It required binary changes/compile options, so no, not possible on 2.4.5.

@stephenw10 Thx for pointing that one out to me

@johnpoz said in Strange performance problem: What do you think of the odds of something like that happening are? ;) Zero. How many home networks are out there with old cheap crap "routers" that want you to believe that NAT is a firewall... So much stuff is going on. My ISP (Spectrum, formally Time Warner) will give me a /56 prefix. Nice. But, this same ISP thinks that power cycling is the cure for all issues. Begging is required to access someone who knows their head from a hole in the ground. A lot needs to improve.

What do you have limiting the bandwidth? How are you applying that? Can we see screenshots? Do you see blocked traffic in the firewall log? If you are able to connect at all through that port then it must no longer be showing as 'no carrier' I assume? Steve

Yup those later P4s were hungry hungry beasts!

Yes, those values you're seeing are small, 8 queued, 4 occurrences. Often if you hit a problem like that you will see far higher numbers there. If you are not seeing any actual connectivity issues you might choose to ignore it. You should not be seeing it though. Steve

@valepe69 Have a look at the Netgear GS350 Series of Smart Managed Pro switches. I've used the GS308T, GS310TP and the GS324T. All solid. And the price is right. I have some spare GS308T's (I consolidated several switches) if that's all you need and are interested.

Hmm, that absolutely shouldn't happen. As long as the assigned interfaces in the config are still present at boot pfSense should not care about other interfaces that may or may not exist on the firewall. Commonly an interface may be removed that changes the ordering of other interfaces, if they are all igb NICs for example. If you don't have any other 10G NICs in the system and have unassigned it I would not expect an issue. Steve

@dzmnetworks Swap a known good working cable and see whether you get the same response. Be sure to reboot the modem when you swap cable.

Yes, or roll back that last config change. https://docs.netgate.com/pfsense/en/latest/config/console-menu.html#restore-recent-configuration Steve

Yeah, you don't need any sort of bridge there. The pfSense router will connect out as an OpenVPN client to remote servers without needing anything special. Steve

@stephenw10 Good advice. I just used my generated pfsense LDAP CA to issue another cert for the second DC and imported the CA cert and generated server cert into the certificate store on that domain controller. Totally forgot you could choose more that one auth server in the OpenVPN server config. Thanks for reminding me!

@claferriere No, I didn't have to spoof the HH3K MAC address for the internet to work. I tried it using the real MAC and the HH3K MAC and was able to get internet access in both cases.

Thanks everyone for your suggestions. I haven't had much opportunity yet to dig into this, but will be this weekend. As a first step, I'm going to try moving the WAN connection from an output on the router to the output from the cable modem. Then, I'm going to connect my laptop to the LAN port, and confirm that I can log onto the local web portal. I'll check out DNS settings and attempt to access external sites. If that works, then I'll swap the LAN connection over to the input on the router, and see what happens. :-)

That is usually some page that tried to display more data than php allows. So if you tried to run something in Diag > Command Prompt with a very large output for example. It's not a system crash. Steve

@andyrh said in Download at full speed then got packet loss: why is the general theme that the HW pfSense is running on is the problem and not the ISP with what looks to be a full link? It isn't, not here at least. As I said there I would expect that CPU to pass 300Mbps with ease and the output from top showed that to be true. I would always expect to see some increase in latency when you use more WAN bandwidth but not packet loss as we're seeing here. I would not expect to see either when loading the CPU with traffic between other interfaces. Unless you are maxing at least one core completely. Steve

If you only have two gateways (no internal gateways) you can set the default to 'auto' there. The system will failover to the second WAN and if the first goes down but will not switch back unless the second goes down. But yeah you can just the second WAN as the default manually there. Steve

It could be two things statically set with the same IP. That's unlikely when either of them is a phone though. Rogue dhcp server is what I'd look at. If you have access to an affected device you can chesk what it's using as as it's gateway. Steve