Router hardware capable of routing 900mbps over PPPoE (FTTP)

I've hit a bit of a wall with this one.

I've beeing using a J1900 based firewall appliance with pfSense for a while and it's been great until I moved from VM to Zen over FTTP. It would cap out around 400-500mbps and suffer heavy packet loss as it hits the limit.

Based on a recommendation, I picked up an PC Engines APU2 to replace it and that's worse.

It seems there's a particular issue with PPPoE and Intel nics in pfSense, but ultimately the hardware doesn't seem powerful enough to do PPPoE at these speeds anyway, as it the J1900 still "only" does 500-800mbps with Linux based ipfire.

I haven't tried a Linux based solution on the APU2, but I suspect it'll be a similar story.

I see 3 options;
1. Try OpenWRT which will probably run on anything
2. Get better suited, more powerful hardware to keep running pfSense.
3. Find an off the shelf appliance

The trouble is, I can't find too much information on proven solutions.

PPPoE can be quite resource intensive, especially at the top end of speeds now possible with FTTP etc and if you're relying on hardware that is based on desktop-class processors that have to do all the heavy lifting (together with routing, packet inspection etc) they can feel the pinch.

Dedicated appliances or routers often or not get around this by offloading this task or have dedicated capacity in silicon do do the computation, rather than a general purpose CPU, so they generally don't tend to suffer as much as x86 based solutions - insofar as they have sufficient routing throughput - you can still cap out a weedy router.

Edited by Pheasant (Tue 27-Apr-21 09:11:50)

I use an HP 600 G2 SFF with Core i3-6100 for pfSense and it works very well - you can buy them second hand for under £100. The 600 and 800 SFF models come with a Platinum rated PSU so power consumption is only around 10W.

I found the same as you, the APU2 wouldn't do more than around 300-400 Meg for me. It is because PPPoE isn't multithreaded on pfSense/FreeBSD, so you need a fast enough CPU on one core to get the throughput. This might be fixed in FreeBSD in the future but it's been an issue for a long time so I wouldn't hold my breath.

I ended up getting a i7 7500U, search for Qotom i7 7500u or Kettop i7 7500u, they come fanless in a solid heavy heaksinked case with 6 Intel Ethernet ports. I'd recommend getting one bare bones and putting in your own RAM (8Gig is plenty) and a small mini-SSD, if bought with these already bundled you take a chance on the brand of memory and SSD. They do sell them on Amazon, you have 2 choices, UK stock or direct from China. UK stock, expect to pay around £200 extra for the privilege I got mine direct from China in about a week, it's been great.

An i7 7500U is probably overkill even for a 1Gig connection, but I think better over powered than under powered and I will be keeping it for several years. It runs cool and silent and at idle draws around 5 watts. Maxes out my 1 Gig connection no problem with room to spare.

Hehe sounds like you’ve horsepower in that box to run it as a PPPoE access concentrator! 😏

Are you running the latest pfSense CE?

Does your J1900 box have dual integrated NICs for WAN/LAN, or are you using a USB-attached NIC or similar, or are you using VLANs?

I have some N2820-based NUCs (DN2820FYKH) running Linux, similar to your J1900. They can easily fill a gigabit of regular ethernet on the built-in NIC but I haven't tried them with PPPoE.

If you just want basic PPPoE routing and not to spend any money, then I'd certainly suggest giving OpenWrt a go. The Linux kernel may do a better job of PPPoE than the FreeBSD one.

If you like pfSense and want to continue using it, then get some more powerful hardware. You could even consider the official Netgate appliances, although they're not cheap.

If you want to buy a dedicated router appliance, the Mikrotik RB4011 has four ARM cores and has no problem filling a gigabit (it has 10 x 1G ports and one 10-gig port). Just note that the built-in switching hardware isn't VLAN-aware, so if you do clever stuff like trunking VLANs it will be switching in software. Even then, it can switch nearly a gigabit on a single core anyway.

If you turn off intrusion / threat detection and smart queues / QOS then the Ubiquiti Unifi USG-4Pro is capable of routing my 900/115 Zen connection. With 900/115 the QOS seems for the large part redundant, as in real use I rarely see saturation.

It's also able to do site-to-site VPN to a USG-3 at my office at between 7 and 9MB / sec (slower in one direction, which I guess is the fault of the less powerful USG-3)

Perhaps there is an Edgerouter product from Ubiquiti that could satisfy your requirement?

As a workaround, if you think the issue is PPPoE, could you try and use some other small device with hardware PPPOE offload as a PPPoE to IP bridge... maybe even the Zen supplied Fritz could be bent to your will...

Mine sounds even more overkill, I'm using an old Xeon E3-1240V3 that is about 25W at idle

Thanks
Dan

J4105 / J5005 based boards can handle 1gbps PPPoE. They are the next generation on from the j1900 and offer double the single threaded speed, along with more cores, etc and use near enough no power. There are a few USFF /Thin client machines that have them made by Dell, HP, Fujitsu etc that also have an expansion slot and can be found second hand - problem is many people online have caught wind of this so they usually go for £200+ which is a lot for a second hand machine with their specs.

If it doesn't have to be very small just get a SFF build Dell or Fujitsu, with your budget dictating how recent a generation. Best value if you really don't care about space are Xeon V1/V2 based small towers, they can be had for around £100 e.g. Dell PowerEdge T110 II - complete overkill though, and will use 5x or more power of a J4015/J5005 based system.

Edited by deleted (Tue 27-Apr-21 14:45:09)

Thanks for all the advice.

I've been playing with all sorts of ideas. The best performer so far? A RPI4 with OpenWRT which can push full 900/100.

I just don't trust a USB ethernet adapter or a little Pi running from MicroSD, however.

I've ordered a Mikrotik RB4011iGS+RM in the hope that it should be ultra-reliable once setup and still less money than the APU2 that's being returned.