ZenArmor and 2.7 Packet Engine w/Multi-Core Support - Suggestion
I’ve been a long-time Zenarmor user on a paid Home subscription, and I’d like to raise a growing limitation. Fiber and cable connections are increasingly multi-gigabit, but the Home Edition is still limited to a single-threaded packet engine. The multi-core engine introduced in 2.7 is apparently limited to Business and higher subscriptions. I myself have a 5x5Gig fiber connection at home.
You can check whether the single-threaded engine is your bottleneck by running top -SHP in OPNsense during heavy traffic. In my case:
eastpect{Eastpect Main Event} CPU1 98.45%
kernel{dummynet} 9.95%
The eastpect main thread is pinned at ~98% on a single core while the other 15 cores sit largely idle on the box. The traffic shaper (dummynet) uses only about 10%. The system has plenty of total CPU capacity, but all inspected traffic funnels through one saturated thread.
In practice, sustained downloads of around 2 Gbps cause intermittent connectivity problems. They’re most visible with Unbound forwarding over DNS over TLS (e.g., Quad9): TLS handshakes fail, and after repeated failures the upstream is marked unavailable for roughly 15 minutes. However, with Zenarmor disabled, upload throughput also improved from roughly 3.1 Gbps to 4.2 Gbps and the intermittent DNS issue was resolved.
I understand full multi-core scaling is a Business feature. Even one or two additional worker threads on the Home Edition would make a meaningful difference for home users on multi-gig connections. As it stands, I can no longer use Zenarmor on my connection, despite paying for a Home subscription.