recommendation to increase swap file during opnsense installation

[scalaechlon]

Good day,

it seems a lot of performance issues involves opnsense performance can be directly linked to memory and swap file allocation

1. when considering a production grade opnsense build, it is preferred that physical memory must be 8Gb (or higher) coupled with a high bus rate to effectively accomodate many of opnsense features and plugins

2. when facing on budget constraints on implementing production grade builds, it is best to have 4Gb physical memory with high data bus speed

3. always remember that you have to increase the swap file capacity to at least four times the physical memory amount

the three above recommendations are considered because opnsense heavily relies on memory intensive processes.

hope this helps

thank you.

[sorano]

So.. do you have any performance data that verifies this?

I mean, why do you need 4x RAM for swap if you have enough RAM? Everyone knows swap is slower.

[scalaechlon]

good day,

here at the office, we use opnsense with the following plugins enabled:

unbound dns  - for managing dns on unencypted traffic
dnsscrypt       - for managing dns on encrpyted traffic
ftpproxy         - for managing ftp services for our webserver

intrusion detection and prevention - for implementing information security using suricata
icap server     - to complement clamav implementation
clamav           -  to serve as layer 3 antivirus
sensei            - to serve as web application protection

we also implemented port forwarding to make our webservers public
we have all black lists, intrusion detection rules and antivirus signatures updated on a regular basis.

before, we use our default setup of 4Gb physical ram coupled with 8Gb swap (the swap automatically identified by opnsense during installation). at this setup, opnsense will consume 90 to 98 percent physical ram then will transfer some of the load to the swap file especially when all of sensei, idps, and clamav featuresets are all enabled. what happens is that the 8gb swap will be easily consumed and opnsense will freeze, and its lan and wan interfaces will start to have an offload error.

what we did is to increase both the physical ram and the swap file. we now currently have 8 gb physical ram and 16gb swap are we do not experience opnsense freezing or other issues since.

as for the swap file increase, in particular sensei relies both on swap and physical memory. even if the phycial memory is sufficiently large, when swap file is at default, sensei will readily consume 8gb swap and it will halt.

with that in mind, we increased from 8gb to 16gb to also accommodate other plugins and opnsense features that uses swap.