Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Throughput from Lan to Wan

    Scheduled Pinned Locked Moved General pfSense Questions
    26 Posts 4 Posters 6.5k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O Offline
      Orkopaede
      last edited by

      okay it doesn't seem to be a problem with PF after all.? As a test, I set up several connections at the same time with iperf and the option -P and then I get my 200Mbit. So maybe it's a Windows problem? I do not get it. Any idea, suggestions?

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ Offline
        johnpoz LAYER 8 Global Moderator @Orkopaede
        last edited by johnpoz

        @orkopaede have had lack luster success with iperf to the internet. If you put a device on your pfsense wan network and do an iperf what do you get through pfsense.

        What does a normal just web based speedtest show. If you have a hard time putting something on your pfsense wan network to test with. Just create a outbound nat on pfsense to one of your other local networks. So pfsense is both firewalling and natting - this is what it does to your internet connection.

        So doing a iperf to my nas with outbound nat so pfsense is doing exactly what it does to the internet.. I see

        $ iperf3.exe -c 192.168.2.42
        Connecting to host 192.168.2.42, port 5201
        [  5] local 192.168.9.100 port 49470 connected to 192.168.2.42 port 5201
        [ ID] Interval           Transfer     Bitrate
        [  5]   0.00-1.00   sec   115 MBytes   961 Mbits/sec
        [  5]   1.00-2.00   sec   112 MBytes   937 Mbits/sec
        [  5]   2.00-3.00   sec   113 MBytes   946 Mbits/sec
        [  5]   3.00-4.00   sec   112 MBytes   943 Mbits/sec
        [  5]   4.00-5.00   sec   112 MBytes   936 Mbits/sec
        [  5]   5.00-6.00   sec   112 MBytes   944 Mbits/sec
        [  5]   6.00-7.00   sec   112 MBytes   936 Mbits/sec
        [  5]   7.00-8.00   sec   112 MBytes   939 Mbits/sec
        [  5]   8.00-9.00   sec   113 MBytes   945 Mbits/sec
        [  5]   9.00-10.00  sec   112 MBytes   940 Mbits/sec
        - - - - - - - - - - - - - - - - - - - - - - - - -
        [ ID] Interval           Transfer     Bitrate
        [  5]   0.00-10.00  sec  1.10 GBytes   943 Mbits/sec                  sender
        [  5]   0.00-10.00  sec  1.10 GBytes   941 Mbits/sec                  receiver
        

        This is for sure close enough to wire speed.. If I take pfsense out of the picture and go directly to the nas over the lan network..

        $ iperf3.exe -c 192.168.9.10
        Connecting to host 192.168.9.10, port 5201
        [  5] local 192.168.9.100 port 49465 connected to 192.168.9.10 port 5201
        [ ID] Interval           Transfer     Bitrate
        [  5]   0.00-1.00   sec   114 MBytes   952 Mbits/sec
        [  5]   1.00-2.00   sec   114 MBytes   962 Mbits/sec
        [  5]   2.00-3.00   sec   113 MBytes   949 Mbits/sec
        [  5]   3.00-4.00   sec   113 MBytes   949 Mbits/sec
        [  5]   4.00-5.00   sec   113 MBytes   949 Mbits/sec
        [  5]   5.00-6.00   sec   113 MBytes   950 Mbits/sec
        [  5]   6.00-7.00   sec   113 MBytes   949 Mbits/sec
        [  5]   7.00-8.00   sec   113 MBytes   949 Mbits/sec
        [  5]   8.00-9.00   sec   113 MBytes   950 Mbits/sec
        [  5]   9.00-10.00  sec   113 MBytes   948 Mbits/sec
        - - - - - - - - - - - - - - - - - - - - - - - - -
        [ ID] Interval           Transfer     Bitrate
        [  5]   0.00-10.00  sec  1.11 GBytes   951 Mbits/sec                  sender
        [  5]   0.00-10.01  sec  1.11 GBytes   949 Mbits/sec                  receiver
        

        Here is the outbound nat I created

        outboundnat.jpg

        Can't really do a test to nas on different network that my pc without doing this without disruption of my network setup. Since the nas has an IP in lan, I run into asymmetrical traffic flow problem - because the nas likes to answer the connection to its 2.42 address via its 9.10 address. This setup makes sure all traffic flows through pfsense, and pfsense nats it, just like it would do to the internet.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 25.07 | Lab VMs 2.8, 25.07

        O 1 Reply Last reply Reply Quote 0
        • O Offline
          Orkopaede @johnpoz
          last edited by

          @johnpoz Hi, unfortunately I can't put a device in front of the PF because of the fiber optic router. The router only accepts one MAC to communicate with. If that was your idea? As I said, I get 200Mbit from the PF with Iperf. A web-based speed test gives the same result (16Mbit). My last test with the multiple connections made me think that it might be a Windows or anti-virus software problem. While looking for a windows speed cap I came across this:

          Windows 10 internet speed capped

          With that I get 65Mbit. Which is better. But theoretically it's not the end yet.

          I'll test that with the OUTBOUND NAT.
          Results will follow immediately.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ Offline
            johnpoz LAYER 8 Global Moderator @Orkopaede
            last edited by johnpoz

            @orkopaede recv window - yup that could have effect for sure..

            What were your settings? And what did you change them too.. Here are mine

            $ netsh interface tcp show global                 
            Querying active state...                          
                                                              
            TCP Global Parameters                             
            ----------------------------------------------    
            Receive-Side Scaling State          : enabled     
            Receive Window Auto-Tuning Level    : normal      
            Add-On Congestion Control Provider  : default     
            ECN Capability                      : enabled     
            RFC 1323 Timestamps                 : disabled    
            Initial RTO                         : 1000        
            Receive Segment Coalescing State    : enabled     
            Non Sack Rtt Resiliency             : disabled    
            Max SYN Retransmissions             : 4           
            Fast Open                           : enabled     
            Fast Open Fallback                  : enabled     
            HyStart                             : enabled     
            Proportional Rate Reduction         : enabled     
            Pacing Profile                      : off         
                                                              
            

            BTW - when your testing from client to server in iperf.. Make sure you test just over the local network, where they are on the same - so you can validate you do see wirespeed between the clients. You might also what to check in reverse flow, normally the client is the sender..

            You can test with -V and see some more details of the test

            $ iperf3.exe -c 192.168.9.10 -V                                                                          
            iperf 3.13                                                                                               
            CYGWIN_NT-10.0-19045 i9-win 3.4.6-1.x86_64 2023-02-14 13:23 UTC x86_64                                   
            Control connection MSS 1460                                                                              
            Time: Wed, 22 Feb 2023 13:28:22 GMT                                                                      
            Connecting to host 192.168.9.10, port 5201                                                               
                  Cookie: grthd7rff3wrvul2smkaytwr6lrnyegxxmp6                                                       
                  TCP MSS: 1460 (default)                                                                            
            [  5] local 192.168.9.100 port 49589 connected to 192.168.9.10 port 5201                                 
            Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test, tos 0   
            [ ID] Interval           Transfer     Bitrate                                                            
            [  5]   0.00-1.00   sec   115 MBytes   965 Mbits/sec                                                     
            [  5]   1.00-2.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   2.00-3.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   3.00-4.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   4.00-5.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   5.00-6.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   6.00-7.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   7.00-8.00   sec   113 MBytes   948 Mbits/sec                                                     
            [  5]   8.00-9.00   sec   113 MBytes   949 Mbits/sec                                                     
            [  5]   9.00-10.00  sec   113 MBytes   950 Mbits/sec                                                     
            - - - - - - - - - - - - - - - - - - - - - - - - -                                                        
            Test Complete. Summary Results:                                                                          
            [ ID] Interval           Transfer     Bitrate                                                            
            [  5]   0.00-10.00  sec  1.11 GBytes   951 Mbits/sec                  sender                             
            [  5]   0.00-10.01  sec  1.11 GBytes   949 Mbits/sec                  receiver                           
            CPU Utilization: local/sender 8.7% (5.0%u/3.7%s), remote/receiver 13.6% (1.0%u/12.6%s)                   
            rcv_tcp_congestion cubic                                                                                 
                                                                                                                     
            iperf Done.                                                                                              
            
            $ iperf3.exe -c 192.168.9.10 -V -R
            iperf 3.13
            CYGWIN_NT-10.0-19045 i9-win 3.4.6-1.x86_64 2023-02-14 13:23 UTC x86_64
            Control connection MSS 1460
            Time: Wed, 22 Feb 2023 13:29:20 GMT
            Connecting to host 192.168.9.10, port 5201
            Reverse mode, remote host 192.168.9.10 is sending
                  Cookie: cvgi4td7ruemmazafk53j3da7qqzy35unrkm
                  TCP MSS: 1460 (default)
            [  5] local 192.168.9.100 port 49593 connected to 192.168.9.10 port 5201
            Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test, tos 0
            [ ID] Interval           Transfer     Bitrate
            [  5]   0.00-1.00   sec   113 MBytes   948 Mbits/sec
            [  5]   1.00-2.00   sec   113 MBytes   949 Mbits/sec
            [  5]   2.00-3.00   sec   113 MBytes   947 Mbits/sec
            [  5]   3.00-4.00   sec   113 MBytes   949 Mbits/sec
            [  5]   4.00-5.00   sec   113 MBytes   949 Mbits/sec
            [  5]   5.00-6.00   sec   113 MBytes   948 Mbits/sec
            [  5]   6.00-7.00   sec   113 MBytes   949 Mbits/sec
            [  5]   7.00-8.00   sec   113 MBytes   949 Mbits/sec
            [  5]   8.00-9.00   sec   113 MBytes   949 Mbits/sec
            [  5]   9.00-10.00  sec   113 MBytes   949 Mbits/sec
            - - - - - - - - - - - - - - - - - - - - - - - - -
            Test Complete. Summary Results:
            [ ID] Interval           Transfer     Bitrate         Retr
            [  5]   0.00-10.00  sec  1.11 GBytes   951 Mbits/sec    0             sender
            [  5]   0.00-10.00  sec  1.10 GBytes   949 Mbits/sec                  receiver
            snd_tcp_congestion cubic
            
            iperf Done.
            

            Notice when use the -R it clearly states that 9.10 is the sender.

            edit: Look how crappy it gets if I turn the window size down to 8k, which could be default..

            $ iperf3.exe -c 192.168.9.10 -V -w 8k
            iperf 3.13
            CYGWIN_NT-10.0-19045 i9-win 3.4.6-1.x86_64 2023-02-14 13:23 UTC x86_64
            Control connection MSS 1460
            Time: Wed, 22 Feb 2023 13:32:57 GMT
            Connecting to host 192.168.9.10, port 5201
                  Cookie: vrzgka56k7hvizu4wdagwtpww4tlc6b6yych
                  TCP MSS: 1460 (default)
            [  5] local 192.168.9.100 port 49603 connected to 192.168.9.10 port 5201
            Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test, tos 0
            [ ID] Interval           Transfer     Bitrate
            [  5]   0.00-1.00   sec  29.5 MBytes   247 Mbits/sec
            [  5]   1.00-2.00   sec  29.4 MBytes   247 Mbits/sec
            [  5]   2.00-3.00   sec  27.6 MBytes   232 Mbits/sec
            [  5]   3.00-4.01   sec  30.6 MBytes   253 Mbits/sec
            [  5]   4.01-5.00   sec  31.7 MBytes   269 Mbits/sec
            [  5]   5.00-6.00   sec  28.6 MBytes   240 Mbits/sec
            [  5]   6.00-7.00   sec  29.1 MBytes   244 Mbits/sec
            [  5]   7.00-8.00   sec  32.2 MBytes   270 Mbits/sec
            [  5]   8.00-9.00   sec  27.6 MBytes   232 Mbits/sec
            [  5]   9.00-10.00  sec  28.6 MBytes   240 Mbits/sec
            - - - - - - - - - - - - - - - - - - - - - - - - -
            Test Complete. Summary Results:
            [ ID] Interval           Transfer     Bitrate
            [  5]   0.00-10.00  sec   295 MBytes   247 Mbits/sec                  sender
            [  5]   0.00-10.00  sec   295 MBytes   247 Mbits/sec                  receiver
            CPU Utilization: local/sender 24.6% (12.1%u/12.6%s), remote/receiver 22.4% (2.3%u/20.1%s)
            rcv_tcp_congestion cubic
            
            iperf Done.
            

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 25.07 | Lab VMs 2.8, 25.07

            O 1 Reply Last reply Reply Quote 0
            • O Offline
              Orkopaede @johnpoz
              last edited by

              @johnpoz Before:

              TCP Global Parameters
              ----------------------------------------------
              Receive-Side Scaling State          : disabled
              Receive Window Auto-Tuning Level    : disabled
              Add-On Congestion Control Provider  : default
              ECN Capability                      : disabled
              RFC 1323 Timestamps                 : disabled
              Initial RTO                         : 1000
              Receive Segment Coalescing State    : enabled
              Non Sack Rtt Resiliency             : disabled
              Max SYN Retransmissions             : 4
              Fast Open                           : enabled
              Fast Open Fallback                  : enabled
              HyStart                             : enabled
              Proportional Rate Reduction         : enabled
              Pacing Profile                      : off
              

              After with: netsh int tcp set global autotuninglevel=normal

              TCP Global Parameters
              ----------------------------------------------
              Receive-Side Scaling State          : disabled
              Receive Window Auto-Tuning Level    : normal
              Add-On Congestion Control Provider  : default
              ECN Capability                      : disabled
              RFC 1323 Timestamps                 : disabled
              Initial RTO                         : 1000
              Receive Segment Coalescing State    : enabled
              Non Sack Rtt Resiliency             : disabled
              Max SYN Retransmissions             : 4
              Fast Open                           : enabled
              Fast Open Fallback                  : enabled
              HyStart                             : enabled
              Proportional Rate Reduction         : enabled
              Pacing Profile                      : off
              
              iperf3.exe -c 192.168.8.248 -V
              
              iperf 3.1.3
              CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
              Time: Wed, 22 Feb 2023 13:38:39 GMT
              Connecting to host 192.168.8.248, port 5201
                    Cookie: WernerLaptop.1677073117.500543.72f2e
                    TCP MSS: 0 (default)
              [  4] local 192.168.8.34 port 2341 connected to 192.168.8.248 port 5201
              Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
              [ ID] Interval           Transfer     Bandwidth
              [  4]   0.00-1.00   sec   112 MBytes   936 Mbits/sec
              [  4]   1.00-2.00   sec   113 MBytes   945 Mbits/sec
              [  4]   2.00-3.00   sec   113 MBytes   949 Mbits/sec
              [  4]   3.00-4.00   sec   112 MBytes   942 Mbits/sec
              [  4]   4.00-5.00   sec   113 MBytes   947 Mbits/sec
              [  4]   5.00-6.00   sec   113 MBytes   949 Mbits/sec
              [  4]   6.00-7.00   sec   113 MBytes   949 Mbits/sec
              [  4]   7.00-8.00   sec   112 MBytes   943 Mbits/sec
              [  4]   8.00-9.00   sec   112 MBytes   941 Mbits/sec
              [  4]   9.00-10.00  sec   112 MBytes   943 Mbits/sec
              - - - - - - - - - - - - - - - - - - - - - - - - -
              Test Complete. Summary Results:
              [ ID] Interval           Transfer     Bandwidth
              [  4]   0.00-10.00  sec  1.10 GBytes   945 Mbits/sec                  sender
              [  4]   0.00-10.00  sec  1.10 GBytes   945 Mbits/sec                  receiver
              CPU Utilization: local/sender 19.2% (2.1%u/17.1%s), remote/receiver 37.3% (1.8%u/35.7%s)
              
              iperf Done.
              
              iperf3.exe -c 192.168.8.248 -V -R
              
              iperf 3.1.3
              CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
              Time: Wed, 22 Feb 2023 13:39:01 GMT
              Connecting to host 192.168.8.248, port 5201
              Reverse mode, remote host 192.168.8.248 is sending
                    Cookie: WernerLaptop.1677073141.672333.7cdce
                    TCP MSS: 0 (default)
              [  4] local 192.168.8.34 port 2351 connected to 192.168.8.248 port 5201
              Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
              [ ID] Interval           Transfer     Bandwidth
              [  4]   0.00-1.00   sec   112 MBytes   942 Mbits/sec
              [  4]   1.00-2.00   sec   107 MBytes   898 Mbits/sec
              [  4]   2.00-3.00   sec   112 MBytes   939 Mbits/sec
              [  4]   3.00-4.00   sec   113 MBytes   945 Mbits/sec
              [  4]   4.00-5.00   sec   110 MBytes   919 Mbits/sec
              [  4]   5.00-6.00   sec   102 MBytes   855 Mbits/sec
              [  4]   6.00-7.00   sec   109 MBytes   917 Mbits/sec
              [  4]   7.00-8.00   sec   110 MBytes   923 Mbits/sec
              [  4]   8.00-9.00   sec  95.4 MBytes   800 Mbits/sec
              [  4]   9.00-10.00  sec   107 MBytes   899 Mbits/sec
              - - - - - - - - - - - - - - - - - - - - - - - - -
              Test Complete. Summary Results:
              [ ID] Interval           Transfer     Bandwidth       Retr
              [  4]   0.00-10.00  sec  1.05 GBytes   904 Mbits/sec    0             sender
              [  4]   0.00-10.00  sec  1.05 GBytes   904 Mbits/sec                  receiver
              CPU Utilization: local/receiver 53.9% (6.7%u/47.1%s), remote/sender 12.8% (3.3%u/9.5%s)
              
              iperf Done.
              
              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator @Orkopaede
                last edited by

                @orkopaede your scaling is set to disabled still..

                "Receive-Side Scaling State : disabled"

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 25.07 | Lab VMs 2.8, 25.07

                O 1 Reply Last reply Reply Quote 0
                • O Offline
                  Orkopaede @johnpoz
                  last edited by

                  @johnpoz i see... I changed it also ecn to enabled but still

                  TCP Global Parameters
                  ----------------------------------------------
                  Receive-Side Scaling State          : enabled
                  Receive Window Auto-Tuning Level    : normal
                  Add-On Congestion Control Provider  : default
                  ECN Capability                      : enabled
                  RFC 1323 Timestamps                 : disabled
                  Initial RTO                         : 1000
                  Receive Segment Coalescing State    : enabled
                  Non Sack Rtt Resiliency             : disabled
                  Max SYN Retransmissions             : 4
                  Fast Open                           : enabled
                  Fast Open Fallback                  : enabled
                  HyStart                             : enabled
                  Proportional Rate Reduction         : enabled
                  Pacing Profile                      : off
                  
                  C:\Users\Werner>Z:\Exchange\Firla\Software\iperf\iperf3.exe -c iperf.par2.as49434.net -p 9232 -V
                  iperf 3.1.3
                  CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                  Time: Wed, 22 Feb 2023 13:47:48 GMT
                  Connecting to host iperf.par2.as49434.net, port 9232
                        Cookie: WernerLaptop.1677073668.275288.50841
                        TCP MSS: 0 (default)
                  [  4] local 192.168.8.34 port 2500 connected to 193.177.162.41 port 9232
                  Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                  [ ID] Interval           Transfer     Bandwidth
                  [  4]   0.00-1.00   sec  7.00 MBytes  58.5 Mbits/sec
                  [  4]   1.00-2.01   sec  7.75 MBytes  64.8 Mbits/sec
                  [  4]   2.01-3.01   sec  7.75 MBytes  64.7 Mbits/sec
                  [  4]   3.01-4.02   sec  8.00 MBytes  66.9 Mbits/sec
                  [  4]   4.02-5.00   sec  7.50 MBytes  63.8 Mbits/sec
                  [  4]   5.00-6.00   sec  7.88 MBytes  66.0 Mbits/sec
                  [  4]   6.00-7.01   sec  7.88 MBytes  65.6 Mbits/sec
                  [  4]   7.01-8.00   sec  7.88 MBytes  66.5 Mbits/sec
                  [  4]   8.00-9.00   sec  7.88 MBytes  66.1 Mbits/sec
                  [  4]   9.00-10.01  sec  7.75 MBytes  64.8 Mbits/sec
                  - - - - - - - - - - - - - - - - - - - - - - - - -
                  Test Complete. Summary Results:
                  [ ID] Interval           Transfer     Bandwidth
                  [  4]   0.00-10.01  sec  77.2 MBytes  64.8 Mbits/sec                  sender
                  [  4]   0.00-10.01  sec  77.2 MBytes  64.8 Mbits/sec                  receiver
                  CPU Utilization: local/sender 1.5% (0.3%u/1.2%s), remote/receiver 4.8% (0.3%u/4.4%s)
                  
                  iperf Done.
                  

                  To be honest, I'm still trying to understand how that NAT ... Thing.. works. what you wrote before... :(

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ Offline
                    johnpoz LAYER 8 Global Moderator @Orkopaede
                    last edited by johnpoz

                    @orkopaede it is just an outbound nat.

                    In my example when pfsense sees traffic to 2.42 from 9.100 it changes the IP from being source of 9.100 to pfsense IP on that interface, in my case 2.253.. Just like what happens when your lan clients goes to something on the internet and pfsense changes the IP to pfsense wan IP (normally some public IP).

                    notice the states when I do that..

                    states.jpg

                    Now when not natting - which pfsense wouldn't do between local networks. See the states

                    nonnatted.jpg

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 25.07 | Lab VMs 2.8, 25.07

                    O 1 Reply Last reply Reply Quote 0
                    • O Offline
                      Orkopaede @johnpoz
                      last edited by

                      @johnpoz okay i think i got it:

                      9b68369b-2133-4368-904e-ce53234e883a-grafik.png

                      180c9b1c-0725-4732-bb8d-790560c0554d-grafik.png

                      Speeds are i would say okay the 8.227 is here probably the bottle neck:

                      iperf3.exe -c 192.168.8.227 -V
                      iperf 3.1.3
                      CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                      Time: Wed, 22 Feb 2023 14:25:03 GMT
                      Connecting to host 192.168.8.227, port 5201
                            Cookie: WernerLaptop.1677075903.687139.6ae82
                            TCP MSS: 0 (default)
                      [  4] local 172.28.0.1 port 1188 connected to 192.168.8.227 port 5201
                      Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                      [ ID] Interval           Transfer     Bandwidth
                      [  4]   0.00-1.00   sec  94.8 MBytes   794 Mbits/sec
                      [  4]   1.00-2.00   sec  96.9 MBytes   813 Mbits/sec
                      [  4]   2.00-3.00   sec  85.1 MBytes   714 Mbits/sec
                      [  4]   3.00-4.00   sec  89.8 MBytes   753 Mbits/sec
                      [  4]   4.00-5.00   sec  89.5 MBytes   751 Mbits/sec
                      [  4]   5.00-6.00   sec  93.5 MBytes   784 Mbits/sec
                      [  4]   6.00-7.00   sec  68.8 MBytes   576 Mbits/sec
                      [  4]   7.00-8.00   sec  72.8 MBytes   609 Mbits/sec
                      [  4]   8.00-9.00   sec  82.5 MBytes   695 Mbits/sec
                      [  4]   9.00-10.00  sec  95.4 MBytes   800 Mbits/sec
                      - - - - - - - - - - - - - - - - - - - - - - - - -
                      Test Complete. Summary Results:
                      [ ID] Interval           Transfer     Bandwidth
                      [  4]   0.00-10.00  sec   869 MBytes   729 Mbits/sec                  sender
                      [  4]   0.00-10.00  sec   869 MBytes   729 Mbits/sec                  receiver
                      CPU Utilization: local/sender 12.0% (2.0%u/10.0%s), remote/receiver 19.8% (5.2%u/14.6%s)
                      
                      iperf Done.
                      

                      any way it should be enough for the 200Mbit Internet connection

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator @Orkopaede
                        last edited by johnpoz

                        @orkopaede I don't see any nat happening in your states.. Notice in my states where it shows 192.168.9.100 changed to the wlan interface IP of 192.168.2.253

                        If you had an existing state between those 2 IPs, then the nat wouldn't happen. You need to clear any old states between those IPs and that 5201 port so that the new connection would use the nat.

                        But hard to believe that "nat" alone would be that much of a hit..

                        edit: just for grins.. Could you disable the Kernel PTI.. That for sure could be a hit on performance.. There is almost zero sort of use case where that would be needed on a firewall.. I find it unlikely it could be such a hit to only see 16mbps vs your 200.. But have a hard time coming up with a use case where you would want/need to enable that on a firewall. And it would be a hit, the level of which is hard to say.. But why have anything enabled that would hinder the performance of your box? Unless you have a very good reason to, and have to take the performance hit.

                        https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#kernel-page-table-isolation-pti

                        While more secure, this protection can incur a performance penalty. If untrusted users do not have access to run arbitrary code on the firewall, it can be disabled without significant security risk.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07 | Lab VMs 2.8, 25.07

                        O 1 Reply Last reply Reply Quote 0
                        • O Offline
                          Orkopaede @johnpoz
                          last edited by

                          @johnpoz I will give that a try.

                          For the NAT problem. I guess the nat didn't work because everything was or is allowed in the firewall rules for this interface. How would the rules have to be set here so that the NAT can still work? Allow everything except LAN interface where the 8.227 is connected?

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ Offline
                            johnpoz LAYER 8 Global Moderator @Orkopaede
                            last edited by

                            @orkopaede nothing should have to change in the firewall rules, if the traffic was allowed before. But if you had an existing state, you would need to clear out those old states that were not doing nat.. Or just wait til they go away on their own on timeouts.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 25.07 | Lab VMs 2.8, 25.07

                            O 2 Replies Last reply Reply Quote 0
                            • O Offline
                              Orkopaede @johnpoz
                              last edited by

                              @johnpoz Okay then I'll just reset the stats or wait. I have to go and pick up my child from kindergarten anyway so.
                              First of all, thank you for your time and help. I'll test further tomorrow. Thank you!

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • O Offline
                                Orkopaede @johnpoz
                                last edited by Orkopaede

                                @johnpoz Finally with the last test

                                6473ec23-6255-4aa3-b73b-cce4576479ae-grafik.png

                                Speeds:

                                iperf3.exe -c 192.168.8.227 -V
                                iperf 3.1.3
                                CYGWIN_NT-10.0 WernerLaptop 2.5.1(0.297/5/3) 2016-04-21 22:14 x86_64
                                Time: Wed, 22 Feb 2023 15:07:53 GMT
                                Connecting to host 192.168.8.227, port 5201
                                      Cookie: WernerLaptop.1677078473.811245.0a2fc
                                      TCP MSS: 0 (default)
                                [  4] local 172.28.0.1 port 5984 connected to 192.168.8.227 port 5201
                                Starting Test: protocol: TCP, 1 streams, 131072 byte blocks, omitting 0 seconds, 10 second test
                                [ ID] Interval           Transfer     Bandwidth
                                [  4]   0.00-1.00   sec  77.4 MBytes   648 Mbits/sec
                                [  4]   1.00-2.00   sec  81.8 MBytes   686 Mbits/sec
                                [  4]   2.00-3.00   sec  87.6 MBytes   735 Mbits/sec
                                [  4]   3.00-4.00   sec  65.5 MBytes   550 Mbits/sec
                                [  4]   4.00-5.00   sec  96.8 MBytes   812 Mbits/sec
                                [  4]   5.00-6.00   sec  90.2 MBytes   757 Mbits/sec
                                [  4]   6.00-7.00   sec  91.9 MBytes   771 Mbits/sec
                                [  4]   7.00-8.00   sec  75.6 MBytes   635 Mbits/sec
                                [  4]   8.00-9.00   sec  78.8 MBytes   660 Mbits/sec
                                [  4]   9.00-10.00  sec  88.4 MBytes   742 Mbits/sec
                                - - - - - - - - - - - - - - - - - - - - - - - - -
                                Test Complete. Summary Results:
                                [ ID] Interval           Transfer     Bandwidth
                                [  4]   0.00-10.00  sec   834 MBytes   699 Mbits/sec                  sender
                                [  4]   0.00-10.00  sec   834 MBytes   699 Mbits/sec                  receiver
                                CPU Utilization: local/sender 11.0% (1.4%u/9.6%s), remote/receiver 2.5% (0.6%u/1.9%s)
                                

                                Okay now i have to go.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ Offline
                                  johnpoz LAYER 8 Global Moderator @Orkopaede
                                  last edited by johnpoz

                                  @orkopaede you can always just kill any state in the state table directly. Under diagnostics, state table.

                                  edit:
                                  That seems low for whatever reason.. Notice in mine it was a very small hit to the speed, compared to just lan to lan speed.. And your on an I5.. I would think that is more powerful than my sg4860..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 25.07 | Lab VMs 2.8, 25.07

                                  O 1 Reply Last reply Reply Quote 1
                                  • O Offline
                                    Orkopaede @johnpoz
                                    last edited by

                                    @johnpoz i selected the wrong interface...

                                    bae59868-48e8-403e-9ca1-1d1bdc2aa6d4-grafik.png

                                    LAN not TESTINTERNET

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ Offline
                                      johnpoz LAYER 8 Global Moderator @Orkopaede
                                      last edited by

                                      @orkopaede yeah you need to put the nat on the correct interface for the direction of your traffic flow ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 25.07 | Lab VMs 2.8, 25.07

                                      O 1 Reply Last reply Reply Quote 0
                                      • O Offline
                                        Orkopaede @johnpoz
                                        last edited by

                                        @johnpoz ok i tested it a bit further and i think it is a windows problem. I repeated the tests on a Linux PC and I always got my 200Mbit without establishing multiple connections (iperf option -P). I don't think I have to bother anyone here with this topic. ;) Thank you once again for the help.

                                        johnpozJ 1 Reply Last reply Reply Quote 1
                                        • johnpozJ Offline
                                          johnpoz LAYER 8 Global Moderator @Orkopaede
                                          last edited by johnpoz

                                          @orkopaede said in Throughput from Lan to Wan:

                                          i tested it a bit further and i think it is a windows problem

                                          did you actually enable window scaling - all the posts you show it disabled.

                                          edit: never mind looks like you did enable it.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 25.07 | Lab VMs 2.8, 25.07

                                          1 Reply Last reply Reply Quote 0
                                          • S Offline
                                            SteveITS Rebel Alliance @Orkopaede
                                            last edited by

                                            @orkopaede I don’t see in the thread that you checked traffic shaping? I’ve seen many threads where an old setting was left enabled.

                                            Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                            When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                                            Upvote 👍 helpful posts!

                                            O 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.