Provide firm date on multicore/thread support

[FullyBorked]

Just a quick glance at a home user, with 10G backbone, but currently nearly pinning a core with only ~600Mbps file transfer.  This is a Intel i3-9100  Please @Zenarmor re-consider this decision.  I've promoted this product since inception, this is a big thorn I'm struggling with. 

[dirtyfreebooter]

it is quite disappointing. have been running a unifi gateway fiber (UXG) for 3 weeks now, the one without the network controller built-in. using the cybersecure subscription, which is $99 a year, so similar cost to zenarmor. unifi gateway basically uses suricata + dns filtering using cloudflare.

i have no problem getting 5gbps+ in my lab testing (sfp+ wan and lan) with all the suricata categories on + geo filtering + cloudflare content filtering, using this $279 unit. connecting it to my 1gbps fiber ISP,  idles at 7w and uses at most 9w when using the full 1 gbps connection.

zenarmor's categories and filtering is by far superior. especially since it filters at the firewall / packet level. unifi's relies on dns for content filtering, so if you wanted to block traffic at the firewall, you need to do old school firewall rules, which have different options than the cloudflare categories. which are also very broad and not really tunable.

unifi's gatetway software has definitely improved greatly over the past 2 years. 2 years ago unifi gateway software was so unstable and unuseable.

is opnsense a better firewall/gateway then unifi?

yes, without a doubt

is zenarmor better than the cybersecure for content filtering?

yes, without a doubt

but unifi is certainly not far behind and then zenarmor just does the most annoying things to its customers because it can't figure out how restrict businesses from using home licenses??? other than making it a bad experience for home licenses. lol.

my kids are getting to the age now that extreme content filtering is not really needed, so for me the zenarmor advantage is less and less attractive. i plan on sticking with the unifi unit for a couple of months to fully give it a shot. hopefully go through a few software updates as well. see if that is a disaster or not.

[tangofan]

To my great surprise I noticed that in the roadmap multicore support is a feature for business plans only. I'm "only" subscribed to the "Home" plan, but I would have expected that this feature would also come to that plan, even if I had a thread limit. In fact, if ZA is serious about attracting homelab users to the Home edition, I would also expect a limited form of multithreading in the free plan.

Apart from this I am wondering how serious that roadmap is with a 1 to 6 months timeframe. The problem is that this feature essentially pays back some technical debt, but isn't a flashy feature. I get it that ZA is a small company that needs to pay the bills and that those "flashy features" are much better at making that happen. Thus I'm concerned that multicore support will remain on the back burner for the foreseeable future.

[Greg_E]

It seems like limiting the threads would be more work than it's worth. Once the code base migrates to multi-thread, it seems like it would be worth just keeping that for all versions.

It should be noted that they do offer a 50% discount for educational users (schools through higher ed). This was a few years ago and I haven't checked on it in a while.

I also think that homelab should have a special discount, but it's so hard to prove that this is really a lab and not a jerk running it in full production.

[tangofan]

It seems like limiting the threads would be more work than it's worth. Once the code base migrates to multi-thread, it seems like it would be worth just keeping that for all versions.

I believe that you're not assessing this correctly. With that new architecture all versions of the engine would use a multicore design and the maximum number of parallel threads is just a number that can be changed. And for home subscriptions and non-paying users this number would simply be set to "1". So the only way to avoid the jerks using a home subscription for their company is to tie the maximum number of threads to the subscription. Sadly home users apparently won't benefit at all from the new design.

[Greg_E]

I wasn't thinking about it as logically assigned, that makes sense to just logically limit to a single thread.

[fakebizprez]

Wow, I'm shocked this saga is still ongoing, but I see it is at 90% implemented on the roadmap.

I did an alpha test for their multi-core support at least a year ago. Unfortunately it lowered my bandwidth worse than the single core product.

As of today, are there any business users that have access and can share feedback?

[almodovaris]

Just a quick glance at a home user, with 10G backbone, but currently nearly pinning a core with only ~600Mbps file transfer.  This is a Intel i3-9100  Please @Zenarmor re-consider this decision.  I've promoted this product since inception, this is a big thorn I'm struggling with. 

Make a separate route for heavy downloading/uploading which does not go through Zenarmor. Use Zenarmor for browsing and IoT.

These being said, your CPU should support 1 Gbps through Zenarmor.

[tangofan]

Just a quick glance at a home user, with 10G backbone, but currently nearly pinning a core with only ~600Mbps file transfer.  This is a Intel i3-9100  Please @Zenarmor re-consider this decision.  I've promoted this product since inception, this is a big thorn I'm struggling with. 

Make a separate route for heavy downloading/uploading which does not go through Zenarmor. Use Zenarmor for browsing and IoT.

A potentially stupid question: How would you do you bypass Zenarmor (the free version) for certain traffic to the WAN, if you want your client to otherwise go through Zenarmor (e.g. for regular web browsing)?

These being said, your CPU should support 1 Gbps through Zenarmor.

My OPNsense box has a Celeron J6412, which apparently has about half the single-core performance of the i3-9100 and I'm still getting 1.1 Gbps on an iperf3 test between two local VLANs, so the OP's network speed seems slow indeed. In my case that's with i226-V NICs, which can do do 2.5 Gbps, and with Zenarmor disabled I can indeed reach 2.3 Gbps. I'd recommend to the OP to check the download speed with Zenarmor disabled.

IIRC some folks on the forums had some success in increasing network speed by setting some tunables. There also is a guide for that here, though with my NICs I never had to do any tuning.

[dirtyfreebooter]

yea i was able to get almost 2.5 gbps on n150 protectli, which cpubenchmark.net shows 9100 has better single and multi-threaded performance