Netgate 2100 Throughput cap at ~500 Mbps on with 1 Gbps coax

[bumperjeep]

I’m experiencing a throughput issue with my pfSense setup on a Netgate 2100. Here’s a rundown of my setup and tests. This is just for my house.

Connection & Cabling:

    Running a coax connection with a Netgear CM1100 modem.

    Cables are all Cat6A. LAN-to-LAN tests on my server show ~980 Mbps.

    When connected directly to the modem, I get around 950 Mbps.

Current pfSense Configuration:

    WAN gets a public IP (no double NAT).
    I have maybe 20-30 total firewall rules across all the interfaces. 

    Hardware Offloading settings:

        Checksum Offloading: Enabled

        TCP Segmentation Offloading: Disabled

        Large Receive Offloading: Disabled

    I also have limiters configured, but none are active.

Additional Services Running (But Basically Idle):

    rsyslog forwarding to another machine

    DuckDNS

    WireGuard - the tunnels are enabled, but not very busy.

Despite the solid hardware and direct tests confirming the full gigabit capacity, speeds through pfSense top out around 500 Mbps. I’m wondering if the enabled checksum offloading might be causing an issue or if there’s something else I should check in my configuration.

Any ideas or recommendations for further troubleshooting would be greatly appreciated.

[SteveITS]

@bumperjeep 500 is a bit low, but realistically you’re not going to see 900 on a 2100. I’d expect more like 600-700 without extra things running. Run top at a command prompt and see if it’s CPU limited.

Also, chevk without the dashboard up, and don’t test on pfSense itself.

[Mission-Ghost]

Even with the lower possible throughput of Starlink, I received observably better performance with a Netgate 4200 than an 1100. I understand the 1100 has the same processor and switch components as the 2100.

A friend with gigabit cable moved up to a 4200 from a 2100 and their throughput increased from approximately 600 mbps to 900 mbps.

It appears the 2100 is not typically capable of gigabit throughput.

Advertising notwithstanding.

[keyser]

@bumperjeep The Netgate 1100 and 2100 does not do anywhere near Gigabit when doing NAT and having the Firewall enabled. They do not have enough CPU power to handle the interrupt/packet rate.
I have a lot of experience with those units, and depending on you setup the 1100 will do a maximum of up to 500mbps. The 2100 will go a little higher because of the two NIC’s compared to only one on the 1100. The 2100 tops out in the very best cases at about 640mbps, but generally will do about 540mbps. If you want anything higher you will need to go netgate 4200 or higher.