• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

New install. Poor performance?

General pfSense Questions
4
25
1.1k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    jrutley
    last edited by Mar 11, 2025, 2:00 PM

    Hi, brand new user of pfsense here. I installed it, put it in front of our home network behind a bridged cable modem, and found out that the performance is abysmal.

    I suspect that it's the CPU, but maybe someone here has more insight.
    Running a speedtest, I get up to maybe 400Mbps before it ends up around 130Mbps.
    On my TP-Link router, the one I want to replace, I get between 700-940Mbps.

    With this new hardware, when going to fast.com or speedtest.net, the CPU usage made it as high as 36%.

    It's not just fast.com though. While one person was downloading stuff (100Mbps+), others couldn't play any online games.

    I have the gateway's monitor IP set to 1.1.1.1
    WAN_DHCP <my-ip> 51.1ms 18.6ms 13% Warning, Packetloss
    when running a test from fast.com, the status says offline

    Here's the hardware in question:

    https://www.aliexpress.com/item/1005007267007244.html
    8GB of RAM and 128GB SSD

    Intel(R) Celeron(R) N4000 CPU @ 1.10GHz
    Current: 1100 MHz, Max: 1101 MHz
    2 CPUs: 1 package(s) x 2 core(s)
    AES-NI CPU Crypto: Yes (inactive)
    QAT Crypto: No

    4*Intel 2.5G RJ45 Lans
    Intel(R) Ethernet Controller I226-V

    G S 2 Replies Last reply Mar 11, 2025, 2:55 PM Reply Quote 0
    • G
      Gblenn @jrutley
      last edited by Mar 11, 2025, 2:55 PM

      @jrutley said in New install. Poor performance?:

      Intel(R) Celeron(R) N4000 CPU @ 1.10GHz
      Current: 1100 MHz, Max: 1101 MHz
      2 CPUs: 1 package(s) x 2 core(s)
      AES-NI CPU Crypto: Yes (inactive)
      QAT Crypto: No

      4*Intel 2.5G RJ45 Lans
      Intel(R) Ethernet Controller I226-V

      No reason that setup should not be able to reach Gbit speeds, or more even... My previous install, able to handle 1Gbit speeds, was on a PC-Engines APU2 that has a single thread rating only 25% of what a Celeron N4000 has.

      What version of pfsense are you running and have you made any changes, additions outside the default?

      J 1 Reply Last reply Mar 11, 2025, 2:59 PM Reply Quote 0
      • J
        jrutley @Gblenn
        last edited by Mar 11, 2025, 2:59 PM

        @Gblenn

        2.7.0-RELEASE (amd64)
        built on Wed Jun 28 03:53:34 UTC 2023
        FreeBSD 14.0-CURRENT

        The system is on the latest version.
        Version information updated at Tue Mar 11 19:58:53 +05 2025

        J G 2 Replies Last reply Mar 11, 2025, 3:02 PM Reply Quote 0
        • J
          jrutley @jrutley
          last edited by Mar 11, 2025, 3:02 PM

          I haven't made any changes other than setting up the ports. I've got one dedicated to WAN, and the other dedicated to LAN.

          Is there a utility for dumping my config somewhere?

          1 Reply Last reply Reply Quote 0
          • G
            Gblenn @jrutley
            last edited by Mar 11, 2025, 3:03 PM

            @jrutley Ok, not the latest release then but it should still be able to give you much better performance than a few hundred Mbit/s. Latest release is 2.7.2 from 2024...

            Have you made any changes? Added any limiters/shapers? Added any packages?

            J 1 Reply Last reply Mar 11, 2025, 3:04 PM Reply Quote 0
            • J
              jrutley @Gblenn
              last edited by Mar 11, 2025, 3:04 PM

              @Gblenn I added one firewall rule to block a site, but I removed that and experienced the same issue

              J 1 Reply Last reply Mar 11, 2025, 3:08 PM Reply Quote 0
              • J
                jrutley @jrutley
                last edited by Mar 11, 2025, 3:08 PM

                login-to-view

                I'm not entirely sure how to update to 2.7.2, at least from this menu.

                G 1 Reply Last reply Mar 11, 2025, 3:10 PM Reply Quote 0
                • G
                  Gblenn @jrutley
                  last edited by Mar 11, 2025, 3:10 PM

                  @jrutley Check the next tab, Update Settings...

                  What modem do you have from the ISP, and do you see that you have a public IP on pfsense WAN?

                  J 1 Reply Last reply Mar 11, 2025, 3:13 PM Reply Quote 0
                  • S
                    stephenw10 Netgate Administrator
                    last edited by Mar 11, 2025, 3:13 PM

                    Run: certctl rehash then check again.

                    1 Reply Last reply Reply Quote 0
                    • J
                      jrutley @Gblenn
                      last edited by Mar 11, 2025, 3:13 PM

                      it's a Hitron CODA 4680, and yes the WAN interface shows that I have a public IP

                      1 Reply Last reply Reply Quote 0
                      • J
                        jrutley
                        last edited by Mar 11, 2025, 3:17 PM

                        The certctl rehash did the trick for that. Thank you.

                        I just noticed now that the gateway IP is different from the WAN interface
                        (unless that .225 is the CMTS, perhaps)

                        login-to-view

                        J 1 Reply Last reply Mar 11, 2025, 3:31 PM Reply Quote 0
                        • J
                          jrutley @jrutley
                          last edited by Mar 11, 2025, 3:31 PM

                          After upgrading to 2.7.2, I still experience the same issue

                          1 Reply Last reply Reply Quote 0
                          • S
                            stephenw10 Netgate Administrator
                            last edited by Mar 11, 2025, 3:57 PM

                            The gateway should be different, that;'s the upstream device at the ISP. The WAN IP is local to pfSense.

                            The first thing I would do is disable the Gateway Monitoring Action (not gateway monitoring!) in Sys > Routing > Gateways, edit the WAN gateway. An external monitoring IP is already set so that's good.

                            Check Status > Interfaces for errors or collisions. That packet loss it pretty catastrophic!

                            J 1 Reply Last reply Mar 11, 2025, 4:13 PM Reply Quote 0
                            • J
                              jrutley @stephenw10
                              last edited by Mar 11, 2025, 4:13 PM

                              @stephenw10

                              monitoring action is disabled

                              <snip IP info>
                              MTU
                              1500
                              Media
                              1000baseT <full-duplex>
                              In/out packets
                              1901037/1054338 (2.22 GiB/656.63 MiB)
                              In/out packets (pass)
                              1901037/1054338 (2.22 GiB/656.63 MiB)
                              In/out packets (block)
                              660/1 (292 KiB/40 B)
                              In/out errors
                              0/0
                              Collisions
                              0
                              Interrupts
                              2689149 (874/s)

                              J 1 Reply Last reply Mar 11, 2025, 4:32 PM Reply Quote 0
                              • J
                                jrutley @jrutley
                                last edited by Mar 11, 2025, 4:32 PM

                                I should have said "monitoring action is now disabled" earlier.

                                I'm still getting huge packet loss. I checked the modem signal levels, and they look pretty good. I'm tempted to try one of the other two disabled ports.

                                The other thing I did was disable IPv6 to see if that would help. It didn't.

                                1 Reply Last reply Reply Quote 0
                                • S
                                  stephenw10 Netgate Administrator
                                  last edited by stephenw10 Mar 11, 2025, 4:38 PM Mar 11, 2025, 4:38 PM

                                  Do you only see loss when running a test or loading the link in some other way?

                                  And you don't see any errors on the LAN side NIC either?

                                  Trying a different port/NIC is always a good test.

                                  J 1 Reply Last reply Mar 11, 2025, 4:51 PM Reply Quote 0
                                  • J
                                    jrutley @stephenw10
                                    last edited by Mar 11, 2025, 4:51 PM

                                    @stephenw10
                                    The lowest I've seen the loss is around 6%, presumably when the network is mostly idle.
                                    Most of the time it's around 16-20%

                                    Zero errors on the LAN side too

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      stephenw10 Netgate Administrator
                                      last edited by stephenw10 Mar 11, 2025, 5:07 PM Mar 11, 2025, 5:06 PM

                                      Hmm, well that's not great!

                                      Try running a ping test from pfSense dircetly so you're only testing the WAN link.

                                      Do you see loss if you just ping the pfSense LAN or WAN IP from an internal client?

                                      If you can try putting a switch between the WAN NIC and modem to make sure it's not some low level connection issue.

                                      J 1 Reply Last reply Mar 11, 2025, 5:34 PM Reply Quote 0
                                      • J
                                        jrutley @stephenw10
                                        last edited by Mar 11, 2025, 5:34 PM

                                        @stephenw10
                                        login-to-view

                                        Although I managed to find a spot to put the switch, unfortunately putting a switch in front didn't help :(

                                        J 1 Reply Last reply Mar 11, 2025, 5:39 PM Reply Quote 0
                                        • J
                                          jrutley @jrutley
                                          last edited by Mar 11, 2025, 5:39 PM

                                          no loss when pinging only within the LAN

                                          no loss when pinging the WAN IP from local network

                                          J 1 Reply Last reply Mar 12, 2025, 2:22 AM Reply Quote 0
                                          2 out of 25
                                          • First post
                                            2/25
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.