Well in this case I don’t mind it. It’s for home use.
Well in this case I don’t mind it. It’s for home use.
The performance drop from virtualizing nics shouldn't be nearly as big. How are you passing the vlans to the VM? are you passing all over one virtio nic or one virtio nic for each.
The setup I ran for multiple years was basicly a bridge interface on the host for each vlan and a seperate virtio nic to the opnsense VM for each, I got almost 10 gbit/s like that with 8gigs of ram for opnsense and 4 or 8 cores (I cant remember) with hyperthreading of a 2nd gen epyc. I didn't do any optimisations for virtio.
I’m not running an epyc. Way too spendy for me. I was using direct attachment pasture but that was failing over to Macvtap because this motherboard sucks and the IOMMU/ACS shit only actually works on the GPU slot and 1 M.2 slot.
Supposedly I can use IOMMU with an i350 and that will work good enough but I’m not certain if this as it’s not the same as a direct passthru so I’m worried I’ll have similar issues.
I’m also reading the i226v NIC I have is kind of ass anyway.
Offloading was disabled everywhere since I won’t be using it in the long run.
Yeah, pci passthrough would probably do it. I assume you used the best-supported virtual adapter and drivers in the guest. But failing that, you could also try USB passthrough. You should still be able to get full gigabit (i.e. ~800Mbps) on one of those, even with passthrough.
But I still don't recommend it, because if your host has issues, your firewall and router do too.
Pass through isn’t going to happen on this board because there are basically just 3 IOMMU groups with ACS, AER, and SR-IOV enabled. 1 for GPU slot, 1 for a single m2 slot, and 1 for everything else. It sucks.
Supposedly an IOMMU-aware NIC can still help me even if the groups are shitty but I’m not certain if that’s true.
It can make a big difference just in the processing power needed if there's anything more intense than a straight firewall. IPS tend to be a resource pig. What are the load numbers saying vs the number of CPU cores available?
I ran into similar (or even worse) choking trying to get it virtualized even with a proper passthrough that I eventually shelved but might take another run at someday. Knocking a couple hundred watts off the stack is always welcome.
Well I was going to drop to IDS instead of IPS and that’s good enough for home use. The load numbers on the host were 2 full cores used but that’s the NIC doing paravirtualizarion crap there. In bare metal, top shows nothing but the fans do spin up so it’s not telling me the whole story.
I think swapping to an i350 nic will help but I’m not certain if it will really help enough.
thanks for using Leebra!
go to feed...
Keep the firewall on dedicated hardware. You don't want your whole network going down because you have to do some work on the server.
save