Messages

Hast du beide Kontrollboxen angehakt?

This switch looks very promising and is about the same price range: https://mikrotik.com/product/crs310_8g_2s_in

But I can't guarantee it will solve all the problems. You could connect the X540 with DAC.

My best bet would be that it is the switch:

https://community.zyxel.com/en/discussion/14072/xgs1250-12-very-slow

https://community.zyxel.com/en/discussion/10854/xgs1250-12-very-very-very-slow

Also I assume the X540 not being able to negotiate down to 2.5G could be a problem by overwhelming the switch from converting 10G to 2.5G.

Yes, their own forum of course: https://www.simplemachines.org/community/

Danke für die Erläuterung, für einen Nicht-PPPoE-Experten kennst du dich aber gut aus. ;D

Is discourse expensive for commercial use?

It doesn't cost anything for commercial use, they earn their money with hosting and support.

But I don't like the style of discourse, it's like made for ADHD people, just a narrow wall of text for endless vertical scrolling (obviously optimized for smartphones).

SMF is much nicer on a wide monitor (while there's still a alot of space on the sides). But version 2.1 claims to have smartphone support:

Detection of mobile devices

https://wiki.simplemachines.org/smf/Differences_between_SMF_2.1_and_SMF_2.0

And I think discourse doesn't fit to OPNsense because it is Linux-based.

https://meta.discourse.org/t/discourse-doesnt-work-on-freebsd/30253

The only thing I miss on SMF are browser push notifications but that requires 3rd party software which the developers don't like for security reasons.

We try not to depend on anything involving third parties, with the exception of PayPal, it is unlikely that we willimplement anything as a core feature which requires a third party interface

https://www.simplemachines.org/community/index.php?topic=560226.0

Maybe upgrading SMF from 2.0.19 to 2.1.4 would be enough modernization.

A secure forum software for a secure firewall.

Etwas off-topic aber ist es nicht unlogisch, dass PPPoE in der Interface-Konfiguration ein Unterpunkt von IPv4 ist aber nicht von IPv6?

Laut OSI-Modell ist PPPoE auf Schicht 2 und IPv4/IPv6 auf Schicht 3.

Ist das "Use IPv4 connectivity" also quasi ein Hack um IPv6 auch über PPPoE verwenden zu können wie hier beschrieben?

https://forum.opnsense.org/index.php?topic=26754.0

Hatten wir erst vor kurzem: https://forum.opnsense.org/index.php?topic=34974

Verwendest du auch einen Yubikey?

Ist das eigentlich eine VDSL- oder eine Glasfaserleitung?

In einigen Foren steht man braucht für ersteres einen 'H'-Präfix vor dem Benutzernamen.

https://www.lancom-forum.de/fragen-zur-lancom-systems-routern-und-gateways-f41/1-1-zugangskennung-benutzername-bei-adsl-vdsl-pppo-t10408.html

Und auch hier hat der Benutzer bei einer Glasfaserleitung ein 'H'-Präfix:

https://forum.opnsense.org/index.php?topic=28216.0

Aber mit DS-Lite hast du ja gar keine IPv4, die Einwahl kann doch dann eigentlich nicht funktionieren. Bei IPv4 müsste dann eigentlich auch DHCP stehen, damit er die IP von CGNAT zugewiesen bekommt?

Bei diesem Benutzer ging PPPoE über IPv4 auch erst als er ein richtiges Dual Stack hatte.

https://forum.opnsense.org/index.php?topic=22193.0

According to the output both Mellanox ports run as full-duplex, so this can't be the issue.

But it's strange that the ports run as 10GBASE-CX4, which is an old standard with SFF-8470 connector.
Maybe that's just the transceiver. Which SFP+-RJ45 transceivers are you using? Maybe they're the problem

Hi legoingschenoer,

That sounds like the Mellanox NIC is running in half-duplex, i.e. the 10 GBit/s are shared among send and receive.

What does "ifconfig -a" say?

I don't have experience with the E810 adapters.

But there was a similar question on the Intel forum:

https://community.intel.com/t5/Ethernet-Products/E810-does-is-support-breakout-cables/m-p/1463312

Although it is about a single port adapter. They referred to a Feature Support Matrix which shows "Table 2. Media Types Supported for the E810" that mentions "QSFP28 Direct Attach Copper breakout cables" under "25 GbE Media Supported".

(— "X" = Supported with Intel® NVM and software driver. — "SNV" = Supported but Not Validated)

In my research I found these two models:

E810-CQDA2:
https://ark.intel.com/content/www/us/en/ark/products/192558/intel-ethernet-network-adapter-e810cqda2.html

E810-2CQDA2
https://ark.intel.com/content/www/us/en/ark/products/210969/intel-ethernet-network-adapter-e8102cqda2.html

According to the product brief the first one (E810-CQDA2) can only do 100 GBit/s at a time but the second one (E810-2CQDA2) can do 200 GBit/s.

The E810-CQDA2 has eight MACs (Media Access Controller) that can be setup in different port configurations.

Total throughput of the adapter is 100GbE for all configurations.

https://www.intel.com/content/www/us/en/support/articles/000093702/ethernet-products/800-series-network-adapters-up-to-100gbe.html

So you need:

• 1x Intel E810-2CQDA2
• 2x Intel XXV4DACBL1M - QSFP28 to 4x SFP28 breakout cable, 1 m, or similar
• 2x Intel XXV4DACBL2M - QSFP28 to 4x SFP28 breakout cable, 2 m (alternative), or similar
• 1x mainboard that supports PCIe 4.0 x16

According to this page the ice driver is supported since OPNsense 22.7:

https://www.thomas-krenn.com/de/wiki/OPNsense_Netzwerkkarten-Treiber

(correction: It is already supported since 21.7: https://forum.opnsense.org/index.php?topic=24302)

But to ultimately verify that it works you probably have to test it yourself, it's only about 1,400 EUR / $1,500. :D

There is also important information in this thread:

This adapter is essentially 2 adapters on a single board.. For the card to work fully, it needs to be in a x16 physical slot that is bifurcated into 2 x8 slots electrically.

This will then show as 2 adapters to the system and there will be 1 port for each. If the slot in the system is not capable of bifurcation, it will only see half of the card and only 1 port will work.

https://community.intel.com/t5/Ethernet-Products/When-enable-Intel-E810-2CQDA2-to-50G-2-mode-only-one-port-can-up/m-p/1465333

So you need a mainboard that not only has 16 PCIe 4.0 lanes but can also bifurcate the port in 2x x8 ports.

The cheapest replacement board probably is the Biostar B450NH with the cheapest boxed AM4 socket CPU AMD Ryzen 5 4500.

That's ~160 EUR.

Hattest du schon mal probiert den Speedport direkt an WAN anzuschließen anstatt über den Switch?

In den Tutorials ist die Firewall bei den Bridge-Ports immer angehakt und ausgegraut (bedeutet wohl dass sie generell aus ist).

Die Proxmox-Wiki sagt: "The firewall is completely disabled by default, so you need to set the enable option here".

Hast du diese vielleicht global aktiviert?

Mir ist noch aufgefallen, dass deine fixe LAN-IP im LAN DHCP-Bereich liegt. Setze diesen mal auf 192.168.115.100-192.168.115.199. Oder der Screenshot ist rechts abgeschnitten.