Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfBlocker & slow speeds

    Scheduled Pinned Locked Moved pfBlockerNG
    24 Posts 8 Posters 6.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NollipfSenseN
      NollipfSense @Tleary
      last edited by

      @Tleary said in pfBlocker-ng slow speeds:

      and most GeoIP

      That's my first thought.

      pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
      pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

      1 Reply Last reply Reply Quote 0
      • T
        Tleary
        last edited by

        @NollipfSense checking that out now.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          How exactly does blocking dns dns slow down your "speed" Make ZERO sense..

          Something either resolves or it doesn't - pfblocker as nothing to do with the traffic moving through pfsense..

          Your blocked or your not blocked - how does that slow you down?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          T O 2 Replies Last reply Reply Quote 0
          • T
            Tleary @johnpoz
            last edited by Tleary

            @johnpoz I have absolutely no idea. It doesn't make any sense to me so that's why I posted. Maybe there was something I'm unaware of. It's just DNS / IP blocking. I'll notice Internet connection's 'speed' doesn't respond as fast as 500mbs should. I only have pfblock on. Regardless, when I disable IP/DNSBL everything is super fast again. I'm running off of a 3100-sg. I had the problem a few times after restoring to defaults.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              @Tleary said in pfBlocker-ng slow speeds:

              connection's 'speed' doesn't respond as fast as 500mbs should

              You do understand that dns can go offline for a while if pfblocker is restarting unbound... You say 'connection' speed.. So is your dns going on and off?

              This can present itself as dns not working, etc. Then sure shit could look broken.. But once you connect your speed would be fine.. Since again pfblocker has nothing to do with that connection..

              Look in your log - how often is unbound restarting?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • T
                Tleary
                last edited by

                5 dnsbl feeds unbound once a day. I'm going through the logs.

                1 Reply Last reply Reply Quote 0
                • RonpfSR
                  RonpfS
                  last edited by

                  Is your pfblockerNG Reloading or Restarting Unbound?

                  When you experience the slowdown, Restart (or Stop / Start) Unbound from the Status / Services Tab to see if the slowdown persist.

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    Tleary @RonpfS
                    last edited by Tleary

                    @RonpfS @johnpoz I'm looking into this, might take me some time to get accurate tests. When I get a better understanding of how Unbounding is working for my 3100-SG, I'll post back. I'm spending time deciphering the packages logs. Update will be coming. thx!!

                    1 Reply Last reply Reply Quote 0
                    • T
                      Tleary
                      last edited by Tleary

                      @johnpoz @RonpfS Alright, so I have the issue occurring, but I can't tell which log I should be checking.
                      The Log Files error.log:

                      [ pfB_Main_Block_List_IPv4_v4 - uBlockFiltersPlus_v4 ] Download FAIL [ 10/25/19 00:01:54 ]
                      [ raw.githubusercontent.com ] Domain listed in DNSBL

                      Restoring previously downloaded file contents.... unknown http status code | 0

                      [ DNSBL_Malicious2 - StevenBlack_BD ] Download FAIL [ 10/25/19 08:00:15 ]
                      [ raw.githubusercontent.com ] Domain listed in DNSBL

                      Restoring previously downloaded file
                      . unknown http status code | 0

                      .----------
                      The System Log / General is ok. Mostly says no update needed:
                      Oct 25 13:04:06 check_reload_status Syncing firewall
                      Oct 25 13:04:10 check_reload_status Syncing firewall
                      Oct 25 13:04:10 check_reload_status Syncing firewall
                      Oct 25 13:04:11 check_reload_status Reloading filter
                      Oct 25 13:04:11 php-fpm 362 [pfBlockerNG] Stopping firewall filter daemon
                      Oct 25 13:04:22 check_reload_status Syncing firewall

                      RonpfSR 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        why is your download failing?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • RonpfSR
                          RonpfS @Tleary
                          last edited by

                          @Tleary said in pfBlocker-ng slow speeds:

                          @johnpoz @RonpfS Alright, so I have the issue occurring, but I can't tell which log I should be checking.
                          The Log Files error.log:

                          Maybe start with Firewall / pfBlockerNG / Log Browser pfblockerng.log ;-)

                          2.4.5-RELEASE-p1 (amd64)
                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                          T 1 Reply Last reply Reply Quote 0
                          • T
                            Tleary @RonpfS
                            last edited by Tleary

                            Yes, lol, well, what I mean is...I went through all the logs and was wondering if there was anything to specifically identify. I had seen pfblockng.log. All it contained was my feeds really. There was one failing for githubcontent.com @johnpoz soI removed that feed. The error.log wasn't useful either. It just had two lines that repeated; the failure and status code 0. I'll keep going through the logs but even though there's so many I haven't seen one to explain this problem.

                            The failed log is in another post: https://forum.netgate.com/topic/124227/dnsbl-blocks-itself/3

                            1 Reply Last reply Reply Quote 0
                            • T
                              Tleary
                              last edited by Tleary

                              Following up. I just had the issue again. This time I checked out my Resource Monitor. The TCP Connection monitor was very high but I did not have a ridiculous amount of browsers open. I looked at TCP View and the connections were fine; quantity, bytes sent/received, software connected. Proccess Explorer was fine. I have a very good computer. i7 9xxx 32gb ddr4. m.2. My ISP gives me a lot of bandwidth. Anyway, the bandwidth went down to 30MiB. I disabled my NIC. When I reenabled it the speed tests were fine again. So, I have to look more into managing my network adapter I suppose. The driver's updated. I'm not sure why it's getting such a loss of performance. I'll have to look at a way to clear it just like disabling it does. I'll continue to review the DNSBL logs and post anything notable. The issue is fixed by disabling pfBlocker but I'm not clear on the connection.

                              Post Note: The Resource Monitor showing 90% TCP connections are on tons of computers, including a work computer. I don't know if the conclusion was correct. I'm going to run ipconfig /flushdns next time or I'm going to sleep all my tabs next time.

                              T 1 Reply Last reply Reply Quote 0
                              • T
                                Tleary @Tleary
                                last edited by

                                Post Comment: It still occurs sometimes. If I use a VPN client to bypass the pfsense the Internet 'speeds' are fine and fast. Instantly after connecting everything loads ultra fast.

                                G 1 Reply Last reply Reply Quote 0
                                • G
                                  gmxpt @Tleary
                                  last edited by

                                  @tleary just got started into pfsense two months ago, previously I was using a commercial router and PiHole as my DNS blocker. I'm currently experiencing the same problems you describe. I've noticed that while browsing certain content (or the website itself) will take a longer time to load, but once it loads the speed is ok. For example, one website I visit often is 9gag.com, the website will load fast enough, but when I want to see the comments on a post it takes a long time for the content that is not text to load i.e. images and videos inside the comments. Speed tests don't really help, it takes "longer" to load the speedtest website, but once it loads the speed test results are great.
                                  I haven't done much troubleshooting in the issue, but as you mention, if I turn on my VPN on my phone (which bypasses the firewall rules created by pfblocker) or when I disable pfblocker everything loads at a normal/faster speed. BTW I'm using the SG-1100.
                                  I don't have a solution, but at least we know we are not alone with this problem.

                                  T 1 Reply Last reply Reply Quote 0
                                  • T
                                    Tleary @gmxpt
                                    last edited by

                                    @gmxpt That's awesome to hear. I've been using it for two years now. I found that I was filtering too much. It was like a nice simple dns request would get to pfBlocker and freak out. So I worked on tuning DNS at a few different levels. I set the pfSense to use OpenDNS. I added the Squid proxy app and it made a big difference. I got rid a lot of duplicates, unnecessary filter rules, and started considering the DNS process as a whole, and took down that roadblock. When I was connected with VPN it got to skip past my configs. I wish I watched the two Packt Pub video modules first.

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      catchman
                                      last edited by

                                      I can also (kind of) confirm this.

                                      But just to be clear - a speed test will result in full speed.
                                      But some web pages will open very slow, at first i thought my dns is very slow.
                                      As when the page load it does at a normal speed, just very delayed.

                                      As nearly every website is using sources(scripts, ad, tracker,...) from all over the place, its hard to pinpoint.
                                      I think it might be slow if some parts of the page are blocked.

                                      But I don't know if the browser is waiting for a timeout or a js script has trouble.

                                      1 Reply Last reply Reply Quote 0
                                      • O
                                        Orwi @johnpoz
                                        last edited by Orwi

                                        @johnpoz said in pfBlocker & slow speeds:

                                        How exactly does blocking dns dns slow down your "speed" Make ZERO sense..

                                        Something either resolves or it doesn't - pfblocker as nothing to do with the traffic moving through pfsense..

                                        Your blocked or your not blocked - how does that slow you down?

                                        may the dead live forever.
                                        So I exhume this thread here ;)

                                        It is >=4 years later and the behavior still exists.
                                        Using pfBlocker leads here and there, more than less, to a creeping slow experience on SOME sites.

                                        An answer like yours is very... how can I say it withuot being unpolite... not helpful and sounds more like defending the own team.

                                        Speaking about teams - with another sense and it's integrated lists, I was able to circumvent this - half way. The other half: Just using another unbound didn't do the trick for me. But after I disabled pfBlocker - my internet experience was blazing again - also without ads.

                                        J 1 Reply Last reply Reply Quote 0
                                        • J
                                          jrey @Orwi
                                          last edited by

                                          @Orwi said in pfBlocker & slow speeds:

                                          It is >=4 years later and the behavior still exists.

                                          let me see, how can I say it without being un-polite...

                                          I can't, if you still have not figured it out after 4 years, sounds like a you problem.

                                          I'm not part of any team, club or otherwise in regards to Netgate, pfSense or pfBlockerNG.

                                          However, if you have a problem, dragging up an old thread and saying "it is broken, can you make it go" provides zero benefit to you or anyone else.

                                          pfBlockerNG is likely not the direct cause of your throughput issue (aka slow speeds). I use pfB, understand what and how it is doing what it is doing. Zero throughput issues.
                                          Screen Shot 2023-12-19 at 7.09.35 AM.png

                                          You should open a new thread and provide details of your specific and current issue. You just never know, in that case, someone might actually help.
                                          Certainly not going to troubleshoot an issue that is being perceived to be the same as something from 4 years ago.

                                          johnpozJ 1 Reply Last reply Reply Quote 1
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @jrey
                                            last edited by

                                            @jrey said in pfBlocker & slow speeds:

                                            I use pfB, understand what and how it is doing what it is doing. Zero throughput issues.

                                            Exactly - my point from years ago, was once something is resolved - it has no bearing on latency to the ip it resolved to or as the OP was saying his speedtest.

                                            Now in theory could some site take a while to load if your dns was horrible and took forever to resolve stuff that was being loaded by the page, like images or ads or frames, etc..

                                            But once something is resolves to the IP - dns is out of the picture to speed or latency of talking to something..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            O J 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.