WAN speed issue - 19.1 on XCP 7.5

[jcdick1]

I am experiencing a WAN speed issue that I'm hoping someone more knowledgeable than I can help diagnose.

I'm running OPNsense 19.1 in a VM on XCP 7.5 over AT&T gigabit fiber, which means I have the required AT&T box (required, as it acts as the filter for unsubscribed services on the same line) set for "passthrough" to have the router VM get the public IP.  That part works fine, and my two port forwards work.  The hypervisor host physical interface is connected to a switch, in a three-port VLAN, to allow the OPNsense VM to be migrated to another host without downtime.  However, I have taken the switch out of the equation for testing, with no change.

If I run an iperf test between LAN clients and the router, I get the expected line speed of ~1000Mb/s.  If I run the speed test that is built into the AT&T box, I get the expected ~900Mb/s both up and down.  If I run an iperf test from the router to a public iperf server, or run a generic web-based speed test from a LAN client, it gets ~40Mb/s down and 100Mb/s up.  Something between the router and the AT&T box is bogging down, but I don't know how to diagnose that segment.

When I first got my AT&T connection, the full speed was available, but I don't remember if the slowdown coincided with an upgrade on the OPNsense or the XCP.

My physical link LED says the link is 1000Mb/s.  I've disabled offload and set the NIC type in the router VM to e1000 instead of the RTL819 that is default, based on googling.  I've got the xen-tools plugin loaded and XCPCenter confirms the use of the paravirtualized drivers.  I don't know for sure what the link speed is for the virtual interface, as ifconfig in OPNsense only says "ethernet manual" for media, and there's no ethtool that might otherwise tell me.

Anyone have an idea what my issue might be and how I might go about diagnosing and resolving the issue?  Any help would be greatly appreciated.

[Steven]

Are you running 19.1 or 19.1.1? There was a hotfix in 19.1.1 that addressed some MTU issues that caused slowdowns because certain ISPs were requesting improper MTU sizes.

[jcdick1]

OPNsense 19.1.1-amd64

[lewi3069]

Issue with latest firmware and DMZ+ (Fake Pass-through). Friend of mine just had this issue. Took us a while to come across this issue as we just did a new unifi AP deployment and thought it was related to that.

https://forums.att.com/t5/AT-T-Fiber-Equipment/PACE-11-1-0-531418-DMZ-Issue/m-p/5745153#M7940