Thanks @Marvosa…

I am going to try this idea.

Your switch is causing slow traffic?  Yeah never seen such a thing other than duplex mismatch or lower speed..  You sure your not limiting traffic on the switch?  That is something you could do.. But then say iperf between pfsense and client through the switch gives you 850?

Did you do that iperf test udp or tcp?

I have been working with cisco switches and routers for years and years and years… Never seen such a thing.. What is the config you have on the ports?  Just post show run interface.. Then again we don't use EOL hardware that got off ebay ;)  But if your saying you are seeing full speed between the devices across the switch, but not to the internet that makes zero sense.

Hi,

I am revisiting this post as I am back to my home location after being away for nearly 2 months.  ok, so I have swapped the draytek 2860 for the PFsense box again (with the draytek 130 vdsl modem).

Again, draytek 2860 works fine, but pfsense has the same errors even with IPv6 disabled.

I will contact the ISP again to see if I can make them work

Odd. Perhaps now would be a good time for you to take a full backup, and reinstall from scratch, then restore from your backup. Cos something sounds a little messed up..!

Pulse Secure is a proprietary ssl based vpn, no pfsense would not connect to it…

@jimp:

It looks in the PPP log and finds the connect time and then calculates.

https://github.com/pfsense/pfsense/blob/master/src/etc/inc/pfsense-utils.inc#L1472

That's a clever way to do it!
Thanks for the pointer.

Fixed the font for you, it was unreadable.

I don't believe I am. I originally built the pfsense rig for load balancing. Since then gigabit fiber came thru and I haven't needed to load balance anything. The tech came out and changed the ONT and since then I haven't had a drop off.

I had this same issue a few times and the only way we could remedy it , was by reinstalling pfsense back on the unit and we had the configurations saved on a server then loaded that config file and that fixed it. Just so long there are no hardware issues with your device.

What NAS hardware would you recommend? Or perhaps NAS+pfsense? Or even NAS+pfsense+ADSL router?

A better way of protecting your network against malware would be pfblockerNG with pihole lists, that  blocks domains that contain malware, including ssl domains. Here is a great tutorial

https://www.youtube.com/watch?v=QwFpMwXEK5w&t=1100s

Thank you, I was just getting back to this. Your explanation mades perfect sense. Thanks for the clarification. Now if I can figure out the answer to my DNS questions over in the DHCP/DNS group I should be good.  ;D

@Phonebuff:

Is the team working on some issue , or is just that ipSec is not getting an love these days ?

The forum is community support. So there is no guaranty that you'll get help.

If you want direkt help from the pfSense team you'll have to go here: https://www.pfsense.org/get-support/ and pay up.

@Derelict:

Why wouldn't you just use a switch with a mirror port there and do whatever you want with the traffic? Wireshark, tcpdump, etc.

Certainly easier than trying to be transparent with a proxy.

You don't need to hammer a square firewall into that round hole.

This or a LAN TAP such as a Throwing Star LAN TAP

I've narrowed the issue to Suricata on the LAN Interface, can a mod please move this thread to the relevant section?

I've disabled Suricata on the LAN interface, and it appears to be working fine now, what gives?