Internet Speeds crushed after update to 26.07

hypnosis4u2nv

26.07-RELEASE running on my own box.

I don't have any error messages so I don't know where to begin looking for the issue, but my download speeds seem to be capped at around 200Mbps on a 1Gig line. Speed tests from the modem show I'm getting the full 1Gig so it's not that. I also have a VPN setup and doing a speed test drops to nothing.

hypnosis4u2nv

Rebooted, waited 15 mins for things to settle down and I had the same results. Went back to 23.06.1 and everything is good again. Not sure what it is but the lack of error messages and my VPN becoming basically unusable is going to keep me off this 26.07 for a bit.

hypnosis4u2nv

Figured it out and will post here in case someone else runs across this.

It appears to have been caused by Suricata blocks for STREAM excessive retransmissions, HTTP Response excessive header repetition, HTTP Request unrecognized authorization method, Ethertype unknown, STREAM Packet with invalid timestamp, weak cryptographic parameters (PRF).

These were all new alerts that were blocked right after booting up on 26.07. Once I suppressed those GID:SID and cleared the blocks, everything started working again.

SteveITS

@hypnosis4u2nv We have this note in our procedures from prior forum conversations/posts. The first sentence in particular may apply here?

"Suricata: disable categories via dropsid.conf because categories are always re-enabled at every reinstall/upgrade. “events” rules are “designed to simply be "informative" and log particular events the IDS sees. 99% of these events are totally harmless.” disable the stream-events.rules category or it will block lots of traffic on false positives. consider disabling all *events categories.
add disable-sid.conf file on SID Mgmt tab and assign to “Disable SID List”:

# Example of modifying state for specific categories entirely.
# "snort_" limits to Snort VRT rules, "emerging-" limits to 
# Emerging Threats Open rules, "etpro-" limits to ET-PRO rules.
# "shellcode" with no prefix would match in any vendor set.
# snort_web-iis,emerging-shellcode,etpro-imap,shellcode

stream-events.rules,quic-events.rules

Check “Enable Automatic SID State Management” on SID tab (top of page)"

hypnosis4u2nv

@SteveITS Thanks Steve. One of those brain fart moments where you never had an issue before and then all of sudden the internet goes down - and right during the late evening when you're half asleep and about to go to bed. It was much easier to just revert back for the night and look again through fresh eyes.

hypnosis4u2nv

@SteveITS I also added -events.rules as suggested to the SID management to disable all those from loading at the next update. Thank you.

SteveITS

@hypnosis4u2nv I think it matches from the beginning of the name? So we use "stream-events.rules,quic-events.rules" as above.

hypnosis4u2nv

@SteveITS (-events.rules) worked as a wild card to disable all the event rules categories.

marcosm

See: https://redmine.pfsense.org/issues/16808