Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New Fiber install, fresh Pfsense install, only getting 20Mbps up/down

    Scheduled Pinned Locked Moved General pfSense Questions
    81 Posts 6 Posters 17.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      If you have the source port in an 802.1q VLAN though it will not pass anything but that VLAN so whatever VLAN tagging the ISP router may or may not be using would get dropped and not appear there.
      The ports the ISP router traffic is using need to pass all tagged traffic.

      J 1 Reply Last reply Reply Quote 0
      • J
        jddoxtator @stephenw10
        last edited by

        @stephenw10 ok, so maybe RSPAN VLAN is not required for this then. Let me try without it.

        1 Reply Last reply Reply Quote 0
        • J
          jddoxtator
          last edited by

          Alright same procedure without RSPAN VLAN.

          34	21.469965	0.0.0.0	255.255.255.255	DHCP	342	DHCP Discover - Transaction ID 0x6b391354
35	21.469991	0.0.0.0	255.255.255.255	DHCP	342	DHCP Discover - Transaction ID 0x6b391354
36	21.477901	172.31.16.1	172.31.17.42	DHCP	398	DHCP Offer    - Transaction ID 0x6b391354
37	21.477929	172.31.16.1	172.31.17.42	DHCP	398	DHCP Offer    - Transaction ID 0x6b391354
38	21.610081	0.0.0.0	255.255.255.255	DHCP	342	DHCP Request  - Transaction ID 0x6b391354
39	21.610104	0.0.0.0	255.255.255.255	DHCP	342	DHCP Request  - Transaction ID 0x6b391354
40	21.619714	172.31.16.1	172.31.17.42	DHCP	398	DHCP ACK      - Transaction ID 0x6b391354
41	21.619814	172.31.16.1	172.31.17.42	DHCP	398	DHCP ACK      - Transaction ID 0x6b391354
42	23.471686	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
43	23.471688	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
44	24.470907	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
45	24.470913	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
46	25.470906	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
47	25.470911	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
48	28.471041	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
49	28.471046	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
50	29.306140	Calix_6b:e8:f7	Broadcast	ARP	60	Who has 172.31.16.1? Tell 172.31.17.42
51	29.306145	Calix_6b:e8:f7	Broadcast	ARP	60	Who has 172.31.16.1? Tell 172.31.17.42
52	29.306893	Cisco_f2:da:7f	Calix_6b:e8:f7	ARP	60	172.31.16.1 is at 7c:69:f6:f2:da:7f
53	29.312275	64.235.98.226	172.31.17.42	DNS	93	Standard query response 0x0d4a A gcs6-ca.calix.com A 52.60.181.28
54	29.336235	8.8.8.8	172.31.17.42	DNS	93	Standard query response 0x0d4a A gcs6-ca.calix.com A 52.60.181.28
55	29.338204	52.60.181.28	172.31.17.42	TCP	74	8443 → 40880 [SYN, ACK] Seq=0 Ack=1 Win=62643 Len=0 MSS=1460 SACK_PERM=1 TSval=237229642 TSecr=5237588 WS=128
56	29.363891	52.60.181.28	172.31.17.42	TLSv1.2	203	Server Hello, Change Cipher Spec, Encrypted Handshake Message
57	29.391025	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [ACK] Seq=138 Ack=822 Win=61952 Len=0 TSval=237229695 TSecr=5237593
58	29.393327	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [ACK] Seq=138 Ack=2270 Win=60544 Len=0 TSval=237229697 TSecr=5237593
59	29.393353	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [ACK] Seq=138 Ack=3718 Win=59136 Len=0 TSval=237229697 TSecr=5237593
60	29.393884	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [ACK] Seq=138 Ack=4326 Win=58624 Len=0 TSval=237229698 TSecr=5237593
61	29.394462	52.60.181.28	172.31.17.42	TLSv1.2	340	Application Data
62	29.426693	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [ACK] Seq=412 Ack=4357 Win=58624 Len=0 TSval=237229730 TSecr=5237597
63	29.426706	52.60.181.28	172.31.17.42	TLSv1.2	97	Encrypted Alert
64	29.426752	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [FIN, ACK] Seq=443 Ack=4357 Win=58624 Len=0 TSval=237229730 TSecr=5237597
65	29.426923	52.60.181.28	172.31.17.42	TCP	66	8443 → 40880 [ACK] Seq=444 Ack=4358 Win=58624 Len=0 TSval=237229731 TSecr=5237597
66	29.452715	52.60.181.28	172.31.17.42	TCP	74	8443 → 36033 [SYN, ACK] Seq=0 Ack=1 Win=62643 Len=0 MSS=1460 SACK_PERM=1 TSval=237229756 TSecr=5237599 WS=128
67	29.470799	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
68	29.470804	Cisco_f4:83:3a	Broadcast	ARP	60	Who has 192.168.1.1? Tell 192.168.1.155
69	29.478182	52.60.181.28	172.31.17.42	TLSv1.2	203	Server Hello, Change Cipher Spec, Encrypted Handshake Message
70	29.505481	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=138 Ack=1101 Win=61696 Len=0 TSval=237229809 TSecr=5237604
71	29.507689	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=138 Ack=2549 Win=60288 Len=0 TSval=237229811 TSecr=5237605
72	29.507715	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=138 Ack=3997 Win=58880 Len=0 TSval=237229811 TSecr=5237605
73	29.507948	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=138 Ack=4560 Win=58368 Len=0 TSval=237229812 TSecr=5237605
74	29.511811	52.60.181.28	172.31.17.42	TLSv1.2	571	Application Data
75	29.576321	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=643 Ack=5156 Win=57856 Len=0 TSval=237229880 TSecr=5237612
76	29.577110	52.60.181.28	172.31.17.42	TLSv1.2	895	Application Data
77	29.610470	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=1472 Ack=5808 Win=57216 Len=0 TSval=237229914 TSecr=5237615
78	29.611045	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=1472 Ack=6921 Win=56576 Len=0 TSval=237229915 TSecr=5237615
79	29.613017	52.60.181.28	172.31.17.42	TLSv1.2	1021	Application Data
80	29.644515	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=2427 Ack=7572 Win=56576 Len=0 TSval=237229948 TSecr=5237618
81	29.644790	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=2427 Ack=8126 Win=56576 Len=0 TSval=237229949 TSecr=5237619
82	29.645791	52.60.181.28	172.31.17.42	TLSv1.2	771	Application Data
83	30.341325	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=8779 Win=56576 Len=0 TSval=237230645 TSecr=5237688
84	30.345607	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=10227 Win=56576 Len=0 TSval=237230649 TSecr=5237689
85	30.345633	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=11675 Win=56576 Len=0 TSval=237230649 TSecr=5237689
86	30.345647	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=14571 Win=56576 Len=0 TSval=237230649 TSecr=5237689
87	30.345653	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=17467 Win=53760 Len=0 TSval=237230649 TSecr=5237689
88	30.345914	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=18915 Win=56576 Len=0 TSval=237230650 TSecr=5237689
89	30.345926	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=21811 Win=56576 Len=0 TSval=237230650 TSecr=5237689
90	30.366516	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=24707 Win=56576 Len=0 TSval=237230670 TSecr=5237691
91	30.370821	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=26155 Win=56576 Len=0 TSval=237230675 TSecr=5237691
92	30.370833	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=30499 Win=56576 Len=0 TSval=237230675 TSecr=5237691
93	30.370877	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=33395 Win=56576 Len=0 TSval=237230675 TSecr=5237691
94	30.371050	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=34843 Win=56576 Len=0 TSval=237230675 TSecr=5237691
95	30.371064	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=36291 Win=56576 Len=0 TSval=237230675 TSecr=5237691
96	30.371882	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=37739 Win=56576 Len=0 TSval=237230676 TSecr=5237691
97	30.371894	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=39187 Win=56576 Len=0 TSval=237230676 TSecr=5237691
98	30.372797	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=3132 Ack=39527 Win=56576 Len=0 TSval=237230677 TSecr=5237691
99	30.376856	52.60.181.28	172.31.17.42	TLSv1.2	1370	Application Data
100	30.403991	52.60.181.28	172.31.17.42	TCP	66	8443 → 36033 [ACK] Seq=4436 Ack=40179 Win=56576 Len=0 TSval=237230708 TSecr=5237694

          Different messages, results much the same as before. ISP router no connection.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Might need to test it with something else then. Make sure you can send tagged traffic between the ports and capture it.

            You might need to use 'Dot1q-Tunnel' mode:
            https://www.cisco.com/c/en/us/td/docs/switches/lan/csbss/CBS220/Adminstration-Guide/cbs-220-admin-guide/vlan-management.html#ID-0000320b

            Since I can see nothing about port based VLANs there.

            Steve

            J 1 Reply Last reply Reply Quote 0
            • J
              jddoxtator @stephenw10
              last edited by jddoxtator

              @stephenw10 Ok, some mild progres. Enabeling Dot1q-Tunnel on the ports I was using allowed the ISP router to full connect. Problem is the only packets I am snooping on the Pfsense box are DNS, DHCP and ARP. Nothing with VLAN information.

              Edit: Fanstatic! I can now eliminate the SFP converter and directly connect the fiber to the switch with the Dot1q-Tunnel trick.

              Edit2: Routing at full speed on ISP router. We are making progress here. Now we just need to get Pfsense to do the same.

              Edit3: yep still capped at 20Mb/s on the Pfsense box.

              keyserK 1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Ok, so you are still not seeing all the traffic to/from the ISP router?

                But you can see it using DHCP to pull an address in the correct subnet from upstream?

                That should show any special dhcp client options it's using.

                Steve

                keyserK 1 Reply Last reply Reply Quote 0
                • keyserK
                  keyser Rebel Alliance @stephenw10
                  last edited by

                  @stephenw10 said in New Fiber install, fresh Pfsense install, only getting 20Mbps up/down:

                  Ok, so you are still not seeing all the traffic to/from the ISP router?

                  But you can see it using DHCP to pull an address in the correct subnet from upstream?

                  That should show any special dhcp client options it's using.

                  Steve

                  Perhaps not true. If he is only seeing dhcp and other broadcasts, he’s either not capturing in promiscious mode, or he’s only seeing the broadcasts in the native VLAN which might be used for ISP management and has nothing to do with the user/internet VLAN

                  Love the no fuss of using the official appliances :-)

                  J 1 Reply Last reply Reply Quote 1
                  • keyserK
                    keyser Rebel Alliance @jddoxtator
                    last edited by keyser

                    @jddoxtator the major issue with using a managed switch is it will by default discard any VLAN tagged frames if that VLAN is not enabled in the switch. Thats why i suggested you used a dumb non managed switch. It makes it infinitely much easier to learn VLAN tags from as Long as you can see the broadcasts.

                    You are likely capturing data on a port that has stripped unknown VLANs or forgot to capture i promiscious mode.
                    If you are capturing on mvneta1 in the SG-2100, remember that is a uplink port to the internal 4 port switch. If dot1.q mode is enabled on that switch to create “discrete” interfaces, then the 2100 is the switch that is stripping unknown VLAN’s

                    Love the no fuss of using the official appliances :-)

                    1 Reply Last reply Reply Quote 0
                    • J
                      jddoxtator @keyser
                      last edited by

                      @keyser Yes, I forgot promiscuous mode. Good catch.

                      Recaptured and I am seeing the PVST+

                      Now the VLAN is type PVID, so I am wondering if that is the issue. I see option in the switch for PVID but not in Pfsense.

                      here is the full details:

                      Originating VLAN (PVID): 85
                      Type: Originating VLAN (0x0000)
                      Length: 2
                      Originating VLAN: 85

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        There is no PVID setting in pfSense (except those with built in switches) because that only applies to assigning VLAN tags to untagged traffic and that only happens in a switch.
                        pfSense either sends and receives tagged traffic on a VLAN interface or untagged traffic on a regular interface.

                        To be clear you are now seeing VLAN tagged traffic in your pcaps on the SPAN port?

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          jddoxtator @stephenw10
                          last edited by

                          @stephenw10 Yes, however I have tried the VLAN 85 before and Pfsense just fails to even connect.

                          There is a possibility I am not implementing the VLAN correctly in Pfsense.

                          What i am doing is creating the VLAN on the bare port ID then assigning that VLAN to WAN instead of having it the bare port ID.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Which is fine if only VLAN85 is required. Looks like something more is so maybe priority tags. And/or custom dhclient values. Something else...

                            keyserK 1 Reply Last reply Reply Quote 0
                            • J
                              jddoxtator
                              last edited by

                              Well this is interesting.... ISP router has completely locked my out of the WebGUI but passes the internet. Tried reboots hooking back up to converter, might have to reset the damned thing.

                              1 Reply Last reply Reply Quote 0
                              • keyserK
                                keyser Rebel Alliance @stephenw10
                                last edited by

                                @stephenw10 said in New Fiber install, fresh Pfsense install, only getting 20Mbps up/down:

                                Which is fine if only VLAN85 is required. Looks like something more is so maybe priority tags. And/or custom dhclient values. Something else...

                                Yes, that might be the next issue. Even if your pfSense is on the correct VLAN some ISP’s do everything they can to deter customers from attaching their own equipment directly.
                                In frace fx. It’s very common that DHCP requests needs to be DSCP queued with 0x06, and a couple DHCP option requests needs to present in the DHCP request. Otherwise the DHCP does not respond, and you experience this as “no service” because nothing responds on the line.

                                To solve that issue you need to capture a successfull DHCP request/offer/ack session from the ISP router, and then see what DHCP options/queue markings is present compared to your regular DHCP request from pfSense when it tries.
                                Rather technical, but solvable :-)

                                Love the no fuss of using the official appliances :-)

                                J 1 Reply Last reply Reply Quote 0
                                • J
                                  jddoxtator @keyser
                                  last edited by

                                  @keyser
                                  Here is what I picked up from a DHCP request:

                                  Option: (55) Parameter Request List
                                  Length: 10
                                  Parameter Request List Item: (1) Subnet Mask
                                  Parameter Request List Item: (28) Broadcast Address
                                  Parameter Request List Item: (2) Time Offset
                                  Parameter Request List Item: (121) Classless Static Route (seen in multiple DHCP tags)
                                  Parameter Request List Item: (3) Router
                                  Parameter Request List Item: (15) Domain Name
                                  Parameter Request List Item: (6) Domain Name Server
                                  Parameter Request List Item: (12) Host Name
                                  Parameter Request List Item: (119) Domain Search
                                  Parameter Request List Item: (26) Interface MTU

                                  Does anything here give any indication of how to configure Pfsense?

                                  keyserK 1 Reply Last reply Reply Quote 0
                                  • keyserK
                                    keyser Rebel Alliance @jddoxtator
                                    last edited by keyser

                                    @jddoxtator said in New Fiber install, fresh Pfsense install, only getting 20Mbps up/down:

                                    @keyser
                                    Here is what I picked up from a DHCP request:

                                    Option: (55) Parameter Request List
                                    Length: 10
                                    Parameter Request List Item: (1) Subnet Mask
                                    Parameter Request List Item: (28) Broadcast Address
                                    Parameter Request List Item: (2) Time Offset
                                    Parameter Request List Item: (121) Classless Static Route (seen in multiple DHCP tags)
                                    Parameter Request List Item: (3) Router
                                    Parameter Request List Item: (15) Domain Name
                                    Parameter Request List Item: (6) Domain Name Server
                                    Parameter Request List Item: (12) Host Name
                                    Parameter Request List Item: (119) Domain Search
                                    Parameter Request List Item: (26) Interface MTU

                                    Does anything here give any indication of how to configure Pfsense?

                                    I’m sorry but that part is a little outside my experience and knowledge field. I was lucky to find a blog describing how to get my pfSense working with the ISP named Orange in France:

                                    https://vincent.bernat.ch/en/blog/2019-orange-livebox-linux
                                    And
                                    https://syscall.eu/blog/2021/10/04/livebox_replacement/

                                    You can skip the ONT part and just look at the DHCP options part. Remember, this is for Orange, and I then found an article on how to get the pfSense DHCP client on WAN to use those settings.

                                    Love the no fuss of using the official appliances :-)

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Yeah, it won't be a parameter request. It will appears as a client option it sends to the server. Assuming it is sending anything custom...

                                      Otherwise check for priority tags or DSCP flags.

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott @stephenw10
                                        last edited by

                                        @stephenw10

                                        I have a Cisco switch here and port mirroring with it is a pain. I created a data tap, with a cheap 5 port managed switch.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.