Odd internet slowness with Netgear GS324TP Switch
-
@johnpoz All devices are wired, 1Gb connections, full duplex, I double checked.
From Desktop 3 (VLAN 10) to Desktop 2 (VLAN 50) I get this:
.\iperf3.exe -c 10.50.50.3 Connecting to host 10.50.50.3, port 5201 [ 4] local 10.0.0.10 port 50372 connected to 10.50.50.3 port 5201 [ ID] Interval Transfer Bandwidth [ 4] 0.00-1.00 sec 2.88 MBytes 24.1 Mbits/sec [ 4] 1.00-2.01 sec 1.62 MBytes 13.5 Mbits/sec [ 4] 2.01-3.01 sec 2.00 MBytes 16.9 Mbits/sec [ 4] 3.01-4.01 sec 2.38 MBytes 20.0 Mbits/sec [ 4] 4.01-5.01 sec 3.00 MBytes 25.1 Mbits/sec [ 4] 5.01-6.01 sec 1.38 MBytes 11.5 Mbits/sec [ 4] 6.01-7.00 sec 2.88 MBytes 24.3 Mbits/sec [ 4] 7.00-8.00 sec 2.38 MBytes 19.9 Mbits/sec [ 4] 8.00-9.00 sec 5.88 MBytes 49.3 Mbits/sec [ 4] 9.00-10.01 sec 4.38 MBytes 36.4 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bandwidth [ 4] 0.00-10.01 sec 28.8 MBytes 24.1 Mbits/sec sender [ 4] 0.00-10.01 sec 28.5 MBytes 23.9 Mbits/sec receiver iperf Done.VLAN 50 is internet only, 10 is internal and can access 50.
The NIC in the pfsense box, it's 1 NIC with 2 separate connections, however, 1 NIC is WAN the other is LAN with the other VLAN as virtual (I think that's the right term) interfaces on the LAN interface.
This is how I would set up the Netgate 4100, one of the ports would connect to the Switch and all VLANS travel over that port.
-
@creationguy well with those speeds I don't see how you were seeing 7MBs? Did you mean 7mbps?
That is horrile horrible speeds.. Something is clearly wrong for sure.. This isn't a VM install of pfsense - right, this is sg4100?
This is iperf test from one of my vlans to another vlan, and the server in this case is even a VM running on my nas.
$ iperf3.exe -c 192.168.2.12 Connecting to host 192.168.2.12, port 5201 [ 5] local 192.168.9.100 port 52822 connected to 192.168.2.12 port 5201 [ ID] Interval Transfer Bitrate [ 5] 0.00-1.00 sec 111 MBytes 927 Mbits/sec [ 5] 1.00-2.00 sec 111 MBytes 933 Mbits/sec [ 5] 2.00-3.00 sec 111 MBytes 933 Mbits/sec [ 5] 3.00-4.00 sec 112 MBytes 938 Mbits/sec [ 5] 4.00-5.00 sec 111 MBytes 933 Mbits/sec [ 5] 5.00-6.00 sec 112 MBytes 940 Mbits/sec [ 5] 6.00-7.00 sec 111 MBytes 931 Mbits/sec [ 5] 7.00-8.00 sec 112 MBytes 937 Mbits/sec [ 5] 8.00-9.00 sec 112 MBytes 940 Mbits/sec [ 5] 9.00-10.00 sec 112 MBytes 939 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate [ 5] 0.00-10.00 sec 1.09 GBytes 935 Mbits/sec sender [ 5] 0.00-10.05 sec 1.09 GBytes 930 Mbits/sec receiver iperf Done. -
I have not purchased the 4100 yet, I am testing on a Desktop computer with a DUAL head NIC. pfsense is bare metal.
-
@creationguy so this is a dual port nic? What nic?
So 1 port on this dual port nic is your wan, and then other port is lan and you have a vlan setup on this lan port of the interface..
So while you are hairpinning that connection - that is just horrible horrible speeds.. Those are like old 802.11g speeds ;)
-
@johnpoz Is the problem that it's a dual nic or is it something else?
-
@creationguy Shouldn't be an issue with a dual nic.
How are your Vlans setup? Default untagged and the rest tagged?
Supposedly there's an issue with BSD and having an untagged vlan on a trunk but I never had a problem with it.
Can you try tagging them all?(assuming you have default untagged since you said if you plug directly into pfSense it works fine)
-
@jarhead said in Odd internet slowness with Netgear GS324TP Switch:
BSD and having an untagged vlan on a trunk
I have not run into this, and I run a native untagged on the interface my vlans are on.
I am not sure where the problem is - but those speeds are horrible, so clearly something is wrong..
-
-
@creationguy You have every port untagged with vlan 1, why?
You also have ports that should be in the other vlans as tagged. They should be untagged.
Good rule of thumb, you only tag a vlan if the device you're plugging into that port is also tagged.
Remove vlan 1 from ports it's not being used on and untag the ports that are not trunked.
So ports 1-4 should be untagged with vlan 10 ONLY.
Ports 5 and 6 untagged with vlan 20 only etc. -
@jarhead I am new to VLANs, I found a couple of guides for Netgear managed switches and that's what worked. I've updated the settings:
VLAN 1 is a default VLAN on the switch that I can't seem to disable.In order for me to get the two devices on guest to obtain an IP, I had to:
Un-tag the two ports, and set their PVID to the VLAN as these devices are not 802.1q aware. I found this thread here.I don't have a way though to test if these devices can reach other VLANs. I do know that desktops on this VLAN 50 can't see devices on other VLANs, but those devices are not set up the same way (Untagged None).
Edit: I placed a desktop in VLAN 50, the same manor as port 10 pictured above. I have a firewall rule set up so that 50 cannot access ANY, just internet. VLAN 10 can access all VLANs. This desktop cannot ping desktop in VLAN 10 until a desktop in VLAN 10 pings that VLAN 50 desktop. After awhile, VLAN 50 desktop can no longer ping VLAN 10 desktop. See below for the rules.
-
@creationguy You still have the ports tagged. They should be untagged unless your devices themselves are also tagged (hint: they aren't).
Ports 1-6 should be untagged ONLY. Nothing tagged on them. Along with all other ports that are "device" ports.
Only port that should be tagged is trunk ports (hint: port 24).
So only the port going to pfSense and any ports going to AP's that are using vlans if you have any. -
@jarhead I'm confused now- you should that ports 1-6, which I want on VLAN 10 should be untagged, are you saying untagged under the VLAN Tag column?
I reset the switch, and configured port 7 for VLAN 10.
Thank you for taking the time to help with this.
-
@creationguy Again, only tag a port if the device connected to it is also tagged.
So if you're plugging pc's into ports, they should be untagged ports.If you go back to the pic from the previous post, under the "Vlan tag" column, all ports should be NONE except the port going to pfSense (port 24).
1-4 should be untagged with vlan id 10, 5 and 6 untagged with vlan id 20.
They should all (except 24) look like port 20 except with the correct vlans on them.Fix the switch, then we'll get to the firewall. You have issues there with understanding rules.
@johnpoz will go into much more detail for you than I will but to sum it up, putting a rule on vlan 10 does not stop other vlans from talking to vlan 10. You need a rule on the other interfaces to do that.
That's why you could ping one way, which created a state that allowed you to ping the other way. -
@jarhead
Ports 1-4 should be on VLAN 10, with port 1 needing to access VLAN 1 which is the switch (built in Netgear setting).
The others shown are guest devices, of which, can't access VLAN 10, unless the device on VLAN 10 pings it. Eventually it stops being able to ping it.
I thought that my rules were fine, as shown below, I have the Guest set to not be able to communicate with the specified VLANs.
-
@creationguy said in Odd internet slowness with Netgear GS324TP Switch:
Ports 1-4 should be on VLAN 10, with port 1 needing to access VLAN 1 which is the switch (built in Netgear setting).
Having port 1 as untagged on two VLANs can cause problems and could result in data leaking into VLAN 10.
-
@creationguy Get rid of vlan 1 on ports 1 and 7. If you're saying you can't take it off of port 1, switch ports. ie leave port 1 at vlan 1 only and use port 5 as vlan 10.
As I said earlier, you'll need to add a rule on your other interfaces to stop them from accessing vlan 10. You can use the copy feature of your existing rule and just change the interface it's on and source/destination as needed. -
@rcoleman-netgate said in Odd internet slowness with Netgear GS324TP Switch:
@creationguy said in Odd internet slowness with Netgear GS324TP Switch:
Ports 1-4 should be on VLAN 10, with port 1 needing to access VLAN 1 which is the switch (built in Netgear setting).
Having port 1 as untagged on two VLANs can cause problems and could result in data leaking into VLAN 10.
How would I configure the port so that I could access the switch to manage?
-
@creationguy Had you tried iperf with the settings like that. Should see a difference now.
-
This post is deleted! -
@creationguy said in Odd internet slowness with Netgear GS324TP Switch:
How would I configure the port so that I could access the switch to manage?
Move your pfSense to port 1?
Also ... it should be accessible through pf via VLAN1
