Odd internet slowness with Netgear GS324TP Switch
-
@creationguy Status/Interfaces
-
@creationguy no talking about just doing a packet capture via the diagnostic menu on pfsense - sure you would then open that up in wireshark to look at.
Or post them here for us to look at.. I would set packet length to something small, say 64 so you don't have large captures, etc..
edit: I would also just install the iperf package, and test to pfsense.. While pfsense is meant to route and firewall, and not really meant as a server.. You can do a simple test are you really limited to 50mbps to pfsense?
Here for example testing to pfsense from client, gig connection.
[22.05-RELEASE][admin@sg4860.local.lan]/root: iperf3 -s ----------------------------------------------------------- Server listening on 5201 (test #1) ----------------------------------------------------------- Accepted connection from 192.168.9.100, port 49892 [ 5] local 192.168.9.253 port 5201 connected to 192.168.9.100 port 49893 [ ID] Interval Transfer Bitrate [ 5] 0.00-1.00 sec 77.6 MBytes 651 Mbits/sec [ 5] 1.00-2.00 sec 78.1 MBytes 655 Mbits/sec [ 5] 2.00-3.00 sec 78.1 MBytes 655 Mbits/sec [ 5] 3.00-4.00 sec 70.9 MBytes 595 Mbits/sec [ 5] 4.00-5.00 sec 52.2 MBytes 438 Mbits/sec [ 5] 5.00-6.00 sec 75.6 MBytes 634 Mbits/sec [ 5] 6.00-7.00 sec 77.5 MBytes 650 Mbits/sec [ 5] 7.00-8.00 sec 77.6 MBytes 651 Mbits/sec [ 5] 8.00-9.00 sec 78.0 MBytes 654 Mbits/sec [ 5] 9.00-10.00 sec 78.1 MBytes 655 Mbits/sec [ 5] 10.00-10.00 sec 55.3 KBytes 655 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate [ 5] 0.00-10.00 sec 744 MBytes 624 Mbits/sec receiver ----------------------------------------------------------- Server listening on 5201 (test #2) ----------------------------------------------------------- -
@johnpoz
I have this set up just like I did last night, and speed tests are showing 300+Mb.....
pfsense status:
WAN: Media 1000baseT <full-duplex>
LAN: Media 1000baseT <full-duplex>Server listening on 5201 ----------------------------------------------------------- Accepted connection from 10.10.10.1, port 12788 [ 5] local 10.10.10.10 port 5201 connected to 10.10.10.1 port 2270 [ ID] Interval Transfer Bandwidth [ 5] 0.00-1.00 sec 89.5 MBytes 750 Mbits/sec [ 5] 1.00-2.00 sec 100 MBytes 843 Mbits/sec [ 5] 2.00-3.00 sec 105 MBytes 884 Mbits/sec [ 5] 3.00-4.00 sec 110 MBytes 925 Mbits/sec [ 5] 4.00-5.00 sec 109 MBytes 918 Mbits/sec [ 5] 5.00-6.00 sec 110 MBytes 926 Mbits/sec [ 5] 6.00-7.00 sec 78.8 MBytes 661 Mbits/sec [ 5] 7.00-8.00 sec 109 MBytes 912 Mbits/sec [ 5] 8.00-9.00 sec 101 MBytes 844 Mbits/sec [ 5] 9.00-10.00 sec 98.6 MBytes 827 Mbits/sec [ 5] 10.00-10.09 sec 9.97 MBytes 892 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bandwidth [ 5] 0.00-10.09 sec 0.00 Bytes 0.00 bits/sec sender [ 5] 0.00-10.09 sec 1022 MBytes 849 Mbits/sec receiverI also restored my backup that brings pfsense back to all of my configs, VLANs, rules, etc and the same results. I will test VLANing on the switch more tomorrow. I'm really at a loss here.... I just don't understand it, maybe it was a duplex issue that I didn't pick up on, it was very late at night but I was sure I looked. I'll shut the system down and try again tomorrow.
-
Speeds are good, as they were since the last post.
I have found, that on the desktop class, dual NIC that I'm using in the pfSense box, inter-VLAN routing is slow, I transferred a 700MB video file at 7MB/s. Both devices are at 1Gb Full duplex. I did double check all of the connected devices (switch and NICs).
When putting the two devices on the same VLAN I was getting 109+MB/s.
Is 7MB/s normal?
-
@creationguy said in Odd internet slowness with Netgear GS324TP Switch:
Is 7MB/s normal?
No not really, gig should be like 100MBps plus - 109MB would pretty freaking close to max
Keep in mind if your doing intervlan on the same physical nic, sure there might could be a performance hit, but so low as 7..
You got something wrong..
Do your iperf3 testing between the devices you were doing the file copy on intervaln.. What do you get?
Is one or both of these devices wireless? 7MBps is like 100mbps speeds, not gig..
-
@johnpoz All devices are wired, 1Gb connections, full duplex, I double checked.
From Desktop 3 (VLAN 10) to Desktop 2 (VLAN 50) I get this:
.\iperf3.exe -c 10.50.50.3 Connecting to host 10.50.50.3, port 5201 [ 4] local 10.0.0.10 port 50372 connected to 10.50.50.3 port 5201 [ ID] Interval Transfer Bandwidth [ 4] 0.00-1.00 sec 2.88 MBytes 24.1 Mbits/sec [ 4] 1.00-2.01 sec 1.62 MBytes 13.5 Mbits/sec [ 4] 2.01-3.01 sec 2.00 MBytes 16.9 Mbits/sec [ 4] 3.01-4.01 sec 2.38 MBytes 20.0 Mbits/sec [ 4] 4.01-5.01 sec 3.00 MBytes 25.1 Mbits/sec [ 4] 5.01-6.01 sec 1.38 MBytes 11.5 Mbits/sec [ 4] 6.01-7.00 sec 2.88 MBytes 24.3 Mbits/sec [ 4] 7.00-8.00 sec 2.38 MBytes 19.9 Mbits/sec [ 4] 8.00-9.00 sec 5.88 MBytes 49.3 Mbits/sec [ 4] 9.00-10.01 sec 4.38 MBytes 36.4 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bandwidth [ 4] 0.00-10.01 sec 28.8 MBytes 24.1 Mbits/sec sender [ 4] 0.00-10.01 sec 28.5 MBytes 23.9 Mbits/sec receiver iperf Done.VLAN 50 is internet only, 10 is internal and can access 50.
The NIC in the pfsense box, it's 1 NIC with 2 separate connections, however, 1 NIC is WAN the other is LAN with the other VLAN as virtual (I think that's the right term) interfaces on the LAN interface.
This is how I would set up the Netgate 4100, one of the ports would connect to the Switch and all VLANS travel over that port.
-
@creationguy well with those speeds I don't see how you were seeing 7MBs? Did you mean 7mbps?
That is horrile horrible speeds.. Something is clearly wrong for sure.. This isn't a VM install of pfsense - right, this is sg4100?
This is iperf test from one of my vlans to another vlan, and the server in this case is even a VM running on my nas.
$ iperf3.exe -c 192.168.2.12 Connecting to host 192.168.2.12, port 5201 [ 5] local 192.168.9.100 port 52822 connected to 192.168.2.12 port 5201 [ ID] Interval Transfer Bitrate [ 5] 0.00-1.00 sec 111 MBytes 927 Mbits/sec [ 5] 1.00-2.00 sec 111 MBytes 933 Mbits/sec [ 5] 2.00-3.00 sec 111 MBytes 933 Mbits/sec [ 5] 3.00-4.00 sec 112 MBytes 938 Mbits/sec [ 5] 4.00-5.00 sec 111 MBytes 933 Mbits/sec [ 5] 5.00-6.00 sec 112 MBytes 940 Mbits/sec [ 5] 6.00-7.00 sec 111 MBytes 931 Mbits/sec [ 5] 7.00-8.00 sec 112 MBytes 937 Mbits/sec [ 5] 8.00-9.00 sec 112 MBytes 940 Mbits/sec [ 5] 9.00-10.00 sec 112 MBytes 939 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate [ 5] 0.00-10.00 sec 1.09 GBytes 935 Mbits/sec sender [ 5] 0.00-10.05 sec 1.09 GBytes 930 Mbits/sec receiver iperf Done. -
I have not purchased the 4100 yet, I am testing on a Desktop computer with a DUAL head NIC. pfsense is bare metal.
-
@creationguy so this is a dual port nic? What nic?
So 1 port on this dual port nic is your wan, and then other port is lan and you have a vlan setup on this lan port of the interface..
So while you are hairpinning that connection - that is just horrible horrible speeds.. Those are like old 802.11g speeds ;)
-
@johnpoz Is the problem that it's a dual nic or is it something else?
-
@creationguy Shouldn't be an issue with a dual nic.
How are your Vlans setup? Default untagged and the rest tagged?
Supposedly there's an issue with BSD and having an untagged vlan on a trunk but I never had a problem with it.
Can you try tagging them all?(assuming you have default untagged since you said if you plug directly into pfSense it works fine)
-
@jarhead said in Odd internet slowness with Netgear GS324TP Switch:
BSD and having an untagged vlan on a trunk
I have not run into this, and I run a native untagged on the interface my vlans are on.
I am not sure where the problem is - but those speeds are horrible, so clearly something is wrong..
-
-
@creationguy You have every port untagged with vlan 1, why?
You also have ports that should be in the other vlans as tagged. They should be untagged.
Good rule of thumb, you only tag a vlan if the device you're plugging into that port is also tagged.
Remove vlan 1 from ports it's not being used on and untag the ports that are not trunked.
So ports 1-4 should be untagged with vlan 10 ONLY.
Ports 5 and 6 untagged with vlan 20 only etc. -
@jarhead I am new to VLANs, I found a couple of guides for Netgear managed switches and that's what worked. I've updated the settings:
VLAN 1 is a default VLAN on the switch that I can't seem to disable.In order for me to get the two devices on guest to obtain an IP, I had to:
Un-tag the two ports, and set their PVID to the VLAN as these devices are not 802.1q aware. I found this thread here.I don't have a way though to test if these devices can reach other VLANs. I do know that desktops on this VLAN 50 can't see devices on other VLANs, but those devices are not set up the same way (Untagged None).
Edit: I placed a desktop in VLAN 50, the same manor as port 10 pictured above. I have a firewall rule set up so that 50 cannot access ANY, just internet. VLAN 10 can access all VLANs. This desktop cannot ping desktop in VLAN 10 until a desktop in VLAN 10 pings that VLAN 50 desktop. After awhile, VLAN 50 desktop can no longer ping VLAN 10 desktop. See below for the rules.
-
@creationguy You still have the ports tagged. They should be untagged unless your devices themselves are also tagged (hint: they aren't).
Ports 1-6 should be untagged ONLY. Nothing tagged on them. Along with all other ports that are "device" ports.
Only port that should be tagged is trunk ports (hint: port 24).
So only the port going to pfSense and any ports going to AP's that are using vlans if you have any. -
@jarhead I'm confused now- you should that ports 1-6, which I want on VLAN 10 should be untagged, are you saying untagged under the VLAN Tag column?
I reset the switch, and configured port 7 for VLAN 10.
Thank you for taking the time to help with this.
-
@creationguy Again, only tag a port if the device connected to it is also tagged.
So if you're plugging pc's into ports, they should be untagged ports.If you go back to the pic from the previous post, under the "Vlan tag" column, all ports should be NONE except the port going to pfSense (port 24).
1-4 should be untagged with vlan id 10, 5 and 6 untagged with vlan id 20.
They should all (except 24) look like port 20 except with the correct vlans on them.Fix the switch, then we'll get to the firewall. You have issues there with understanding rules.
@johnpoz will go into much more detail for you than I will but to sum it up, putting a rule on vlan 10 does not stop other vlans from talking to vlan 10. You need a rule on the other interfaces to do that.
That's why you could ping one way, which created a state that allowed you to ping the other way. -
@jarhead
Ports 1-4 should be on VLAN 10, with port 1 needing to access VLAN 1 which is the switch (built in Netgear setting).
The others shown are guest devices, of which, can't access VLAN 10, unless the device on VLAN 10 pings it. Eventually it stops being able to ping it.
I thought that my rules were fine, as shown below, I have the Guest set to not be able to communicate with the specified VLANs.
-
@creationguy said in Odd internet slowness with Netgear GS324TP Switch:
Ports 1-4 should be on VLAN 10, with port 1 needing to access VLAN 1 which is the switch (built in Netgear setting).
Having port 1 as untagged on two VLANs can cause problems and could result in data leaking into VLAN 10.
Ryan
Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
Requesting firmware for your Netgate device? https://go.netgate.com
Switching: Mikrotik, Netgear, Extreme
Wireless: Aruba, Ubiquiti
