PFSense with Squid Proxy = Slow speedtest.net Download on Comcast Only

Spiffster · May 5, 2014, 8:18 PM

We have four offices that each have a pfsense firewall setup (version 2.1.3 amd64) .
Two offices have Comcast for internet connectivity, the other two have Windstream and CenturyLink DSL.
What is strange is that I have every office setup with identical configurations for the basic (stable release) squid package. Using speedtest.net at the offices with Comcast, when bypassing the proxy I can get about 18Mb down and 2.5Mb up (full speed), using the Squid proxy I only get 2.8Mb down and 2.5Mb up.
Now, at the sites using non-Comcast connections, there is only a small hit to upload speed when using the squid proxy.

For squid, we are using default configurations, the only alteration I have made was from this guide:

https://doc.pfsense.org/index.php/Squid_Package_Tuning

'Change kern.ipc.nmbclusters="0" to kern.ipc.nmbclusters="32768"'

Thats it. I did try with the default setting 'kern.ipc.nmbclusters="0"' and can see no difference.

I/O errors are 0/0

Perhaps something needs to be tweaked for Comcast? If so I have no idea what would need to change, and thats why I am here.

Every office is running pfSense in a VM on ESXi 5.1. Hardware is same across the board too: Dell 2950 w/3.0ghz, 32GB Ram, 6 x 146GB 15k in RAID 10.

Any help would be much appreciated. Thanks!

Spiffster · May 6, 2014, 2:08 AM

OK, well now im getting speed tests that are 90% of the time capped at 3Mb then sometimes jump to 18Mb or so. Same thing at both locations. Cant make any sense of it all. Only happening on Comcast internet connections.

rds_correia · May 6, 2014, 11:56 PM

Hello.
I wonder if both our issues could be somehow connected…
https://forum.pfsense.org/index.php?topic=76564.0
We're not on the same ISP, though.
Do you feel slowlyness on vLAN to vLAN too?
Cheers

Spiffster · May 7, 2014, 1:38 PM

Possibly. There seems to be a hard cap at 3Mb and about 2-2.5 on upload. I dont have vLans setup though, but I too cannot find anything in the logs that would give a clue as to where the restriction is. Its very odd… I am not running the proxy in transparent mode as I have a .pac file that points systems to the proxy. I have tried running in transparent mode by manually setting a client PC to pfsense as the gateway, and the problem goes away. Since I will eventually replace my original firewalls with the pfsense ones, this will be a non-issue soon.