Slow internet speed with pfSense virtualized under Proxmox on Zimaboard 832

brainolution

I recently got a new Zimaboard 832. I installed Proxmox on it and virtualized pfSense (v2.7) under it. I have a 1 Gbps fibre broadband connection, but noticed that the internet speed that I get from pfSense is around 500 Mbps up and down. This is with 2 CPU cores and 2 GB RAM.

Here are some other observations:

When I connect my computer directly to the modem, I get about 800-900 Mbps both up and down.
When I run pfSense natively on the board, I get about 800 Mbps up and down.
Increasing the number of CPU cores from 2 to 4 increases the throughput to about 600 Mbps (i.e. 100 Mbps improvement).
Increasing the RAM from 2 to 6 GB doesn't make any meaningful difference.
The option to Disable Hardware Checksum Offloading in pfSense is checked.
RAM Disk is enabled.
PowerD (HiAdaptive) is enabled.
Cryptographic Hardware: AES-NI CPU-based Acceleration
Thermal Sensors: Intel Core CPU on-die thermal sensor
VirtIO is used for the network devices.
The Zimaboard uses Realtek NICs. I installed the latest Realtek driver but it didn't make any difference.
I'm using speedtest for testing.

So, is there a performance penalty due to virtualization? Is this the best performance I can hope to get with this board with virtualized pfSense?

Urbaman75

This post is deleted!

Urbaman75

This post is deleted!

bmeeks

@Urbaman75 said in Slow internet speed with pfSense virtualized under Proxmox on Zimaboard 832:

So my problem seems to be Suricata-related, stopping it the throughput get up to 2G!

Is there a way to get Suricata faster?

Use fewer rules. Most users wind up enabling far more rules than are actually needed. Evaluate the exposed vulnerabilities in your network and only enable rules that cover those scenarios. For example, if you don't run a web server, email server, or public DNS server, then all the rule categories related to those vulnerabilities are not needed and should not be enabled.

I see you appear to have a Bridge interface enabled (vmbr0). Suricata is not going to play well with that setup. It wants to run on native physical interfaces and not virtual ones (a bridge is a type of virtual interface).

You can also try swapping the RUN MODE on the INTERFACE SETTINGS tab to "workers" from "autoFP". Sometimes that can help, but usually more so when using Inline IPS Mode.

Urbaman75

This post is deleted!

bmeeks

@Urbaman75: yes, if the virtual NIC is single-queue only that will certainly impact throughput.

Bob.Dig

@Urbaman75 Have you tried turning "Multiqueue" on and off for the VirtIO paravirtualized NIC, to see if it makes any difference?

Urbaman75

This post is deleted!

brainolution

@Urbaman75 You have completely hijacked my thread. Mine was in the context of my newly purchased Zimaboard.

Could you please create a new thread of your own and delete your comments so I could get the space?

Urbaman75

@brainolution done, deleted my comments, sorry for having taken up your space

tibere86

@Bob-Dig - How do you enable MULTIQUEUE on Proxmox with VirtIO NICs? I have tried this to no avail. Even though I enable the setting in the VirtIO NICS, pfSense does not see it and still reverts to a single (1) queue.

brainolution

@tibere86 Please create a new post for your question. Thanks.