Topics

1

22.7 Legacy Series / Possible PF Software Bug Causing Slowness [Solved, Lower the ARP Expiration]

« on: January 02, 2023, 01:15:42 am »

Hello All,

After a couple days of testing, I think there may be a software issue with PF. I've tried various configurations over a couple different hardware setups and keep experiencing the exact same issue. Full details below.

I currently have a fiber link of 1gbit up/1gbit down. Connecting directly to the fiber modem without going through the firewall, my speed tests run 950mbit up and 950mbit down. I have run the tests multiple times over a period of an hour to verify there's no deviation in that speed when connected directly to the modem.

Now, I have built a couple firewalls during my tests:
1) Intel Xeon E3-1220 v3 @ 3.10GHz, 250GB Samsung SSD, 8GB ram, 2x Intel CT Desktop NICs (Intel EXPI9301CTBLK)
2) Virtual Machine, AMD Ryzen 5950x. Assigned 8 threads to the HyperV VM. 128gb HD on 4x raid 10 SSDs. 8gb ram. Intel NICs

On both machines, I have the exact same experience:
1) I power up the firewall
2) I do a speedtest. The speedtests are 950mbit up/down like they are when directly plugged in
3) I watch some YouTube videos for about 5 minutes.
4) I do another speedtest. The speedtests are 600-700mbit down and only 60mbit up.
5) I reboot
6) Speedtest returns back to normal

I have performed the speedtests using a Windows 10 Machine and also a Windows Server 2019 machine. I have plugged the Ethernet cables directly from the test machines directly into the firewall LAN port (no middle switches).

Additionally, I have also tried installing pfsense on the same machines to see if it was something to do with opnsense. I experienced the exact same issue. Speed drops after the firewall has been online for a few minutes.

The performance seems to deviate. Occasionally it will come back up to the 950mbit, but the majority of the time the speed is slower. The upload rate is the primary issue. It is always below 100mbit for some reason.

I have tried enabling RSS in the tuneables. That did not help. I tried disabling Spectre and Meltdown mitigations. Disabling the meltdown mitigations for some reason causes it to run slower on the Xeon processor - Download never goes above 600mbit, but the upload seems to be a little faster than 60mbit when it goes into slow down mode.

I've tried enabling and disabling the "Hardware CRC", "Hardware TSO", "Hardware LRO" in the interface settings. I tried enabling/disabling interface scrubbing.

When performing speedtests, I watch the opnsense interface statistics to make sure the speeds match what the speedtests shows. They are very close to each other. This shows that there's no background activity occurring other than the speedtest.

Since I have this issue with opnsense and pfsense, the only thing that makes sense to me is an issue with PF. Anyone have a similar issue?

2

21.7 Legacy Series / Weird firewall logs

« on: November 07, 2021, 09:54:40 am »

Just set up a new install of opnsense and the firewall logs seem strange.

My computer is connected to the firewall and has received an ip of 10.0.1.10. The firewall is 10.0.1.1.

When my computer goes to a website, the firewall does not show any activity on the LAN. It just shows several WAN interface entries and the source is my public IP address. It's not showing any traffic for LAN nor from the 10.0.1.10 ip address.

If I filter to show only LAN traffic, it's completely empty. I can't see any traffic originating from the LAN. However, my computer is sending traffic just fine.

Been running opnsense for several years and this is the first time I've been unable to see my LAN traffic. Any idea what could be the issue with my configuration?

3

18.7 Legacy Series / SMB Errors When Traversing opnsense

« on: December 12, 2018, 12:12:58 am »

I've recently migrated a firewall from pfSense to opnSense.  However, I've been experiencing issues with filesharing even though the same firewall rules are in place.  The connection seems to occur, but I get a "system error 53" and the connection resets when attempting to connect to the fileshare.

The issue seems to occur only when the client computer that is connected to a domain attempts to connect to a server which is not domained.

I basically have a virtual firewall that has segmented a web server outside our domain (DMZ).  We make updates to the server via SMB/file explorer.

Computers that are NOT on a domain can connect to the shares just fine.  A prompt for user/pass is shown and a connection is made.  Computers that ARE on a domain just throw a system 53 error.  This doesn't occur on the pfSense box with basically the same configuration.  Everything is default except the firewall rules and port forwarding to the web server ip.

I have provided screens of the firewall rules here https://imgur.com/a/pDbkGP6.

All other protocols seem to work fine except SMB.  HTTP/HTTPS/DNS/SSH/ORACLE/MYSQL all connect and authenticate successfully.

Few things I tried:

• Ensure local group policy is set to "Digitally sign communications (always)" to match the group policy setting of the domain https://blogs.technet.microsoft.com/josebda/2010/12/01/the-basics-of-smb-signing-covering-both-smb1-and-smb2/"
• Allow everything

I have restored the pfsense vm for now and file shares are working again, but it seems strange that the same settings dont work on opnsense.

I have a few other opnsense machines that are working fine, but they aren't operating under a scenario similar to this.

Any ideas?

4

18.7 Legacy Series / Resuming OPNSense VM from Sleep Breaks Networking

« on: November 01, 2018, 07:14:37 pm »

I run OPNSense inside of a virtual machine and use it as my primary gateway on the host.  If the host goes to sleep, once it wakes up, OPNSense no longer routes packets until either "The virtual machine is put to sleep on the host and then resumed" or "The virtual machine is fully rebooted".  It's worth noting that you can still access the web interface just fine, but network functionality does not work.  I usually put the VM back to sleep and then resume.  However, sometimes this does not work and I have to do a full reboot by logging into the web interface and initiating a power->restart.

Attempting to make this relate to other users, consider the following scenario:
1) Power is lost
2) UPS system puts the server to sleep when battery gets low
3) Power returns and server is restored, however, networking does not function because it is restoring from sleep state and you will need to manually initiate a reboot/sleep-resume

I've tested both Virtualbox and Hyper-V and they both seem to have the same issue - at least with my setup.  Happy to provide any additional info requested.

Thanks.