Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Random Websites slow under VLAN

    Scheduled Pinned Locked Moved
    L2/Switching/VLANs
    3
    8
    609
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • idscommI
      idscomm
      last edited by

      Hi guys,

      I have a pfsense (2.4.4 p3) setup with a Guest VLAN. The guest VLAN is tagged through UniFi Access point.

      Im having issue with some websites I.e.: www.wannawin.ca which loads super slow (about 1 minute to load) while my LAN side loads it instantly.

      I did some research, played with the MTU/MSS of my guest interface, I also ticked Disable Hardware checksum offload but I can’t find the problem!?

      Any ideas? I’m fairly new with pfsense as I just switched from Check Point.

      Thanks!

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        Hi,

        Just found another tip, check this : is your VLAN using IPv6 (and your pfSense isn't routing IPv6 ) ?

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • idscommI
          idscomm
          last edited by

          Hi Gertjan,

          Thanks for the reply. I am not using IPv6 on my network... the option I believe is still check tho, wonder if I should block all IPv6 traffic... not sure it would help or not.

          My installation is fairly basic - couple network interface (Broadcom and Realtek), LAN, VLANs (Guests and Cameras), DMZ for the Web Servers. Only package installed on my Box are Snort and pfBlockerNG which I tried to stop the services and I was still experiencing the issue...

          I wonder is this has anything to do with the VLAN itself. My LAN and VLAN shared the same NIC, no issues with the LAN side but the VLAN can't access some sites, others are super slow to load... Not sure where to look anymore..

          JKnottJ 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan
            last edited by

            @idscomm said in Random Websites slow under VLAN:

            I.e.: www.wannawin.ca which loads super

            Btw : a site that talks about money and isn't accessible by https ..... worse, it has a certificate, it expired more then a year ago.
            I would enter this site into pfBlockerNG ... not as an exception, but as a block.

            Do you have another example with a more serious site ?

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            idscommI 1 Reply Last reply Reply Quote 0
            • idscommI
              idscomm @Gertjan
              last edited by

              @Gertjan
              I totally agree with you on that one, the site is used by a couple of people... not much I can do about their gambling "hobby" lol.

              I will try to find a few sites for you, I will run some test. I need to solve that because Like I said this affects more than one site... Hopefully it'll be fix sooner than later... I'd hate switching for another product now that I am all setup.

              1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @idscomm
                last edited by

                @idscomm said in Random Websites slow under VLAN:

                Thanks for the reply. I am not using IPv6 on my network... the option I believe is still check tho, wonder if I should block all IPv6 traffic... not sure it would help or not

                If set up properly, IPv6 is not the problem. You might have slow response if you have IPv6, beyond link local addresses, on your LAN, but no routing off your network. In this instance, when the DNS reply contains AAAA records, that will be tried first, falling back to the IPv4 A record. I experienced this last year, when my ISP had a problem with IPv6. You will not experience delays to IPv4 only addresses, if this is the cause.

                If you don't have any other IPv6, you should at least have link local(fe80::) addresses.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • idscommI
                  idscomm
                  last edited by

                  Update for the ones interested, well, I have done more testing and although I had "authorized" or whitelist the IP address for the sites in pfblockerNG, it seems that it was the issue. I de-activated pfblockerNG and tried accessing these sites and quick as lightning now!

                  I will have to dig a bit into the config to see where it "hangs" ...

                  1 Reply Last reply Reply Quote 0
                  • idscommI
                    idscomm
                    last edited by

                    • UPDATE *
                      I did more test today and I don't understand why pfblocker NG causes the issue on my VLAN but not my LAN since both networks are assigned to the same interface and screened by the same rules under pfblockerNG... The IP was white listed therefore it should not be an issue in my opinion...

                    @BBcan177 Maybe you can shed some light on my issue if you have time, I would appreciate that. :)

                    Thanks in advance!

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post