Normally no CSP on a connectorised install .... there should be enough on that coil to be taken right into the ONT.

In reply to a post by F00tS0re:

I use VLANs to split off Network Equipment, Guests (with device isolation), IoT devices (with device isolation), and our personal devices+Sonos, I am tempted to isolate the kids on their own network but Sonos created a bit of a barrier.

All very sensible. You won't have any problem with policies for those on either Mikrotik or pfSense.

If you add in IPv6, then the Mikrotik is a bit more awkward because it has separate policies for IPv4 and IPv6 - it's up to you to keep them in sync. pfSense lets you have rules and address lists which contain a mixture of address families, at least for TCP and UDP.

If you can get IPv6 natively from your provider, it's probably worth deploying in a network such as yours. It will reduce pressure on your NAT tables and ports. But of course you *do* want to ensure your firewall policies permit outbound but not inbound.

In reply to a post by candlerb:

If you add in IPv6

I haven't got my head around that yet. I know the basic logic with the increase in available IPs. But the implications for my network I have avoided. Will be with Cerberus. More homework to do.

Ta Dave

Have pfsense sorted the single thread issues for PPPOE connections?

I stopped using pfsense a couple of years ago.

In reply to a post by F00tS0re:

In reply to a post by Jabes:

In reply to a post by F00tS0re:

The Unify Pro 4/ Edgerouter-4 (basically the same kit with differently coloured case and firmware) should easily handle any FTTP connection from Openreach with the proviso you don't want QoS.

I run my 330/30 link at full speed with a USG3...

Do you run QoS or IPS? I think those two features slow it down lot from what I have gathered. Without either then USG will go close to gigabit speeds from what I have seen.

Plus we have 80 guest devices on the holiday cottages and circa 80 devices of our own (phones, tablets, sonos, IoT stuff)

No, I don't have QoS or IPS turned on. I have about 100 devices on my network including 5 access points. All switches and AP are Unifi and although the USG is not as fully featured as my previous pfSense router it does enough and I appreciate the 'single pain of glass'...

In reply to a post by fredfox:

Have pfsense sorted the single thread issues for PPPOE connections?

I stopped using pfsense a couple of years ago.

https://redmine.pfsense.org/issues/4821
See last 3 posts: setting tunable net.isr.dispatch=deferred apparently fixes it.

In summary: multi-queue NICs generally can't hash PPPoE traffic and they just assign it to the first queue. Setting 'deferred' moves all the heavy packet processing out of the interrupt handler, so that multiple cores can work on it.

Latest update:

External build and testing have all now been completed. Order is currently awaiting an audit to be completed.

I will Openreach for a date and get back to you.

So nothing too new that I don't already know, except the audit which I presume may take up to several weeks to complete? At least that's what I thought I read somewhere in this thread when someone mentioned the audit step. So close... haha.

Edited by Ixel (Thu 28-Feb-19 17:07:02)

Thanks
I stopped messing with pfsense such a long time ago that I'm rather out of touch, maybe time to start playing again, although quite happy with the free version of Sophos XG & UTM9, but I love playing with this stuff!

I spoke with Openreach on my way home from work today, they were running fibre to/from the exchange (800m away) - at 7.30pm! They said the jointers will be in next join on to that from my village, and then down to my house.

Is it normal for them to be working at that time? If you've gone past this stage in the build, how long has it taken from here to completion for you?

Time to order the parts for a new home server!

In reply to a post by Ixel:

Latest update:

External build and testing have all now been completed. Order is currently awaiting an audit to be completed.

I will Openreach for a date and get back to you.

So nothing too new that I don't already know, except the audit which I presume may take up to several weeks to complete? At least that's what I thought I read somewhere in this thread when someone mentioned the audit step. So close... haha.

Mine went from audit completed to audit not done. Official line from Openreach (via Cerberus) was that Audit can take up to two weeks, but mine took 7-days to get to the audit team from the point the fibre was physically finished on site. Of course I understand the jointers would have paperwork to submit, and most of the stuff is still likely run on overnight batches. So some time to be expected.

Once audit is complete it is then passed to commissioning team, so figure another week or two for availability of commissioning team (YMMV).

So could still be 4-weeks away.