Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense and Videoconference is not a perfect match!?

    Scheduled Pinned Locked Moved General pfSense Questions
    17 Posts 7 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      madah999
      last edited by

      So Im new to Pfsense and have been running the firewall for some months now. I come from a Cisco ASA 5506X with Firepower and have been scanning for better priced alternatives. So someone at work recommended Pfsense and I thought I give it a try.

      A very advanced firewall that can do a lot I am very impressed!!

      I work a a lot from my home office and have several video meetings everyday via MS Teams, Webex, Skype and Zoom.

      I have done several tests with my Cisco ASA connected in parallell with my Pfsense. Both FW are connected to the same ISP via its WAN interface and both have the LAN interface connected to the same ethernet network and ip network. DNS is also available on the LAN network. So from my laptop I can pick either the ASA as gateway or the Pfsense by changing gateway in the IPv4 settings.

      If I use Cisco ASA as Internet gateway everything work as intended, no problems with surfing the web or to have video meetings via Teams, Webex, S4B or Zoom!

      If I switch to Pfsense gateway to Internet Teams meetings are interrupted minutes after joining a meeting, my teams client connects to the meeting, drops out, reconnects, drops out continuously. Skype for business does not work at all. Webex has similar behavior as MS Teams.

      When attending video meetings, Pfsense HW is using aprx CPU 19%, Memusage 17%, Swap 0%, Disk 4%. Internet cap is asymmetrical 250Mb DN /100Mb UP

      If I change back to use my Cisco ASA I don't have any problems at all MS Teams, Webex or any other real time traffic client, traffic just flows through Cisco firewall.

      What is going on, please assist???

      KR
      Madah

      johnpozJ keyserK S JKnottJ 4 Replies Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @madah999
        last edited by johnpoz

        @madah999 All I can say is also work from home multiple times a week, and before I was work from home full time and have had zero issues with any video calls on any of the platforms, we use teams and webex all the time.. Zoom as well is very common - I don't recall a lot of skype.

        Are you running any packages? That could cause problems - any IPS for example? Your not using proxy are you? How exactly are you setup where you can use either - you have 2 public, you have a natting device in front of both your pfsense and asa?

        Could you have some sort of asymmetrical flow?

        Recently my wife was doing zoom calls every week with lots of video with lots of people setting up a wedding shower with friends and family from all over in the planning of it - she was on multiple calls a week for a few weeks with zoom, these were normally long calls of an hour or more - and she never complained..

        I have been on 2 team calls sofar today, very smooth on both of them.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • keyserK
          keyser Rebel Alliance @madah999
          last edited by

          @madah999 It's definitively not base pfSense that has any issues in this regard. So I'm guessing you have one of the following issues:

          1: Autonegotiate issue between your pfSense WAN NIC and the gateway NIC
          2: Autonegotiate issue between your pfSense LAN NIC and your Switch

          Otherwise its likely some issue on you WAN side as I assume you have multiple public IPs to be able to do that parallel setup (on IP for pfSense and one for ASA).
          Do you perhaps have the pfSense public IP loaded as a VIP on ASA as well? That constitutes an IP address conflict causing erratic ARP behaviour - the symptoms would very much be like what you are experiencing.

          Try setting up a running ping for the pfSense LAN IP, the pfSense WAN IP, the ISP Gateway IP and Googles 8.8.8.8 IP (all using the pfSense af default Gateway).
          Are they all equally stable, or which ones are seeing fallout/erratic behaviour?

          Love the no fuss of using the official appliances :-)

          1 Reply Last reply Reply Quote 1
          • S
            SteveITS Galactic Empire @madah999
            last edited by

            @madah999 What is the hardware being used? pfSense can do traffic shaping but that’s usually only helpful if a connection is relatively busy.

            19% seems a tad high at idle for a PC but if you’re looking on the dashboard pfSense is also busy updating all the widgets.

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote 👍 helpful posts!

            1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @madah999
              last edited by

              @madah999

              I often use video conferencing with Teams, Skype, Zoom, Jitsi, etc.. Works fine. In fact, last week I was on a Teams call for about 1.5 hours. No problem.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                My guess would also be some sort of link asymmetry with two gateways on the LAN subnet. Like perhaps local DNS using a different WAN IP.

                1 Reply Last reply Reply Quote 0
                • C
                  coxhaus
                  last edited by coxhaus

                  My videoconferencing is working. I am using a Cisco small business layer 3 switch with pfsense. I couple of things I did that seemed to help me is I used all upper case for my L3 defined switch gateway in pfsense and I defined the pfsense WAN interface as default. I have pfsense LAN IP setup with a static IPv4 address that exists in vlan 1 on the L3 switch. vlan 1 is defined on the L3 switch with the same network as what I used on the pfsense LAN IP. No vlans are defined on pfsense. And I setup a gateway on pfsense with the vlan IP I used for the L3 switch. And default routing for 0.0.0.0 0.0.0.0 on the L3 switch points to the pfsense LAN IP. pfsense LAN port plugs into an access port defined in vlan1 or whatever vlan you are using. I have used vlan 10 in the past. I am not sure how you have yours setup but this helped me using a Cisco L3 switch.

                  I think with this setup you could just change your routing statement and route to a different firewall. You would have to decide how you would handle DNS. DNS could be as simple as assigning something like QUAD9 in DHCP in the L3 switch. You could run a local DNS server like Microsoft DNS server forwarding to QUAD9. I guess you could change your DNS local IP when you change your routing statement. And tell everybody to reboot client devices.

                  1 Reply Last reply Reply Quote 0
                  • M
                    madah999
                    last edited by

                    Thanks for all responses.
                    The setup is straight forward. I have a Managed Netgear switch in which port 8 is on Untagged VL666 is connected to the ISP via fiber converter.
                    PFsense is connected to port 1 via Dot1Q in the same Netgear switch. PF is configured with two VLANs, VL1 and VL666 with a single NIC.

                    Pfsense1.png

                    Pfsense2.png

                    When I do Teams meetings it feels that traffic does not flow as freely as when connected via the Cisco ASA.

                    I have DNSBL+ Snort running + DHCP. I have 15 rules on the LAN interface

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @madah999
                      last edited by

                      @madah999 said in Pfsense and Videoconference is not a perfect match!?:

                      Snort running

                      And if you turn that off?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • C
                        coxhaus
                        last edited by coxhaus

                        Are you using router on a stick with untagged traffic? How do you know how to process the untagged traffic. Maybe I am looking at this wrong. You said 2 VLANs. I guess VL666 and VL1 on 1 interface. On your gateway WAN is default which is VL666. I guess you are using a trunk with 2 vlans. It took me a while to think about it.
                        Router on a stick is weird with a firewall. Why don't you use 2 interfaces defined with vlans. I guess the WAN since it is untagged it does not need to be defined as a vlan. LAN side needs a to be a vlan to be able to talk with DNS and the workstation.
                        PS
                        I have never used Netgear only Cisco.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @coxhaus
                          last edited by

                          @coxhaus said in Pfsense and Videoconference is not a perfect match!?:

                          Maybe I am looking at this wrong

                          Maybe not - might be a good catch - lists tagged with 802.1q but then his drawing shows untagged for vl666 and untagged fro vlan1? into pfsense - if that is one physical interface one of those has to be tagged..

                          so a bit confused as well with the L3 diagram

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • C
                            coxhaus
                            last edited by coxhaus

                            I would not want a Netgear switch software standing between my workstation and my DNS server. It seems very unsafe to me. I would rather be behind the firewall. But everybody gets to choose.
                            You are only logically behind the firewall not physically behind a firewall. There is a big difference in my mind.
                            His terminology may be Netgear.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              I would prefer to use two tagged VLANs on the trunk rather than tagged (666) and untagged just because it's much easier to make mistakes with tagged and untagged. I'm assuming here that VLAN1 only exists inside the switch. You shouldn't ever use VLAN1 on a trunk directly if you can possibly avoid it.

                              I wouldn't have any real concerns with a setup like this. It should work fine.

                              However if there were some layer 2 issue here it would affect far more than just streaming video.

                              Steve

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @stephenw10
                                last edited by johnpoz

                                @stephenw10 said in Pfsense and Videoconference is not a perfect match!?:

                                ather than tagged (666) and untagged just because

                                But his L3 drawing shows 666 and 1 both untagged..

                                untagged.jpg

                                Which wouldn't be good setup that is for sure. If there is only 1 physical interface on pfsense.

                                What I assumed from his L2 drawing is 666 was tagged into pfsense, and 1 was untagged.. He labeled it 802.1q so assume that vlan 1 is the the default native and would be untagged across a trunk, But then on his L3 he shows both untagged.

                                edit: but yeah if he was running both untagged into pfsense you would assume he would be seeing much more than just issues with video calls. Not even sure how you could really set that up in pfsense? On the switch sure you could send both untagged, but then there would be no wan connectivity at all since how would pfsense see the wan if was looking for tag 666 and it was untagged?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Yeah I assumed the tagging was on the L3 diagram just for clarity (though I'm not sure it helps!) since the switch isn't marked on there.

                                  What is not clear is whether the internal subnet is tagged between the switch and pfSense as VLAN1 or untagged. Either could work but I hate seeing VLAN1 tagged anywhere except inside a switch.

                                  https://docs.netgate.com/pfsense/en/latest/vlan/security.html#using-the-default-vlan-1

                                  I also don't like seeing tagged and untagged traffic on the same link though if I can avoid it. I'd rather see two tagged VLANs (other than 1!) on the trunk to pfSense.

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    coxhaus
                                    last edited by

                                    Yes, untagged traffic ends up on the default vlan which can be any vlan.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      madah999
                                      last edited by

                                      Hi

                                      I have been traveling so I have not been able to respond.

                                      I have made some changes and to my Pfsense which has fix many issues. Yes this is a simple setup with a single NIC computer running Pfsense.
                                      Yes, It is a router on stick which I find is good for a small home office. You need to trust VLAN technology to be able to use router on stick designs.
                                      I trust vlans and vlans is very practical in many ways. I will later on change from VL1 to something else as it is not recommended for security reasons
                                      to use VL1. Pfsense, Netgear and Cisco talk vlan via Dot1q protocol, Cisco used to also do vlans via their proprietary protocol ISL but they have skipped that one
                                      many years ago.

                                      I have been using my own DNS for many years because of security and the low latency in DNS resolution. I like to keep my data in my log own files
                                      rather having them at Google Datacenters :)

                                      So I was running version 2.6 when I had "my" issues. I noticed in systems log that when I was loading the NIC with "more" traffic, NIC often
                                      "decided" to restart which of course caused issues. I use a builtin Realtek Gigabit card in my Pfsense server and have found out that more people
                                      than I have had issues with Realtek.

                                      I have now upgraded the Pfsense to version 2.7, I have not started services like Snort, DNSBL for now.
                                      I only run Ntopng 5.7.2 and the setup seem to work much better with my HW compared to when I was using 2.6 version of Pfsense.
                                      No more odd NIC restarts when I load traffic on the network,

                                      I am really happy right now and I love Pfsense. :)

                                      1 Reply Last reply Reply Quote 1
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.