There is a recent hangout explaining how to use OpenVPN as a WAN (PIA, etc). It goes into detail regarding policy routing. Yes, Gold Membership gets you access there. October 2016 pfSense Hangout on OpenVPN as a WAN with pfSense March 2016 was Multi-WAN: https://portal.pfsense.org/webcasts/index.php?video=160624666

So… it seems to be the LRO that is decreasing the throughput. I'll keep you informed. *edit: i think that and some performancetuning helped.

Ok. Found my miracle. One firewall rules block this.

i would stop trying to measure from/to the firewall. This is pointless & incorrect. try this & report back: iperf-server<->routerWAN | routerLAN <–> iperf-client

Thank you very much hda!

@johnpoz: You do not need to put anything in there if you just want to have the dhcp clients point to IP the dhcp server is running on for dns..  Its right there in the text below the dns boxes.. Leave blank to use the system default DNS servers: this interface's IP if DNS Forwarder or Resolver is enabled, otherwise the servers configured on the System / General Setup page. Thanks, apparently I've read way too much in the past few days and my brain is melted. Thank you for your patience, I got it :D

The wan is a 10.0.x.x /16 and the LAN side is the default 192.168.1.x /24.

Try the WAN NIC.  They might be swapped.

@vitoreiter: …and for security purposes I can't really give exact IP's. For example lets say that WSUS is on x.x.x.45 and other systems are on the same subnet ... Do you use public IPs internally? Then use RFC5737 Test-Net addresses for documentation, that's what they are there for. But usually RFC1918 are misunderstood. I'm currently dealing with a university that does just that, use public IPv4 addresses internally. And only internally…

So, driver issue, who`s responsible for that ;)

2x32A power cables (top of rack) were going very near the cable, which was unshielded btw. Changed to shielded cable, and also different path to switch, to make sure. Since then it's been on 1000 mbit not falling back to 100 mbit. So not a fault of pfsense! :-)

https://forum.<other project="">.org/index.php?topic=4191.msg15344#msg15344</other>

Not enough information to help you. What do your rules look like for OPT1?  Does anything show up in the firewall logs reference blocked traffic from the Android devices?

I've been inspired by the board to investigate alternate ideas, particularly based on the feedback about Soekris reliability.  I had always considered the devices to be highly reliable, but am now seeing quite a few issues, particularly around the thermal package.  I have the device in a large closet on a high shelf, which should be OK, but got me to dig.  Well, it appears that the stock case and heat sink are NOT up to the job, as the CPU core is currently running around 79C with little / no load. I now expect the printer IS causing the issue, due to heating the closet, not some strange broadcast packets!!! Incidentally, does anyone know how to override the Tj Max setting - the coretemp module is unable to read the CPU ID and sets the Tj Max to 100; for the net6501-50 it should be 90. Tom