Messages

In case anyone finds this thread this has been resolved by swapping the router.

I installed Opnsense 25.7 on a Sophos XG310 with a 4 port fiber expansion module and restored the settings from the M470. I had to adjust the interface assignments but it just took a few minutes and I was up and running.

I used all the same RJ45 -> SFP+ module/cables and I get a full 2g+ up/down through the box. I also tested four different brands of SFP+->RJ45 adapters and they all push 2g+ through the XG310 router.

So the problem appears to be with the Watchguard M470 limiting traffic to 1g for some reason. The XG310 also has a i3-6100 desktop CPU which is about half the CPU power of the E3-1260Lv5 in the M470 so it was definitely not a CPU issue. I'm going to install a E3-1275v5 Xeon just because they are so cheap and we should be good as we step up to 5g or even 10g internet as it drops in price.

As a test I connected a 8 port switch with 10g rj45 ports between the ONT and the M470. The link speed on both 10g ports shows 10g connection speeds.

Unfortunately my download/upload speed is still ~950Mbps or 1g.

Looking like it's the M470 hardware or maybe OpnSense is limiting the throughput to 1g. I'm going to test some different hardware to host OpnSense
next. I may try Xeon server with 10g ether NIC and a SFP+ nic just to eliminate under powered hardware as an issue.

Thanks! I missed the link.

I used this guide and enabled RSS.

Code Select Expand


    net.isr.bindthreads = 1
    net.isr.maxthreads = -1
    net.inet.rss.enabled = 1
    net.inet.rss.bits = 2


Same result, still 1g download. Traffic shaper was never setup and nothing is listed under rules/status/etc. No IDS setup.

Yes. There are links in the original article, pointing to instructions on enabling RSS.

Please disable the traffic shaper to test if that has any impact, regardless of having set the correct limits. Same goes for any type of IDS.

Tested with 2 different 10g only RJ45 modules and I'm still limited to 1g download speed. I'm guessing at this point that
OpnSense is not allowing the M470 perform at full speed on the SFP+ ports. 

This point 10?

Code Select Expand

10. You do not get close to your ISP's advertised speed? Some CPUs are not sufficient for fast internet connections. Look for ones with high single-thread performance - especially, if you need PPPoE, VPN and/or Zenarmor or other IDS (disable them for tests). For more than 1 GBps, you may need something along the range of an N100, for more than 2.5 Gbps you will look at CPUs with even more punch. There are many websites to compare CPU speeds or look in the hardware and performance section.
Also note this about RSS. That being said, hand-me-down systems often are sub-par w/r to being used for OpnSense, because desktops with older CPUs tend to use way more power such that the higher energy cost may soon outweigh the investment on a modern appliance in a 24/7 scenario.

Also: Disable any traffic shaper, especially when you just upgraded your plan to a higher speed.

That being said: How are you measuring? Single stream performance may not utilize your connection fully, so if you use iperf, try "-P4". Also, do not measure from OpnSense itself, but route the connection through it, in order not to put more strain by running the test client or server on it. You can use OOKLA speedtest in a browser, this is multithreaded.


Yes, #10 regarding the CPU speed? I tried an updated Xeon E3-1260LV5 CPU with no change. Or did I miss something in that post?

So, did you actually try the tips in the link I posted in #1?

No. follow this link and look in point 10 in the first posting. There is more than one tip w/r to low speeds.

No traffic shaping is setup. Thanks for the input.

...I seem to be capped at 1g (950mbs)...

Been following this thread and I'm surprised this didn't come up yet:

Did you set up traffic shaping for 1Gb way back when and forgot to adjust it for the 2Gbps plan ?

Got it, thanks for the clarification.

>>My use of OPNSense is actually *above* the M470, using the exact same modules and fibre leads.

Can you expand on this? Do you mean *above* physically in the picture?

Thanks for the input.

No, I mean above the watchguard as in the M470 is downstream of multiple OPNSense routers.

In my picture the 3 little black routers (R86S) all run OPNSense, One for each separate 10G leased line (MultiWAN with BT and Virgin in the M470) and the 3rd one at the bottom is for routing IPv6 as the WG is crap with IPv6.

Yes, #10 regarding the CPU speed? I tried an updated Xeon E3-1260LV5 CPU with no change. Or did I miss something in that post?

So, did you actually try the tips in the link I posted in #1?

So as a test I connected a 10g SFP+ module from my M470 to a Sodola 8 port switch using a SFP+ module, (both Cisco SFP-10g-SR modules) and then an RJ45 connection from a 2.5g port on the switch to the fiber ONT 10g RJ45 port. The Sodola switch has 8 2.5g rj45 ports and 1 SFP+ port. The download is still maxing out at 1g.

Any chance OpnSense is capping throughput at 1g? I've used OpnSense for years but this is the first time I've have more than 1g WAN throughput. Anyone else using OpnSense with > 1g WAN? Surely thousands are?

The 10g only RJ45 modules will be here tomorrow so I guess that's my next test.

Nice network rack!  I have a multi-WAN setup using 2 M470's. It's a homelab but I work from home so it's more business than homelab.

I have a 40g MMF link via the Brocade 7450-24p switch to my server rack in another part of the house so I can have multiple 10g streams between my office workstations and servers and the server rack. I also have a 10g switch on my desk to connect 10g workstation and any servers that I'm provisioning.

I ordered a 10g only RJ45 module from Amazon. I'm hoping that will take care of it but I have the FS module bookmarked as a backup.

>>My use of OPNSense is actually *above* the M470, using the exact same modules and fibre leads.

Can you expand on this? Do you mean *above* physically in the picture?

Thanks for the input.

Does this module look like the same part as yours?

It is indeed that exact module that I use.....
I use MMF Fibre between the Firebox and my 10G Unifi switches. 
My use of OPNSense is actually *above* the M470, using the exact same modules and fibre leads.

Dont know if this will work, but here is a picture:
https://ibb.co/B5m6xxHG
If that doesnt work try this:
https://postimg.cc/wyc7sZJH

Thanks, that is actually really helpful. It's good to know it's capable, I just need to get all the details right.

So the M470 running the Firmware 12.11.4 Watchguard software?

Does this module look like the same part as yours?

Not that this helps you much, but I also have a Watchguard M470 with a 4 port SFP+ module and I'm using it as designed, so its running Fireware 12.11.4.

It's easily pushing 5Gbps through the SFP+ without a sweat, and I use the Cisco SFP-10G-SR Compatible 10GBASE-SR SFP+ 850nm 300m DOM Duplex LC/UPC MMF Optical Transceiver Module from FS.com.

So the device itself is capable of those speeds.

Just upgraded my M470 to the Xeon E3-1260L V5 and got the same results. CPU usage was less than 25% on the G4400 and about 19% on the 1260L during the
speed test.

Interesting. I have a Intel Xeon E3-1260L v5 that I could try with it. Roughly 30% faster than the N100.

The M470 is rated at 450 users and 19.6G throughput but it's worth a try. Watchguard M470

It's also worth noting that the download is consistent around 950Mbs or the 1g limit.

I have a Watchguard M470 with a 4 port SFP+ module running OpnSense 25.7.6 and it's been running great for more than a year but I recently upgraded to 2g fiber (was 1g before) and I'm capped at 1g.

I'm able to connect from a PC with a 2.5g NIC to the fiber ONT and get 2.1+g download/upload speeds but connecting from my SFP+ port on the M470 to the ONT I seem to be capped at 1g (950mbs).

I have the interface speed set to 10G-BASE-SR and ifconfig from the opnsense shell shows 10Gbase-SR.

I'm using a 10GTek ASF-10G2-T optic to connect from the M470 SFP+ port to the 10g RJ-45 port on the ONT through a 12in CAT7 cable. The 10gTek does allow 1g/2.5/5/10g connections but everything seems to be linked at 10g.

I checked my PC to switch link speed and it's 10g full-duplex. What else can I look for?

Here is the ifconfig from OpnSense shell:

ix3: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500 description: WAN (opt2) options=4803828<VLAN_MTU,JUMBO_MTU,WOL_UCAST,WOL_MCAST,WOL_MAGIC,HWSTATS,MEXTPG> inet 38.xx.xx.xx netmask 0xffffff00 broadcast 38..xx.xx.255 media: Ethernet autoselect (10Gbase-SR <full-duplex,rxpause,txpause>) status: active nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>