# Gateway and computation on the same box?



## M0dusPwnens (Jun 28, 2013)

I'm new to FreeBSD and have thus far been running it in VirtualBox. I'm getting ready to set up a simple little home server with it, but I had (what I assume (perhaps incorrectly) to be) a simple question that I haven't managed to figure out any way to answer.

Reading up on using a FreeBSD home server as a gatway/DHCP/DNS server, this is something I'm interested in learning to implement (as a long-term project to replace my ailing networking devices), but most of the guides are about using a separate box and none of the information in the handbook seems to bear directly on the question of running such services on a computer that actually sees regular use for heavier tasks (they seem to mostly consist of "turn your old PC into a router!" guides).

On the other hand, the primary purpose for the server is going to be doing some relatively heavy statistical analysis and providing a uniform working environment I can ssh into rather than trying to manage installs and dotfiles on half a dozen different machines (it is not unthinkable that a rare Minecraft server might appear from time to time too...).

The issue: Obviously, I don't want my routing to bog down when an analysis is running - so I'm wondering if there are robust mechanisms in FreeBSD that allow for running these networking services while ensuring that they have high enough priority to ensure that routing, DNS/DHCP requests or even streaming or filesharing all get through despite the number crunching. I'm sure that I'm showing my inexperience here, but the only times I've interacted with priority systems on other OSes have left me a little nervous - the results were somewhat unpredictable and not nearly the sort of dependable guarantee of service one wants to have with their networking devices.

I'm guessing this is a simple and probably somewhat stupid question, but I've been trying all day to figure out the right search terms that might yield results. I'd very much appreciate if someone could just answer a simple yes/no (is this doable or should I count on needing a separate box?) and possibly point me toward in the right direction for further research.


----------



## Anonymous (Jun 28, 2013)

M0dusPwnens said:
			
		

> The issue: Obviously, I don't want my routing to bog down when an analysis is running - ...



I have been running a FreeBSD box as a gateway (Firewall/NAT/VPN/DNS/DHCP), and the experience is that even the heaviest computation, for example in the course of compiling a new kernel, doesn't make any noticeable difference on network performance. This is a low profile Intel Atom dual core 1.6 GHz machine. If your computation would be more intense than kernel compilation, then you might want to consider to set[]up a quad core machine.


----------



## M0dusPwnens (Jun 28, 2013)

rolfheinrich said:
			
		

> I have running a FreeBSD box as gateway (Firewall/NAT/VPN/DNS/DHCP), and the experience is that even heaviest computation, for example in the course of compiling a new kernel doesn't make any noticeable difference on network performance. This is a low profile Intel Atom dual core 1.6 GHz machine. If your computation would be more intense than kernel compilation, then you might want to consider to setup a quad core machine.


I'm still not sure what the machine will be - so I'll take that into consideration! I'm still a relative newbie at more or less all of this. Normally I just SSH into a server and run the tools that I'm used to without any idea what's really going on - something I'm trying to fix by getting my hands dirty, learning to actually use basic unix tools and do basic setup. Setting up a home server like this seemed like a nice project to keep me occupied for a while.

And thanks for the helpful answer - it sounds like it's even simpler than I thought: it just works out of the box without having to fiddle with any knobs to guarantee a sort of processing QoS? That's so...sensible. It's almost hard to imagine having lived most of my life in Windows.


----------



## wblock@ (Jun 28, 2013)

PF has some QoS features, see pf.conf(5).  ipfw(8) may also.  But I've never felt the need to adjust for QoS.  Possibly it would be different if VoIP were involved.


----------



## M0dusPwnens (Jun 29, 2013)

Ah - I spoke badly. I don't mean actual QoS, I mean a sort of pseudo-"QoS" to ensure that the machine reserves CPU cycles to do all of the routing during number crunching (so I don't start up some hideous analysis that's taking up all of the system resources and then sudde_n_ly lose networking until it's done). I think this is technically something to do with "priority", but, as I had said, my only interaction with manipulating priority was on another OS and it didn't do quite what I thought it would.


----------



## n00balert (Jun 30, 2013)

@M0dusPwnens,
I run a moderately used home PF/NAT/DNS/DHCP/ZFS/NFS/Media Server on a dual core AMD Opteron. CPU is hardly used and is only used when compiling kernels. If you get a decent CPU for number crunching, you can accomplish Firewall/NAT etc. function through a VM (or Jail, if it's possible, though I'm not sure) such as pfSense. pfSense runs quite well in VirtualBox for example and takes little resources. In short, to answer your question; yes.

Although, I'd also say, since I offered my opinion, that you might want to run Stable if you're serious about your stuff.


----------



## throAU (Jul 1, 2013)

The only consideration I would have doing compute on the same box is not performance related, but security.

If you're doing compute, you're likely storing data and opening network ports to provide services.

Make sure you're not exposing them to the internet!  Ensure that you keep on top of security updates and establish an adequate firewall rule-set, as the compromise of a machine that has actual data (and applications) on it is both a lot easier (due to the increased amount of software installed that is potentially exploitable) and has a lot more to lose than a dedicated machine to provide internet gateway services only.

And yes, unless you're routing gigabits of traffic and doing complex firewall rule processing, the CPU will not be taxed doing general home user firewall stuff, NAT, etc.


----------

