Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Throughput from Lan to Wan

    Scheduled Pinned Locked Moved General pfSense Questions
    26 Posts 4 Posters 6.5k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O Offline
      Orkopaede
      last edited by

      My next test confirms that there is a problem within the PF. I activated another Ethernet port (OPT1) to test the speed directly from the PC through the PF to the Internet. So without a switch or possible defective cable in between. Unfortunately I have also only the 16Mbit here.

      1 Reply Last reply Reply Quote 0
      • O Offline
        Orkopaede
        last edited by

        okay it doesn't seem to be a problem with PF after all.? As a test, I set up several connections at the same time with iperf and the option -P and then I get my 200Mbit. So maybe it's a Windows problem? I do not get it. Any idea, suggestions?

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ Offline
          johnpoz LAYER 8 Global Moderator @Orkopaede
          last edited by johnpoz

          @orkopaede have had lack luster success with iperf to the internet. If you put a device on your pfsense wan network and do an iperf what do you get through pfsense.

          What does a normal just web based speedtest show. If you have a hard time putting something on your pfsense wan network to test with. Just create a outbound nat on pfsense to one of your other local networks. So pfsense is both firewalling and natting - this is what it does to your internet connection.

          So doing a iperf to my nas with outbound nat so pfsense is doing exactly what it does to the internet.. I see

          $ iperf3.exe -c 192.168.2.42
          Connecting to host 192.168.2.42, port 5201
          [  5] local 192.168.9.100 port 49470 connected to 192.168.2.42 port 5201
          [ ID] Interval           Transfer     Bitrate
          [  5]   0.00-1.00   sec   115 MBytes   961 Mbits/sec
          [  5]   1.00-2.00   sec   112 MBytes   937 Mbits/sec
          [  5]   2.00-3.00   sec   113 MBytes   946 Mbits/sec
          [  5]   3.00-4.00   sec   112 MBytes   943 Mbits/sec
          [  5]   4.00-5.00   sec   112 MBytes   936 Mbits/sec
          [  5]   5.00-6.00   sec   112 MBytes   944 Mbits/sec
          [  5]   6.00-7.00   sec   112 MBytes   936 Mbits/sec
          [  5]   7.00-8.00   sec   112 MBytes   939 Mbits/sec
          [  5]   8.00-9.00   sec   113 MBytes   945 Mbits/sec
          [  5]   9.00-10.00  sec   112 MBytes   940 Mbits/sec
          - - - - - - - - - - - - - - - - - - - - - - - - -
          [ ID] Interval           Transfer     Bitrate
          [  5]   0.00-10.00  sec  1.10 GBytes   943 Mbits/sec                  sender
          [  5]   0.00-10.00  sec  1.10 GBytes   941 Mbits/sec                  receiver
          

          This is for sure close enough to wire speed.. If I take pfsense out of the picture and go directly to the nas over the lan network..

          $ iperf3.exe -c 192.168.9.10
          Connecting to host 192.168.9.10, port 5201
          [  5] local 192.168.9.100 port 49465 connected to 192.168.9.10 port 5201
          [ ID] Interval           Transfer     Bitrate
          [  5]   0.00-1.00   sec   114 MBytes   952 Mbits/sec
          [  5]   1.00-2.00   sec   114 MBytes   962 Mbits/sec
          [  5]   2.00-3.00   sec   113 MBytes   949 Mbits/sec
          [  5]   3.00-4.00   sec   113 MBytes   949 Mbits/sec
          [  5]   4.00-5.00   sec   113 MBytes   949 Mbits/sec
          [  5]   5.00-6.00   sec   113 MBytes   950 Mbits/sec
          [  5]   6.00-7.00   sec   113 MBytes   949 Mbits/sec
          [  5]   7.00-8.00   sec   113 MBytes   949 Mbits/sec
          [  5]   8.00-9.00   sec   113 MBytes   950 Mbits/sec
          [  5]   9.00-10.00  sec   113 MBytes   948 Mbits/sec
          - - - - - - - - - - - - - - - - - - - - - - - - -
          [ ID] Interval           Transfer     Bitrate
          [  5]   0.00-10.00  sec  1.11 GBytes   951 Mbits/sec                  sender
          [  5]   0.00-10.01  sec  1.11 GBytes   949 Mbits/sec                  receiver
          

          Here is the outbound nat I created

          outboundnat.jpg

          Can't really do a test to nas on different network that my pc without doing this without disruption of my network setup. Since the nas has an IP in lan, I run into asymmetrical traffic flow problem - because the nas likes to answer the connection to its 2.42 address via its 9.10 address. This setup makes sure all traffic flows through pfsense, and pfsense nats it, just like it would do to the internet.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 25.07 | Lab VMs 2.8, 25.07

          O 1 Reply Last reply Reply Quote 0
          • O Offline
            Orkopaede @johnpoz
            last edited by

            @johnpoz Hi, unfortunately I can't put a device in front of the PF because of the fiber optic router. The router only accepts one MAC to communicate with. If that was your idea? As I said, I get 200Mbit from the PF with Iperf. A web-based speed test gives the same result (16Mbit). My last test with the multiple connections made me think that it might be a Windows or anti-virus software problem. While looking for a windows speed cap I came across this:

            Windows 10 internet speed capped

            With that I get 65Mbit. Which is better. But theoretically it's not the end yet.

            I'll test that with the OUTBOUND NAT.
            Results will follow immediately.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ Offline
              johnpoz LAYER 8 Global Moderator @Orkopaede
              last edited by johnpoz

              @orkopaede recv window - yup that could have effect for sure..

              What were your settings? And what did you change them too.. Here are mine

              $ netsh interface tcp show global                 
              Querying active state...                          
                                                                
              TCP Global Parameters                             
              ----------------------------------------------    
              Receive-Side Scaling State          : enabled     
              Receive Window Auto-Tuning Level    : normal      
              Add-On Congestion Control Provider  : default     
              ECN Capability                      : enabled     
              RFC 1323 Timestamps                 : disabled    
              Initial RTO                         : 1000        
              Receive Segment Coalescing State    : enabled     
              Non Sack Rtt Resiliency             : disabled    
              Max SYN Retransmissions             : 4           
              Fast Open                           : enabled     
              Fast Open Fallback                  : enabled     
              HyStart                             : enabled     
              Proportional Rate Reduction         : enabled     
              Pacing Profile                      : off         
                                                                
              

              BTW - when your testing from client to server in iperf.. Make sure you test just over the local network, where they are on the same - so you can validate you do see wirespeed between the clients. You might also what to check in reverse flow, normally the client is the sender..

              You can test with -V and see some more details of the test

              $ iperf3.exe -c 192.168.9.10 -V                                                                          
              iperf 3.13                                                                                               
              CYGWIN_NT-10.0-19045 i9-win 3.4.6-1.x86_64 2023-02-14 13:23 UTC x86_64                                   
              Control connection MSS 1460                                                                              
              Time: Wed, 22 Feb 2023 13:28:22 GMT                                                                      
              Connecting to host 192.168.9.10, port 5201                                                               
                    Cookie: grthd7rff3wrvul2smkaytwr6lrnyegxxmp6                                                       
                    TCP MSS: 1460 (default)                                                                            
              [  5] local 192.168.9.100 port 49589 connected to 192.168.9.10 port 5201                                 
              Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test, tos 0   
              [ ID] Interval           Transfer     Bitrate                                                            
              [  5]   0.00-1.00   sec   115 MBytes   965 Mbits/sec                                                     
              [  5]   1.00-2.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   2.00-3.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   3.00-4.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   4.00-5.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   5.00-6.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   6.00-7.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   7.00-8.00   sec   113 MBytes   948 Mbits/sec                                                     
              [  5]   8.00-9.00   sec   113 MBytes   949 Mbits/sec                                                     
              [  5]   9.00-10.00  sec   113 MBytes   950 Mbits/sec                                                     
              - - - - - - - - - - - - - - - - - - - - - - - - -                                                        
              Test Complete. Summary Results:                                                                          
              [ ID] Interval           Transfer     Bitrate                                                            
              [  5]   0.00-10.00  sec  1.11 GBytes   951 Mbits/sec                  sender                             
              [  5]   0.00-10.01  sec  1.11 GBytes   949 Mbits/sec                  receiver                           
              CPU Utilization: local/sender 8.7% (5.0%u/3.7%s), remote/receiver 13.6% (1.0%u/12.6%s)                   
              rcv_tcp_congestion cubic                                                                                 
                                                                                                                       
              iperf Done.                                                                                              
              
              $ iperf3.exe -c 192.168.9.10 -V -R
              iperf 3.13
              CYGWIN_NT-10.0-19045 i9-win 3.4.6-1.x86_64 2023-02-14 13:23 UTC x86_64
              Control connection MSS 1460
              Time: Wed, 22 Feb 2023 13:29:20 GMT
              Connecting to host 192.168.9.10, port 5201
              Reverse mode, remote host 192.168.9.10 is sending
                    Cookie: cvgi4td7ruemmazafk53j3da7qqzy35unrkm
                    TCP MSS: 1460 (default)
              [  5] local 192.168.9.100 port 49593 connected to 192.168.9.10 port 5201
              Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test, tos 0
              [ ID] Interval           Transfer     Bitrate
              [  5]   0.00-1.00   sec   113 MBytes   948 Mbits/sec
              [  5]   1.00-2.00   sec   113 MBytes   949 Mbits/sec
              [  5]   2.00-3.00   sec   113 MBytes   947 Mbits/sec
              [  5]   3.00-4.00   sec   113 MBytes   949 Mbits/sec
              [  5]   4.00-5.00   sec   113 MBytes   949 Mbits/sec
              [  5]   5.00-6.00   sec   113 MBytes   948 Mbits/sec
              [  5]   6.00-7.00   sec   113 MBytes   949 Mbits/sec
              [  5]   7.00-8.00   sec   113 MBytes   949 Mbits/sec
              [  5]   8.00-9.00   sec   113 MBytes   949 Mbits/sec
              [  5]   9.00-10.00  sec   113 MBytes   949 Mbits/sec
              - - - - - - - - - - - - - - - - - - - - - - - - -
              Test Complete. Summary Results:
              [ ID] Interval           Transfer     Bitrate         Retr
              [  5]   0.00-10.00  sec  1.11 GBytes   951 Mbits/sec    0             sender
              [  5]   0.00-10.00  sec  1.10 GBytes   949 Mbits/sec                  receiver
              snd_tcp_congestion cubic
              
              iperf Done.
              

              Notice when use the -R it clearly states that 9.10 is the sender.

              edit: Look how crappy it gets if I turn the window size down to 8k, which could be default..

              $ iperf3.exe -c 192.168.9.10 -V -w 8k
              iperf 3.13
              CYGWIN_NT-10.0-19045 i9-win 3.4.6-1.x86_64 2023-02-14 13:23 UTC x86_64
              Control connection MSS 1460
              Time: Wed, 22 Feb 2023 13:32:57 GMT
              Connecting to host 192.168.9.10, port 5201
                    Cookie: vrzgka56k7hvizu4wdagwtpww4tlc6b6yych
                    TCP MSS: 1460 (default)
              [  5] local 192.168.9.100 port 49603 connected to 192.168.9.10 port 5201
              Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test, tos 0
              [ ID] Interval           Transfer     Bitrate
              [  5]   0.00-1.00   sec  29.5 MBytes   247 Mbits/sec
              [  5]   1.00-2.00   sec  29.4 MBytes   247 Mbits/sec
              [  5]   2.00-3.00   sec  27.6 MBytes   232 Mbits/sec
              [  5]   3.00-4.01   sec  30.6 MBytes   253 Mbits/sec
              [  5]   4.01-5.00   sec  31.7 MBytes   269 Mbits/sec
              [  5]   5.00-6.00   sec  28.6 MBytes   240 Mbits/sec
              [  5]   6.00-7.00   sec  29.1 MBytes   244 Mbits/sec
              [  5]   7.00-8.00   sec  32.2 MBytes   270 Mbits/sec
              [  5]   8.00-9.00   sec  27.6 MBytes   232 Mbits/sec
              [  5]   9.00-10.00  sec  28.6 MBytes   240 Mbits/sec
              - - - - - - - - - - - - - - - - - - - - - - - - -
              Test Complete. Summary Results:
              [ ID] Interval           Transfer     Bitrate
              [  5]   0.00-10.00  sec   295 MBytes   247 Mbits/sec                  sender
              [  5]   0.00-10.00  sec   295 MBytes   247 Mbits/sec                  receiver
              CPU Utilization: local/sender 24.6% (12.1%u/12.6%s), remote/receiver 22.4% (2.3%u/20.1%s)
              rcv_tcp_congestion cubic
              
              iperf Done.
              

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 25.07 | Lab VMs 2.8, 25.07

              O 1 Reply Last reply Reply Quote 0
              • O Offline
                Orkopaede @johnpoz
                last edited by

                @johnpoz Before:

                TCP Global Parameters
                ----------------------------------------------
                Receive-Side Scaling State          : disabled
                Receive Window Auto-Tuning Level    : disabled
                Add-On Congestion Control Provider  : default
                ECN Capability                      : disabled
                RFC 1323 Timestamps                 : disabled
                Initial RTO                         : 1000
                Receive Segment Coalescing State    : enabled
                Non Sack Rtt Resiliency             : disabled
                Max SYN Retransmissions             : 4
                Fast Open                           : enabled
                Fast Open Fallback                  : enabled
                HyStart                             : enabled
                Proportional Rate Reduction         : enabled
                Pacing Profile                      : off
                

                After with: netsh int tcp set global autotuninglevel=normal

                TCP Global Parameters
                ----------------------------------------------
                Receive-Side Scaling State          : disabled
                Receive Window Auto-Tuning Level    : normal
                Add-On Congestion Control Provider  : default
                ECN Capability                      : disabled
                RFC 1323 Timestamps                 : disabled
                Initial RTO                         : 1000
                Receive Segment Coalescing State    : enabled
                Non Sack Rtt Resiliency             : disabled
                Max SYN Retransmissions             : 4
                Fast Open                           : enabled
                Fast Open Fallback                  : enabled
                HyStart                             : enabled
                Proportional Rate Reduction         : enabled
                Pacing Profile                      : off
                
                iperf3.exe -c 192.168.8.248 -V
                
                iperf 3.1.3
                CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                Time: Wed, 22 Feb 2023 13:38:39 GMT
                Connecting to host 192.168.8.248, port 5201
                      Cookie: WernerLaptop.1677073117.500543.72f2e
                      TCP MSS: 0 (default)
                [  4] local 192.168.8.34 port 2341 connected to 192.168.8.248 port 5201
                Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                [ ID] Interval           Transfer     Bandwidth
                [  4]   0.00-1.00   sec   112 MBytes   936 Mbits/sec
                [  4]   1.00-2.00   sec   113 MBytes   945 Mbits/sec
                [  4]   2.00-3.00   sec   113 MBytes   949 Mbits/sec
                [  4]   3.00-4.00   sec   112 MBytes   942 Mbits/sec
                [  4]   4.00-5.00   sec   113 MBytes   947 Mbits/sec
                [  4]   5.00-6.00   sec   113 MBytes   949 Mbits/sec
                [  4]   6.00-7.00   sec   113 MBytes   949 Mbits/sec
                [  4]   7.00-8.00   sec   112 MBytes   943 Mbits/sec
                [  4]   8.00-9.00   sec   112 MBytes   941 Mbits/sec
                [  4]   9.00-10.00  sec   112 MBytes   943 Mbits/sec
                - - - - - - - - - - - - - - - - - - - - - - - - -
                Test Complete. Summary Results:
                [ ID] Interval           Transfer     Bandwidth
                [  4]   0.00-10.00  sec  1.10 GBytes   945 Mbits/sec                  sender
                [  4]   0.00-10.00  sec  1.10 GBytes   945 Mbits/sec                  receiver
                CPU Utilization: local/sender 19.2% (2.1%u/17.1%s), remote/receiver 37.3% (1.8%u/35.7%s)
                
                iperf Done.
                
                iperf3.exe -c 192.168.8.248 -V -R
                
                iperf 3.1.3
                CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                Time: Wed, 22 Feb 2023 13:39:01 GMT
                Connecting to host 192.168.8.248, port 5201
                Reverse mode, remote host 192.168.8.248 is sending
                      Cookie: WernerLaptop.1677073141.672333.7cdce
                      TCP MSS: 0 (default)
                [  4] local 192.168.8.34 port 2351 connected to 192.168.8.248 port 5201
                Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                [ ID] Interval           Transfer     Bandwidth
                [  4]   0.00-1.00   sec   112 MBytes   942 Mbits/sec
                [  4]   1.00-2.00   sec   107 MBytes   898 Mbits/sec
                [  4]   2.00-3.00   sec   112 MBytes   939 Mbits/sec
                [  4]   3.00-4.00   sec   113 MBytes   945 Mbits/sec
                [  4]   4.00-5.00   sec   110 MBytes   919 Mbits/sec
                [  4]   5.00-6.00   sec   102 MBytes   855 Mbits/sec
                [  4]   6.00-7.00   sec   109 MBytes   917 Mbits/sec
                [  4]   7.00-8.00   sec   110 MBytes   923 Mbits/sec
                [  4]   8.00-9.00   sec  95.4 MBytes   800 Mbits/sec
                [  4]   9.00-10.00  sec   107 MBytes   899 Mbits/sec
                - - - - - - - - - - - - - - - - - - - - - - - - -
                Test Complete. Summary Results:
                [ ID] Interval           Transfer     Bandwidth       Retr
                [  4]   0.00-10.00  sec  1.05 GBytes   904 Mbits/sec    0             sender
                [  4]   0.00-10.00  sec  1.05 GBytes   904 Mbits/sec                  receiver
                CPU Utilization: local/receiver 53.9% (6.7%u/47.1%s), remote/sender 12.8% (3.3%u/9.5%s)
                
                iperf Done.
                
                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ Offline
                  johnpoz LAYER 8 Global Moderator @Orkopaede
                  last edited by

                  @orkopaede your scaling is set to disabled still..

                  "Receive-Side Scaling State : disabled"

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 25.07 | Lab VMs 2.8, 25.07

                  O 1 Reply Last reply Reply Quote 0
                  • O Offline
                    Orkopaede @johnpoz
                    last edited by

                    @johnpoz i see... I changed it also ecn to enabled but still

                    TCP Global Parameters
                    ----------------------------------------------
                    Receive-Side Scaling State          : enabled
                    Receive Window Auto-Tuning Level    : normal
                    Add-On Congestion Control Provider  : default
                    ECN Capability                      : enabled
                    RFC 1323 Timestamps                 : disabled
                    Initial RTO                         : 1000
                    Receive Segment Coalescing State    : enabled
                    Non Sack Rtt Resiliency             : disabled
                    Max SYN Retransmissions             : 4
                    Fast Open                           : enabled
                    Fast Open Fallback                  : enabled
                    HyStart                             : enabled
                    Proportional Rate Reduction         : enabled
                    Pacing Profile                      : off
                    
                    C:\Users\Werner>Z:\Exchange\Firla\Software\iperf\iperf3.exe -c iperf.par2.as49434.net -p 9232 -V
                    iperf 3.1.3
                    CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                    Time: Wed, 22 Feb 2023 13:47:48 GMT
                    Connecting to host iperf.par2.as49434.net, port 9232
                          Cookie: WernerLaptop.1677073668.275288.50841
                          TCP MSS: 0 (default)
                    [  4] local 192.168.8.34 port 2500 connected to 193.177.162.41 port 9232
                    Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                    [ ID] Interval           Transfer     Bandwidth
                    [  4]   0.00-1.00   sec  7.00 MBytes  58.5 Mbits/sec
                    [  4]   1.00-2.01   sec  7.75 MBytes  64.8 Mbits/sec
                    [  4]   2.01-3.01   sec  7.75 MBytes  64.7 Mbits/sec
                    [  4]   3.01-4.02   sec  8.00 MBytes  66.9 Mbits/sec
                    [  4]   4.02-5.00   sec  7.50 MBytes  63.8 Mbits/sec
                    [  4]   5.00-6.00   sec  7.88 MBytes  66.0 Mbits/sec
                    [  4]   6.00-7.01   sec  7.88 MBytes  65.6 Mbits/sec
                    [  4]   7.01-8.00   sec  7.88 MBytes  66.5 Mbits/sec
                    [  4]   8.00-9.00   sec  7.88 MBytes  66.1 Mbits/sec
                    [  4]   9.00-10.01  sec  7.75 MBytes  64.8 Mbits/sec
                    - - - - - - - - - - - - - - - - - - - - - - - - -
                    Test Complete. Summary Results:
                    [ ID] Interval           Transfer     Bandwidth
                    [  4]   0.00-10.01  sec  77.2 MBytes  64.8 Mbits/sec                  sender
                    [  4]   0.00-10.01  sec  77.2 MBytes  64.8 Mbits/sec                  receiver
                    CPU Utilization: local/sender 1.5% (0.3%u/1.2%s), remote/receiver 4.8% (0.3%u/4.4%s)
                    
                    iperf Done.
                    

                    To be honest, I'm still trying to understand how that NAT ... Thing.. works. what you wrote before... :(

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ Offline
                      johnpoz LAYER 8 Global Moderator @Orkopaede
                      last edited by johnpoz

                      @orkopaede it is just an outbound nat.

                      In my example when pfsense sees traffic to 2.42 from 9.100 it changes the IP from being source of 9.100 to pfsense IP on that interface, in my case 2.253.. Just like what happens when your lan clients goes to something on the internet and pfsense changes the IP to pfsense wan IP (normally some public IP).

                      notice the states when I do that..

                      states.jpg

                      Now when not natting - which pfsense wouldn't do between local networks. See the states

                      nonnatted.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 25.07 | Lab VMs 2.8, 25.07

                      O 1 Reply Last reply Reply Quote 0
                      • O Offline
                        Orkopaede @johnpoz
                        last edited by

                        @johnpoz okay i think i got it:

                        9b68369b-2133-4368-904e-ce53234e883a-grafik.png

                        180c9b1c-0725-4732-bb8d-790560c0554d-grafik.png

                        Speeds are i would say okay the 8.227 is here probably the bottle neck:

                        iperf3.exe -c 192.168.8.227 -V
                        iperf 3.1.3
                        CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                        Time: Wed, 22 Feb 2023 14:25:03 GMT
                        Connecting to host 192.168.8.227, port 5201
                              Cookie: WernerLaptop.1677075903.687139.6ae82
                              TCP MSS: 0 (default)
                        [  4] local 172.28.0.1 port 1188 connected to 192.168.8.227 port 5201
                        Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                        [ ID] Interval           Transfer     Bandwidth
                        [  4]   0.00-1.00   sec  94.8 MBytes   794 Mbits/sec
                        [  4]   1.00-2.00   sec  96.9 MBytes   813 Mbits/sec
                        [  4]   2.00-3.00   sec  85.1 MBytes   714 Mbits/sec
                        [  4]   3.00-4.00   sec  89.8 MBytes   753 Mbits/sec
                        [  4]   4.00-5.00   sec  89.5 MBytes   751 Mbits/sec
                        [  4]   5.00-6.00   sec  93.5 MBytes   784 Mbits/sec
                        [  4]   6.00-7.00   sec  68.8 MBytes   576 Mbits/sec
                        [  4]   7.00-8.00   sec  72.8 MBytes   609 Mbits/sec
                        [  4]   8.00-9.00   sec  82.5 MBytes   695 Mbits/sec
                        [  4]   9.00-10.00  sec  95.4 MBytes   800 Mbits/sec
                        - - - - - - - - - - - - - - - - - - - - - - - - -
                        Test Complete. Summary Results:
                        [ ID] Interval           Transfer     Bandwidth
                        [  4]   0.00-10.00  sec   869 MBytes   729 Mbits/sec                  sender
                        [  4]   0.00-10.00  sec   869 MBytes   729 Mbits/sec                  receiver
                        CPU Utilization: local/sender 12.0% (2.0%u/10.0%s), remote/receiver 19.8% (5.2%u/14.6%s)
                        
                        iperf Done.
                        

                        any way it should be enough for the 200Mbit Internet connection

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ Offline
                          johnpoz LAYER 8 Global Moderator @Orkopaede
                          last edited by johnpoz

                          @orkopaede I don't see any nat happening in your states.. Notice in my states where it shows 192.168.9.100 changed to the wlan interface IP of 192.168.2.253

                          If you had an existing state between those 2 IPs, then the nat wouldn't happen. You need to clear any old states between those IPs and that 5201 port so that the new connection would use the nat.

                          But hard to believe that "nat" alone would be that much of a hit..

                          edit: just for grins.. Could you disable the Kernel PTI.. That for sure could be a hit on performance.. There is almost zero sort of use case where that would be needed on a firewall.. I find it unlikely it could be such a hit to only see 16mbps vs your 200.. But have a hard time coming up with a use case where you would want/need to enable that on a firewall. And it would be a hit, the level of which is hard to say.. But why have anything enabled that would hinder the performance of your box? Unless you have a very good reason to, and have to take the performance hit.

                          https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#kernel-page-table-isolation-pti

                          While more secure, this protection can incur a performance penalty. If untrusted users do not have access to run arbitrary code on the firewall, it can be disabled without significant security risk.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 25.07 | Lab VMs 2.8, 25.07

                          O 1 Reply Last reply Reply Quote 0
                          • O Offline
                            Orkopaede @johnpoz
                            last edited by

                            @johnpoz I will give that a try.

                            For the NAT problem. I guess the nat didn't work because everything was or is allowed in the firewall rules for this interface. How would the rules have to be set here so that the NAT can still work? Allow everything except LAN interface where the 8.227 is connected?

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ Offline
                              johnpoz LAYER 8 Global Moderator @Orkopaede
                              last edited by

                              @orkopaede nothing should have to change in the firewall rules, if the traffic was allowed before. But if you had an existing state, you would need to clear out those old states that were not doing nat.. Or just wait til they go away on their own on timeouts.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 25.07 | Lab VMs 2.8, 25.07

                              O 2 Replies Last reply Reply Quote 0
                              • O Offline
                                Orkopaede @johnpoz
                                last edited by

                                @johnpoz Okay then I'll just reset the stats or wait. I have to go and pick up my child from kindergarten anyway so.
                                First of all, thank you for your time and help. I'll test further tomorrow. Thank you!

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • O Offline
                                  Orkopaede @johnpoz
                                  last edited by Orkopaede

                                  @johnpoz Finally with the last test

                                  6473ec23-6255-4aa3-b73b-cce4576479ae-grafik.png

                                  Speeds:

                                  iperf3.exe -c 192.168.8.227 -V
                                  iperf 3.1.3
                                  CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                                  Time: Wed, 22 Feb 2023 15:07:53 GMT
                                  Connecting to host 192.168.8.227, port 5201
                                        Cookie: WernerLaptop.1677078473.811245.0a2fc
                                        TCP MSS: 0 (default)
                                  [  4] local 172.28.0.1 port 5984 connected to 192.168.8.227 port 5201
                                  Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                                  [ ID] Interval           Transfer     Bandwidth
                                  [  4]   0.00-1.00   sec  77.4 MBytes   648 Mbits/sec
                                  [  4]   1.00-2.00   sec  81.8 MBytes   686 Mbits/sec
                                  [  4]   2.00-3.00   sec  87.6 MBytes   735 Mbits/sec
                                  [  4]   3.00-4.00   sec  65.5 MBytes   550 Mbits/sec
                                  [  4]   4.00-5.00   sec  96.8 MBytes   812 Mbits/sec
                                  [  4]   5.00-6.00   sec  90.2 MBytes   757 Mbits/sec
                                  [  4]   6.00-7.00   sec  91.9 MBytes   771 Mbits/sec
                                  [  4]   7.00-8.00   sec  75.6 MBytes   635 Mbits/sec
                                  [  4]   8.00-9.00   sec  78.8 MBytes   660 Mbits/sec
                                  [  4]   9.00-10.00  sec  88.4 MBytes   742 Mbits/sec
                                  - - - - - - - - - - - - - - - - - - - - - - - - -
                                  Test Complete. Summary Results:
                                  [ ID] Interval           Transfer     Bandwidth
                                  [  4]   0.00-10.00  sec   834 MBytes   699 Mbits/sec                  sender
                                  [  4]   0.00-10.00  sec   834 MBytes   699 Mbits/sec                  receiver
                                  CPU Utilization: local/sender 11.0% (1.4%u/9.6%s), remote/receiver 2.5% (0.6%u/1.9%s)
                                  

                                  Okay now i have to go.

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ Offline
                                    johnpoz LAYER 8 Global Moderator @Orkopaede
                                    last edited by johnpoz

                                    @orkopaede you can always just kill any state in the state table directly. Under diagnostics, state table.

                                    edit:
                                    That seems low for whatever reason.. Notice in mine it was a very small hit to the speed, compared to just lan to lan speed.. And your on an I5.. I would think that is more powerful than my sg4860..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 25.07 | Lab VMs 2.8, 25.07

                                    O 1 Reply Last reply Reply Quote 1
                                    • O Offline
                                      Orkopaede @johnpoz
                                      last edited by

                                      @johnpoz i selected the wrong interface...

                                      bae59868-48e8-403e-9ca1-1d1bdc2aa6d4-grafik.png

                                      LAN not TESTINTERNET

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ Offline
                                        johnpoz LAYER 8 Global Moderator @Orkopaede
                                        last edited by

                                        @orkopaede yeah you need to put the nat on the correct interface for the direction of your traffic flow ;)

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 25.07 | Lab VMs 2.8, 25.07

                                        O 1 Reply Last reply Reply Quote 0
                                        • O Offline
                                          Orkopaede @johnpoz
                                          last edited by

                                          @johnpoz ok i tested it a bit further and i think it is a windows problem. I repeated the tests on a Linux PC and I always got my 200Mbit without establishing multiple connections (iperf option -P). I don't think I have to bother anyone here with this topic. ;) Thank you once again for the help.

                                          johnpozJ 1 Reply Last reply Reply Quote 1
                                          • johnpozJ Offline
                                            johnpoz LAYER 8 Global Moderator @Orkopaede
                                            last edited by johnpoz

                                            @orkopaede said in Throughput from Lan to Wan:

                                            i tested it a bit further and i think it is a windows problem

                                            did you actually enable window scaling - all the posts you show it disabled.

                                            edit: never mind looks like you did enable it.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 25.07 | Lab VMs 2.8, 25.07

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.