This seems like a potential sweet spot for the Espressobin [1] with pfsense but the pfsense folks have not released their ARM version, only demonstrated it [2], perhaps they're just too dang busy or perhaps it would cut into the margins of their x86 solutions. Regardless it would make a nice appliance if they ever do release a PFsense ARM image.

[1]http://espressobin.net/

[2] https://gist.github.com/gonzopancho/760ab9ecee9dfbc1b6033e48...

PFSense is great if your okay with pulling out a monitor and keyboard every time there is a config issue or interface change. Do not bring in any interfaces over USB if you like to preserve your sanity and want to use PFSense.

These days I just run OpenWRT on x86, no more will my router sit in a broken state that I can't fix by logging in over the LAN or WAN (via OpenVPN ofc). Wish PFSense would get sane defaults in this regard!

I'm at 100/100 though, so wouldn't something simpler be enough? The wired side of the router is gigabit but that's just an integrated gigabit switch, it doesn't even touch any CPU. I'll be doing more testing to make sure but my ISP doesn't seem to have too bad a buffer bloat anyway.

Sometimes turning on QoS disables offload on all ports including lan. Try a download test between local machines

My understanding of these routers is that the gigabit switch is independent from the router. They're physically on the same board but the router is just another machine on the switch. If the switch table says portA->portB it doesn't matter what the router on portC has decided to offload or not.

Edit: Maybe you mean Wifi to wired may have a disabled offload? That path does go through the router and not directly through the switch. For bigger installations I end up having one of these with wifi disabled as the router (firewall, dhcp, etc) and individual ones connected through ethernet as dumb access points (same SSID on all and straight bridge from Wifi to Ethernet). That should also avoid any issues and is a good setup to get more wifi coverage with a simple config.

Good to know, would explain why there's a phantom eth port on some of these routers, must be used to connect between router and switch chips. Sounds like you're right about wifi->wired transit though if this is the casr

The typical architecture for routers these days is that the main SoC has two ethernet interfaces, each of which is connected to a 7+ port managed switch. One of the host CPU's interfaces is on the WAN VLAN, and the other is on the LAN VLAN. Some older routers used to have just one ethernet link between the switch and the CPU, with the CPU's other interface exposed directly as the WAN port. That made it easier to avoid bloat or bugs in the ethernet switch itself, but was fundamentally incompatible with the NAT offload those switches provide, so that configuration is now almost impossible to find.

This also makes these little routers extremely powerful. Since those switches have VLANs as well you can create very interesting topologies that would require much more expensive managed switches to achieve. I run an extra VLAN from my router, to one of my APs, to a dedicated wifi SSID to another wireless router to ethernet to a TV box so I can have the TV signal in a place I can't run ethernet to. Doing it through the normal Wifi would be a bad idea because the provider uses multicast IPTV and if you put that on your wifi every connected devices receives it. And this is all done with 3 50€ routers running LEDE, each with different VLANs and wifi SSIDs configured. They make for a really flexible setup.