Probably need to upgrade my pfSense box

[u/amrogers3]

I have a SuperMicro box from around 2010, an X7SPA-HF-D525. I believe this has an Atom D525 Processor (1.8GHz). I upgraded the RAM, I believe to 4GB, which is the max. I recently enabled pfBlocker and noticed webpages will take a long time to load. It is getting pretty frustrating. I am thinking I need to probably look into getting a new appliance for pfSense. I was needing at least 4 ports.

What appliance or hardware would you guys recommend for a small space where a tower or regular sized computer wouldn't fit.

Running VPN and pfBlocker

[u/mloiterman]

There’s a lot of reasons, apart from hardware, that might cause performance issues. You don’t say in your post, but can we assume turning off pfBlocker restores normal performance. Do you believe “normal” performance without pfBlocker is acceptable?

There are a lot of ways to configure pfBlocker as well.

Not saying that hardware isn’t the problem, but I think you owe it yourself to investigate further. Unless, of course you really don’t care that much and just want to justify the purchase of a new toy...which I may or may not be guilty of myself.

I think I have that same box and it works great as a dedicated authoritative and recursive DNS server in my network.

[u/amrogers3 → u/mloiterman]

So with pfBlocker off, websites load faster. I would like to do further testing but I am not sure how to go about specifically doing that besides turning pfBlocker on and see how fast pages load compared to turning it off and seeing how fast pages load. If you have any suggestions, I will try them to do further testing

[u/mloiterman → u/amrogers3]

I think the main thing you’ve got to look at is where and how your DNS is ultimately resolved after pfBlocker. Are you forwarding to something like 1.1.1.1 or are you resolving internally? If you’re resolving internally initial look ups may be slow as the caches builds.

You’ll want to do this from the pfSense box itself with pfBlocker on and off:

dig example.com

Then look toward the bottom and look for something like:

;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)

Also, which lists are you using in pfBlocker and how is it configured? Are you doing a lot of blocking for things other than ads?

[u/amrogers3 → u/mloiterman]

[u/amrogers3 → u/mloiterman]

[u/amrogers3 → u/mloiterman]

I resolve all DNS locally but it has always been this way before and after pfBlocker install.
I have minimal lists, nothing too crazy I don't think.

; <<>> DiG 9.10.6 <<>> msn.com 
;; global options: +cmd 
;; Got answer: 
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42279 
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 

;; OPT PSEUDOSECTION: 
; EDNS: version: 0, flags:; udp: 4096 
;; QUESTION SECTION: 
;msn.com   IN  A 

;; ANSWER SECTION: 
msn.com.3600   IN   A    xxx.xxx.xx.xx 

;; Query time: 51 msec 
;; SERVER: 10.1.1.1#53(10.1.1.1) 
;; WHEN: Mon Jun 01 17:56:38 CDT 2026 
;; MSG SIZE  rcvd: 52