Significantly lower CPU temperatures on 26.7

[Nullman]

Im running opnsense on Protectli Vault FW6E with core boot bios. Since i upgraded to 26.7 i noticed much lower CPU temperatures on all cores. On 26.1 unit was sitting at 55C on idle, and  70C in full load. Its now sitting at 44C at idle and its hitting 66C at full load. To make this even more interesting, its much hotter outside today than it was before. Device is sitting in a small closed rack in a room with no AC. Did anyone else noticed lower temps on passively cooled devices ? Is this because of FreeBSD 15.1 ?

Great job Franco and the gang.

[Warbreaker]

I can confirm that, for my CWWK mini PC N150 only 6 degrees down but maybe is because the N150 is quite heat efficient already.
Seen from average 62 down to 56, whatever it is, I am happy with it, extends the life of mini PCs, those are  difficult to select for me :)

[gspannu]

Im running opnsense on Protectli Vault FW6E with core boot bios. Since i upgraded to 26.7 i noticed much lower CPU temperatures on all cores. On 26.1 unit was sitting at 55C on idle, and  70C in full load. Its now sitting at 44C at idle and its hitting 66C at full load. To make this even more interesting, its much hotter outside today than it was before. Device is sitting in a small closed rack in a room with no AC. Did anyone else noticed lower temps on passively cooled devices ? Is this because of FreeBSD 15.1 ?

Great job Franco and the gang.

Do you have any tuneables set? Prior or after the upgrade.
Would you mind sharing your tunables settings?

I also have a Protectli (V1210) setup; and it used to run at around 45C on 25.x; but since upgrade to 26.1 (earlier this year) - it started to hover around 55 instead.
I have not yet migrated to 26.7 (thinking of a clean install over the weekend) - so it is good news if the temps are lower.

Would be keen to see your tunables...

[Nullman]

Do you have any tuneables set? Prior or after the upgrade.

Nope. Its all default. No additional packages, no tuneables.

Would you mind sharing your tunables settings?

Here you go

Code Select Expand

net.inet.tcp.drop_synfin
runtime
0
1
Drop TCP packets with SYN+FIN set
hw.syscons.kbd_reboot
runtime
1
0
enable keyboard reboot
net.inet.icmp.drop_redirect
runtime
0
1
Ignore ICMP redirects
net.pf.share_forward
runtime
0
1
If set pf(4) will defer IPv4 forwarding to the network stack.
net.inet.carp.senderr_demotion_factor
runtime
240
0
Send error demotion factor adjustment
net.inet6.ip6.redirect
runtime
1
0
Send ICMPv6 redirects for unforwardable IPv6 packets
net.enc.out.ipsec_filter_mask
runtime
1
1
IPsec output firewall filter mask
net.enc.out.ipsec_bpf_mask
runtime
3
1
IPsec output bpf mask
net.inet.ip.sourceroute
runtime
0
0
Enable forwarding source routed IP packets
net.inet.tcp.tso
runtime
1
1
Enable TCP Segmentation Offload
debug.kassert.warn_only
runtime
1
1
KASSERT triggers a panic (0) or just a warning (1)
net.link.tap.user_open
runtime
0
1
Enable legacy devfs interface creation for all users
net.inet.tcp.delayed_ack
runtime
1
0
Delay ACK to try and piggyback it onto a data packet
net.inet.icmp.log_redirect
runtime
0
0
Log ICMP redirects to the console
net.inet6.ip6.use_tempaddr
runtime
0
0
Create RFC3041 temporary addresses for autoconfigured addresses
net.inet.tcp.sendspace
runtime
32768
65228
Initial send socket buffer size
net.inet.udp.checksum
runtime
1
1
compute udp checksum
net.local.dgram.maxdgram
runtime
8192
8192
Maximum datagram size.
hw.ixl.enable_head_writeback
boot-time
0
0
For detecting last completed TX descriptor by hardware, use value written by HW instead of checking descriptors
net.inet.icmp.reply_from_interface
runtime
0
1
ICMP reply from incoming interface for non-local packets
net.inet.ip.forwarding
runtime
0
1
Enable IP forwarding between interfaces
vfs.read_max
runtime
64
32
Cluster read-ahead max block count
net.route.multipath
runtime
1
0
Enable route multipath
kern.coredump
runtime
1
0
Enable/Disable coredumps
net.inet.ip.random_id
runtime
0
1
Assign random ip_id values
net.link.bridge.pfil_local_phys
runtime
0
0
Packet filter on the physical interface for locally destined packets
net.link.vlan.mtag_pcp
runtime
0
1
Retain VLAN PCP information as packets are passed up the stack
net.inet.udp.maxdgram
runtime
9216
57344
Maximum outgoing UDP datagram size
net.inet.icmp.icmplim
runtime
200
0
Maximum number of ICMP responses per second
net.inet.ip.redirect
runtime
1
0
Enable sending IP redirects
vfs.zfs.dirty_data_sync_percent
runtime
5
5
Dirty data txg sync threshold as a percentage of zfs_dirty_data_max
vm.numa.disabled
boot-time
0
1
NUMA-awareness in the allocators is disabled
net.link.bridge.pfil_onlyip
runtime
0
0
Only pass IP packets when pfil is enabled
net.inet6.ip6.log_cannot_forward
runtime
1
0
Log packets that cannot be forwarded
security.bsd.see_other_gids
runtime
1
0
Unprivileged processes may see subjects/objects with different real gid
net.inet.tcp.blackhole
runtime
0
2
Do not send RST on segments to closed ports
net.inet.tcp.log_debug
runtime
0
0
Log errors caused by incoming TCP segments
net.inet.ip.accept_sourceroute
runtime
0
0
Enable accepting source routed IP packets
net.inet6.ip6.rfc6204w3
runtime
0
0
Accept the default router list from ICMPv6 RA messages even when packet forwarding is enabled
net.inet6.ip6.prefer_tempaddr
runtime
0
0
Prefer RFC3041 temporary addresses in source address selection
net.enc.in.ipsec_filter_mask
runtime
1
2
IPsec input firewall filter mask
security.bsd.see_other_uids
runtime
1
0
Unprivileged processes may see subjects/objects with different real uid
hw.vtnet.csum_disable
boot-time
1
1
Disables receive and send checksum offload
net.link.bridge.pfil_bridge
runtime
0
0
Packet filter on the bridge interface
kern.msgbuf_show_timestamp
runtime
1
1
Show timestamp in msgbuf
net.inet6.ip6.forwarding
runtime
0
1
Enable forwarding of IPv6 packets between interfaces
kern.randompid
runtime
0
1
Random PID modulus. Special values: 0: disable, 1: choose random value
net.inet.udp.blackhole
runtime
0
1
Do not send port unreachables for refused connects
net.inet.tcp.syncookies
runtime
1
1
Use TCP SYN cookies if the syncache overflows
net.inet6.ip6.intr_queue_maxlen
runtime
256
1000
Maximum size of the IPv6 input queue
net.link.bridge.pfil_member
runtime
1
1
Packet filter on the member interface
kern.ipc.maxsockbuf
runtime
8388608
4262144
Maximum socket buffer size
vfs.zfs.txg.timeout
runtime
90
90
Max seconds worth of delta per txg
net.inet.ip.portrange.first
runtime
10000
1024
net.enc.in.ipsec_bpf_mask
runtime
1
2
IPsec input bpf mask
net.pf.share_forward6
runtime
0
1
If set pf(4) will defer IPv6 forwarding to the network stack.
net.inet.ip.intr_queue_maxlen
runtime
256
1000
Maximum size of the IP input queue
net.inet.tcp.recvspace
runtime
65536
65228
Initial receive socket buffer size

I also have a Protectli (V1210) setup; and it used to run at around 45C on 25.x; but since upgrade to 26.1 (earlier this year) - it started to hover around 55 instead. I have not yet migrated to 26.7 (thinking of a clean install over the weekend) - so it is good news if the temps are lower.

 Your temps will also go down once you upgrade/reinstall.

[turipriv]

Hey there,

Interesting post.

I also run OPNSense on a Protectli (VP2420), but I am still postponing the upgrade due to reported issues with reverse proxies and CPU Microcode, so this time I'll probably wait for the first minor release.

Would you mind sharing your current feature set? Just for me to have an idea.

[Nullman]

Unbound DNS
Kea DHCPv4
Wireguard Client VPN

[turipriv]

Thank you

[gspannu]

Nope. Its all default. No additional packages, no tuneables.

Thanks.. 👍
What is your WAN connection type? PPoE or other?

[Nullman]

What is your WAN connection type? PPoE or other?

Other.