VPN tunnels massively slows down if high network traffic
-
That delay is abysmal.
Now add the right axis, Traffic, WAN
-
-
OK so there is no traffic reason for the delay.
At first glance I'd say your ISP/Your ISP circuit is having serious problems.
-
depending on the current situation, that i have massive problems at the moment I would assume that as an option as well ...
just wanted to make sure that there is no config error
-
There is nothing in pfSense that can send an echo request out WAN and delay the echo reply 1200ms before it arrives on WAN.
-
I have found out what the issue is. The cheap f*** internet gateway router detects a sync flood and slows down the interface ...
So I will get a fritzbox as a Modem instead of this thing.
as a workaround I have disabled all VPN Clients and only use the wan gw. hopefully it will not get to much on my nerves until this evening
-
Nice, that will do it!
You can't disable that? Or tune it? I assume you mean 'SYN flood' which this is not. Something that is a modem only is a better option though I agree.
Steve
-
Auto correct did the syn“c“ ;)
This isp Router cannot tweak anything ...
Unfortunately today there are no good modems (stand alone) are available. So another Router where no router is really needed
-
@paoloest said in VPN tunnels massively slows down if high network traffic:
Unfortunately today there are no good modems (stand alone) are available. So another Router where no router is really needed
Sure there are, for (V)DSL you can use the Draytek Vigor 165 for example. For cable it depends on your provider.
-
@grimson said in VPN tunnels massively slows down if high network traffic:
Draytek Vigor 165
thanks a lot. have seen this, but it costs more then the fritzbox 7530 - the pros of the fritzbox for me were that the modem (with the same specs) is build in and I can have one more security layer. (and with the fritzbox I can fine tune the parameters)
would you choose the modem over the router?
-
@paoloest said in VPN tunnels massively slows down if high network traffic:
would you choose the modem over the router?
When using pfSense, always. Double-NAT just adds useless complexity and the pfSense devs are a lot faster in fixing security issues than the AVM devs.
-
And beyond the pfsense there is a Sophos utm for one subnet and an xg for Another.
So maybe no bad idea to leave one layer of complexity ;)
-
You guys actually have VDSL2+? No jealousy here!
Otherwise the V130 would likely be cheaper.
Steve
-
@stephenw10
Sounds like another +1 for the vigorVdsl2+ - 3 weeks to go
-
@stephenw10 said in VPN tunnels massively slows down if high network traffic:
You guys actually have VDSL2+? No jealousy here!
Not to bad for a little village in the hills. Real fiber would be nicer, but that's not going to happen anytime soon here.
Edit: this is with a current link uptime of 6 weeks.
-
Nice!
-
Today the vigor will arrive and I am prepared to set it up ;)
One question: if it runs as a modem via pppoe and the connection is initiated by the pfsense. How can you dial in the webinterface of the modem? (The wan Interface has no ip in subnet of modem)
Do you have one vlan (7) as Gateway vlan and another as a Management vlan with static ip in the vigor subnet?
-
One method:
https://docs.netgate.com/pfsense/en/latest/interfaces/accessing-modem-from-inside-firewall.html
