FIOS > ONT > pfSense = nojoy
-
Recently upgraded to FIOS, and i can't make sense of it anymore need a hand here.
-FIOS > ONT > G3100 (verizon router) = subscription speed 500/500 is all there.
-FIOS > ONT > pfSense box = 300/9
-FIOS > ONT > Client PC = 500/500
-FIOS > ONT > G3100 > pfSense box = 300/9pfSense box = Dell R210II
CPU Type Intel(R) Xeon(R) CPU E31240 @ 3.30GHz
Current: 3300 MHz, Max: 3301 MHz
8 CPUs: 1 package(s) x 4 core(s) x 2 hardware threads
AES-NI CPU Crypto: Yes (active)
QAT Crypto: NoPlease advise
-
-FIOS > ONT > pfSense box = 300/9
You are Xeon E3 based and my small APU4D4 is doing without any tunings and pimping something around
480 MBit/s plus TCP/IP overheat ~500 MBit/sYou are way of with your Xeon E3-12xx @3,xGHz it must be able routing a full GBit/s in my eyes. Is it bare metal or in VM?
-
A limit at 9Mbps like that indicates some low level issue like a speed/duplex mismatch or a bad cable
Check the Status > Interfaces page for errors or collisions on the WAN and LAN.
Steve
-
bare metal.
-
WAN Interface (wan, bce0)
In/out errors
0/0
Collisions
0LAN Interface (lan, lagg0)
LAGG Protocol
lacp lagghash l2,l3,l4
LAGG Ports
em2 (ACTIVE,COLLECTING,DISTRIBUTING), em3 (ACTIVE,COLLECTING,DISTRIBUTING)
In/out errors
0/421
Collisions
0 -
Hmm, well bce can be problematic. I assume it shows as linked at 1G auto?
I would try running a test from the firewall itself using the speedtest-cli pkg. That way you are only testing the WAN.
A LAGG of two em NICs should be fine but to be sure I would probably try assigning WAN and LAN as simply single em NICs. That should always work.
Steve
-
Retrieving speedtest.net server list... Selecting best server based on ping... Hosted by Hosted Backbone, LLC (Ashburn, VA) [72.52 km]: 3.803 ms Testing download speed................................................................................ Download: 282.25 Mbit/s Testing upload speed...................................................................................................... Upload: 9.63 Mbit/s -
Hmm, so appears to be a WAN side problem.
I would try swapping the bce NIC for one of the ems if you can.
-
-
Hmm, and it is linking as expected at 1G (auto)? With no errors/collisions?
Do you have any traffic shaping applied?
-
My Internet speed is Down50 and Up10 but it is a little bit more coming over the line (63 Down and ~13 Upload)
and my speedtest server is ~180 Kilometer (1k = 1000 meter) away. Test is done under a pimped and tuned APU4D4, but it has only some tuneable´s and the cpu
is not anymore on 600MHz - 1000MHz, it is now on
1000MHz - 1400MHz. But this is ways under your
Xeon E3-12xx @3,0GHz CPU! You should be able
to route one pure GBit/s up and down with your
cpu in my eyes. Perhaps it has something to do
with your rules set and/or iDS/IPS or perhaps
pfblocker-NG could be involved? I am running here a
pfSesen that is turned into a full UTM, with mSATA, modem and WiFi card, plus snort, ClamAV & Squid & SquidGuard & pfBlocker-NG, so with your hardware
you should be able to serve a small company as I see it.[22.05-RELEASE][root@home.arpa]/root: speedtest-cli Retrieving speedtest.net configuration... Testing from Deutsche Telekom AG (xxx.xxx.xxx.xxx.)... Retrieving speedtest.net server list... Selecting best server based on ping... Hosted by Spacken.net (Hagen) [179.48 km]: 39.099 ms Testing download speed................................................................................ Download: 57.90 Mbit/s Testing upload speed...................................................................................................... Upload: 11.27 Mbit/s -
link is normal 1G auto there are some errors on the LAN interface.
no traffic shaping.reseat the NIC, pfblocker/snort disable all yields the same results.
-
buffer bloat limiter was the issue.
-limiter adjusted for the new connection.resolved.
-
@propeto13 said in FIOS > ONT > pfSense = nojoy:
buffer bloat limiter was the issue.
-limiter adjusted for the new connection.resolved.
Perhaps you will be so friendly and say exactly what and where you were setting up? Only for other find later that threat here over google or the forum search.
-
You have to set the expected available bandwidth on the WAN when configuring Limiters for buffer bloat because in order to control it you need the Limiter to be the throttling point in the link.
So if you then change the WAN to some higher bandwidth you have to reconfigure the Limiter to match that or you will be stuck at the previous values. As OP found.
Steve
-
@stephenw10
Well said, thank you for clarifying this to me. -
