Messages

1

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 22, 2018, 07:35:53 am »

Actually, I just found some public iperf3 servers on the internet and was able to run a few tests and can verify that I am able to route traffic through the OPNSense box at near Gig speeds (~915 Mbits/sec). As far as I can tell, this verifies that the OPNSense box is running okay.

What does this all mean as far as internet speed tests are concerned? I'm not exactly sure. I have read over and over again that they are inconsistent and not a great measure of a speed test but I can't stop thinking about the fact that if I run the test directly from my laptop to the cable modem that I get better results. At this point, maybe I'm just chasing ghosts and should be satisfied with the results I'm getting with iperf.

2

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 22, 2018, 06:40:19 am »

Okay, so I did some new tests with iperf3 but I need someone to validate the setup and let me know if this is a valid test.

My OPNSense box has a 4 port network card in it. What I did was create a VLAN on my switch (VLAN 10), and created a new VLAN interface in OPNSense and attached it to one of my unused ports. I then connected this port to a switch port that was tagged for VLAN 10.

I also setup a spare PC with Debian 8 (PC2) on it and connected it to a static port on the switch for VLAN 10. I verified that without the OPNSense box in the middle, that I could not access the PC2 on VLAN10 from my test PC (PC1) on the default VLAN.

I then added the proper firewall rules on OPNSense to allow access to PC2 from PC1. All is good at this point. I proceeded to run my iperf3 test with PC1 as the client and PC2 as the server. My results were fantastic, ~915 Mbits/s

This is where I need someone to validate my test, my thinking is that because PC2 is on a separate VLAN that my OPNSense box had to route and allow all the iperf traffic through the firewall, proving that the OPNSense box was very capable of near 1 Gbs traffic. Question is, was my test valid. Only thing I can think about is that there was no NAT involved in the test. Would that make a significant enough difference in this validation?

3

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 21, 2018, 04:16:17 am »

@compunction, I'm still playing with different combinations of settings with mixed results. Sometimes, I feel like I find a combination that seems to improve things, but the results don't seem to last. So, I am starting to think that my test methodology is flawed.

First, using speed test sites seems to be very inconsistent. I'm thinking that the only real way to get an accurate speed test is to do an iperf test with two computers, on either side of the OPNSense router (LAN/WAN). To be honest, I feel I may even be getting throttled from hitting the speed test sites so often. Just a paranoid theory really.

I'll report back once I get more info and setup a proper test. That said, what are the specs of your OPNSense box?

4

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 07, 2018, 04:16:39 am »

Perhaps check out https://www.freebsd.org/cgi/man.cgi?tuning

dcol also has a more specific tuning thread here. I found it helpful: https://forum.opnsense.org/index.php?topic=6590.0

@youngman Thanks for those links. I'm playing around with some of the tunables now. I'll report back if there's any improvement.

5

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 06, 2018, 11:05:44 pm »

Just wanted to update with some additional steps I've taken without success. So far I've tried to enable "hardware checksum offload", and "hardware TCP segmentation offload", rebooted and still had no improvement. I left "hardware large receive offload" disabled during testing.

I have also replaced all Ethernet cables just to be sure that wasn't part of the issue.

6

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 05, 2018, 04:30:19 pm »

If I remove the OPNsense box from the equation, I consistently get the faster 900 - 940 Mbps speed test results.

When you add the OPNsense box, is the modem/connection interface bridged properly? No double NATing or other double-ups?

No double NATing. As a matter of fact, the modem doesn't have any router or firewall features, other than passing a local IP during boot before it passes a public IP. For reference, it is a Motoroal MB8600.

Thanks,
Ric

7

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 05, 2018, 09:42:37 am »

IPS and Proxy disabled?

Yes, both are disabled.

8

Hardware and Performance / Re: Bandwidth slow through firewall

« on: August 05, 2018, 09:00:16 am »

Set MSS on LAN to 1400

Tried that, no change. Thanks for the suggestion though.

9

Hardware and Performance / Bandwidth slow through firewall

« on: August 05, 2018, 03:35:46 am »

Hi,

I recently upgraded to Gig internet with Comcast and have been having trouble getting my full speed when traffic is going through the firewall.

To do some baseline testing, I have connected my laptop directly to the cable modem and when I do a speed test on http://speedtest.xfinity.com/ I consistently get between 900 - 940 Mbps. When I do the same speed test with OPNsense as the firelwall/router, my download speeds are ~ 600 Mbps. I have an IPSec vpn running but I have removed it and run the speed tests and still see the same results. For testing pruposes, I have all other devices removed from the switch so it's just my laptop, the OPNsense box, and the cable modem. The laptop is connected via ethernet cable during the tests. If I remove the OPNsense box from the equation, I consistently get the faster 900 - 940 Mbps speed test results.

I have done an iperf3 test from my laptop to the OPNsense LAN port and am getting ~940 Mbps test results, that of course is not traversing the firewall.

Here are the OPNsense box specs:
Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz (4 cores)
8 Gigs of Ram
I350 Quad Port Network Card

Modem:
Motorola MB8600

Any troubleshooting tips would be appreciated.

Thanks,
Ric

10

General Discussion / Re: IPSec Not Staying Alive

« on: July 02, 2018, 08:20:14 am »

I may have figured it out. Looks like I had missmatched PFS key groups in my phase two settings. I checked and updated them to match and the link has stayed up without issue for 12 hours.

Sent from my SM-G965U using Tapatalk

11

General Discussion / [Solved] IPSec Not Staying Alive

« on: June 30, 2018, 11:19:28 pm »

Hi,

I've setup an IPSec VPN point to point connection between three sites in a hub/spoke model. So far, I have everything setup and can contact clients at any of the three sites from any other site. My problem is that I can't manage to keep the connections alive. As I am still testing there is no active traffic going across the IPSec tunnels unless I'm actually actively doing my testing. When I step away and come back after a few hours, all the tunnels are down and I have to manually bring them back up.

Question is, how do I keep them active and how do I have them auto-connect in the event they go down? Once I solve this, my setup is ready to go.

Thanks,
Ric