Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    10GB lan speeds

    Scheduled Pinned Locked Moved Virtualization
    29 Posts 5 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 1
      12Sulljo
      last edited by

      interface status.PNG

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Ok so you only have one queue for the vmx NIC like I suspected. Add that loader tunable I posted to /boot/loader.conf.local and reboot.

        What's in bridge0? But more to the point why do you have a bridge? That's probably killing your throughput.

        What's on igb0? The interrupt rate is quite high there.

        Steve

        1 Reply Last reply Reply Quote 0
        • 1
          12Sulljo
          last edited by

          igb0 is the wan

          I setup the bridge because it was recommended to me on an unraid forum on how to have the dockers and everything else on my server be visible to the rest of my physical lan network.

          before setting that up my server was unable to communicate with the rest of the network, only pfsense and the rest of the physical network was able to communicate.

          I'm still new at this stuff, I'm not sure what you mean by adding the loader tunable, all I see on this post is something called multiple queues but I'm not sure how I would turn that on.

          Thank you all for this help by the way, I'm eager to understand where my mistakes are so I can learn from them.

          DerelictD 1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate @12Sulljo
            last edited by

            @12Sulljo said in 10GB lan speeds:

            I setup the bridge because it was recommended to me on an unraid forum on how to have the dockers and everything else on my server be visible to the rest of my physical lan network.

            That would probably be a bridge on unraid, not on your firewall.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              The options for vmx are detailed here: https://www.freebsd.org/cgi/man.cgi?query=vmx

              But you want to create the file /boot/loader.conf.local (if it doesn't exist) and add to it the line:
              hw.pci.honor_msi_blacklist=0

              You can do that from the webgui in Diag > Edit File.

              Then when you reboot the vmx driver will enable MSI and you will get multiple queues on the NIC. That should allow you to use multiple cores and get far better throughput for multiple connections. Though you may still be restricted somewhere else.

              Steve

              1 1 Reply Last reply Reply Quote 0
              • 1
                12Sulljo @stephenw10
                last edited by

                @stephenw10 ok so I added it but before I do anything should I remove the usb one?

                pf.PNG

                stephenw10S 1 Reply Last reply Reply Quote 0
                • 1
                  12Sulljo
                  last edited by

                  Also, how can my vmx and physical lan be on the same subnet if they aren't in a bridge?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Use a switch?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • 1
                      12Sulljo
                      last edited by

                      I have a switch, How does a virtual nic which communicates between unraid and a VM of pfsense use a switch?

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Like I said before. you do not need a pfSense bridge to communicate across your virtual environment. You need a bridge in the virtual environment.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • 1
                          12Sulljo
                          last edited by

                          ok, but then how does unraid communicate with the physical environment without assigning an ip on a different subnet?

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            you connect your hypervisor to the bridge by bridging in a hypervisor physical NIC.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator @12Sulljo
                              last edited by

                              @12Sulljo

                              That line should should go in /boot/loader.conf.local to avoid being overwritten at upgrade. You will probably need to create that.

                              Don't remove the default values from loader.conf.

                              Steve

                              1 1 Reply Last reply Reply Quote 0
                              • 1
                                12Sulljo @stephenw10
                                last edited by

                                @stephenw10 the line increased my speed to 54MB/s and only two of my threads are running at 100%

                                stephenw10S 1 Reply Last reply Reply Quote 0
                                • 1
                                  12Sulljo @Derelict
                                  last edited by

                                  @Derelict said in 10GB lan speeds:

                                  you connect your hypervisor to the bridge by bridging in a hypervisor physical NIC.

                                  I'm not sure how I would do that, are there any instructions anywhere on how to set that up?

                                  Should my virtual nic and physical nic both be available on the pfsense interface or are you saying that unraid should have control of the nic and pf should send stuff to the unraid server through the virtual nic if it wants to reach my switch?

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    The hypervisor should have connectivity to the physical network so virtual machines running in it have connectivity to the physical network.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator @12Sulljo
                                      last edited by

                                      @12Sulljo said in 10GB lan speeds:

                                      the line increased my speed to 54MB/s

                                      Hmm, well that's not great. You see multiple queue now in vmstat -i ? Interrupts on all of them?

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • kiokomanK
                                        kiokoman LAYER 8
                                        last edited by

                                        instructions
                                        https://docs.netgate.com/pfsense/en/latest/virtualization/virtualizing-pfsense-with-vmware-vsphere-esxi.html

                                        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                                        Please do not use chat/PM to ask for help
                                        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                                        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.