Messages

Brandywine – for clarity when I did the VM-Host/Laptop test I put a layer 2 switch in play.

Figured it out.

After an evening filled with Margaritas and a good nights' sleep, I rolled up the sleeves and went back to basics. I replaced the patch cable. Lo and behold it worked. Dumbfounded at the simplicity and having been in IT for 30+ years, I was upset with myself for not trying it sooner. As with any good troubleshooting the first thing I did was ask, what changed? Well the fw changed. After putting the old one back and the problem going away, that would indicate the problem was with the new fw... (this was literally day/hour one)

Anyhow, to be certain of this, I put the cable back in and the problem came back. In my years, I have had my fair share of bad cables (ask me about the plenum run we found that had been "repaired" by building maintenance with telecom gel filled crimp connectors), but never once have I had a cable negotiate 1g-FD but pass clean heavy traffic one way and choke in the other. I even took the extra step of flipping the cable 180 and sure enough, the problem followed the cable. Laptop > VM was fine at 942 Mbps but VM > laptop choked at 2kbps. Problem was with the receive pair of wires. Still don't understand why it worked with the VP2410 but oh well.

Anyhow, problem solved. Thanks for the sounding board.

I believe we can close this one out as the problem is not within the Protectli/OPNsense device. Found an old laptop in the storage room and plugged it in to the DMZ vlan...
My workstation (iperf -c) > through vp2420/OPNsense > VM on DMZ host (iperf -s) = 600 kbps
My workstation (iperf -c)> through vp2420/OPNsense > Laptop in DMZ vlan (iperf -s) = 934 Mbps
VM on DMZ host (iperf -c) > laptop in DMZ vlan (iperf -s) = 945 Mbps
Laptop in dmz vlan (iperf -c) > VM on DMZ host (iperf -s)= 2 kbps
Created a temporary firewall rule allowing port 5201 traffic from dmz to my workstation
VM on DMZ host (iperf -c) > through vp2420/OPNsense > my workstation (iperf -s) = 932 Mbps
So something going on with that host and inbound connections. Not a VP2420/OPNsese issue. What is throwing me is it works when the 2410 is in play. Checked for IP conflicts and don't see any.
Anyway, thanks for all the ideas folks.
If I figure it out I will update the thread.

Couple notes and a surprise.
I neglected to mention that I checked the negotiation a while back. the host was wired directly to the interface then wired to a separate switch (it is back to direct wired). In all cases the host and interface had always auto neg 1g FD and at some point I nailed the config to 1g FD on both devices.
I am not sure I remember seeing the 2430 back when I ordered it in June, otherwise I probably would have.
I swapped the DMZ interface for one of the WAN interfaces and the problem followed the swap so it is not a defective port issue.
Now here is the surprise. it is a VP2420 running the J6412 but it is also running the I226-V (unless opnsense is lying to me)
I think my next step is to restore the old 2410 config and see what it does. will have to wait until this weekend.
You cannot view this attachment.

Apologies for the late reply, life got in the way.
To add a few details:
1. Opnsense is not virtualized. It is running on a new Protectli VP2420 device (a physical upgrade/replacement for the previous VP2410 device).
2. The DMZ host that is currently in play with the nextcloud VM is the same host/VM that was in play with the old VP2410 opnsense.
3. Over the weekend, I took the new VP2420 out of the mix and put the old VP2410 in and everything ran like it did before. no issues with DMZ performance.
4. With the exception of my workstation, all of the source/target iperf machines are VM's running on vsphere 8. not sure how relevant the hypervisor is since I get the same performance regardless if it is my work station or a VM
With that, I would assume the issue lies within the VP2420, either the device itself or the opnsense install/config.
I think my next plan of action is to:
A. set up another host in the DMZ and try that. I doubt it will make a difference due to item 3 above.
B. Completely rebuild the VP2420 but swap the LAN<>DMZ interfaces. if the problem follows the DMZ, then it would be a config problem. if it stays with the interface, then it would point to a hardware issue. If the problem goes away, then I fudged a config somewhere (and I am going to go N.V.T.S nuts wishing I understood what happened...)

Thoughts? any other ideas I can try?
Thanks for the assist. You are appreciated.

Hey all, first time on the forum but not a first time user. been on opnsense since it forked from pfsense.
got an issue that has me stumped. I've been running a Protectli VP2410 for the last 3 years and it has been rock solid stable. Not running Suricata or IDP/IPS or anything special. Just a dual wan, a LAN, VLAN and a DMZ (Nextcloud) with some rules and DHCP on the LAN/VLAN. Both of my ISP's announced that 2g fiber was coming soon so I splurged and picked up a VP2420 to get the 2.5g interfaces. I did not restore my config from the old unit. I just documented my settings and entered them into a fresh opnsense install on the new unit. Everything works great except traffic to/from the DMZ. Haven't tried the VLAN as that one is wireless so I expect a perfomance hit
1. from the public internet, uploads/downloads to the nextcloud instance in the DMZ (192.168.11.23) runs between 1 and 2 mbps (on the old device it easily hit 700+mbps)(I know this as this is how I moved ISO's from home to work)
2. from my workstation (192.168.10.167) to the DMZ machine (192.168.11.23) iperf is showing 1.47 Mbits/sec. the same test to a file server (192.168.10.20) in the same lan segment as my workstation is 826 Mbits/sec.
3. From a test machine I spun up in the DMZ (192.168.11.20) to the target machine (192.168.11.23) I am seeing 9.55Gbit/sec (same hypervisor host)
I just today stood up the iperf tests but last week I put the old VP2410 back in play for a day and all the performance issues went away.
What am I missing?