.) Slightly lower throughput than you would with a hardware switch
3.) Slightly higher CPU use on the machine running OPNSense
 
If you can live with the above downsides, there really is not a problem.

Also worth noting, some of this is historical (particularly #2) as with modern hardware a bridge can probably saturate gigabit just fine, though admittedly I haven't tested in a long time.

To be fair, it is still not best practice, and you will still find a lot of people online telling you not to, but a lot of the concerns stem from back in the day with weaker hardware.   If you have a modern system running OPNSense chances are you won't even notice, but YMMV.

I'd test it with your hardware, see what performance you get, see how much CPU load you get, compare your latencies (ping) across the bridge and then decide if this is something you can live with, or if it warrants spending the extra money on a switch.

That said, as long as you don't need a managed switch with VLANs and other managed capabilities, you can get a very basic switch dirt cheap switch, and they don't use a notable amount of power either.

I still prefer actual switches for everything myself, but that is mostly from a historical perspective and a possibly misguided sense of it being "right".

The only place I use bridges is on my KVM/LXC host as I need the individual guests to have their own IP's.   

(My NIC's technically support SR-IOV which could allow me to achieve the same goals but with hardware acceleration rather than bridges  and gain a little performance and reduce a little CPU overhead, but I haven't gotten around to setting it up.  I've been thinking about doing it for going on a decade now, but I never quite seem to get around to it...    )

[bimbar]

Yes. A significant amount of support questions in this forum are from people trying to use the bridge.
I think it's not a good idea. Switches are cheap.

[logi]

Thank you for the feedback

[Greg_E]

If possible, I would go with a cheap switch. If not possible, then Bridge is your only choice.