LAN vs WAN speed differences

[Raptcha]

Hello,

I have a 1gbps (~940mbps) internet connection. I am testing zenarmor on my OPNSense installation and I see a lot of difference in speedtest between running zenarmor on LAN vs WAN. WAN is almost always faster (Almost the full speed). In LAN, I only get about 550mbps.
What are differences of running it on WAN vs LAN interfaces?

[athurdent]

Are your interfaces compatible with Netmap?
Is your LAN interface a different model than your WAN interface perhaps?

[Raptcha]

They are both Realtek 8111H 1GbE ports. I believe they are compatible with netmap. I have tried both netmap native and netmap emulated. They are mostly the same results.

[sy]

Hi,

Have you installed the os-realtek plugin? Could you please provide the specifications for your CPU and RAM?

[Raptcha]

Thank you for responding. Yes I have already installed the realtek plugin. Without it, the connection keeps dropping for me.

Sure, I am running OPNSense on a Zimaboard 432 with Intel Celeron N3450 Quad Core (1.1 GHz Base and 2.2GHz Boost), 4GB LPDDR4 RAM, 32GB eMMC Storage. I'm using local Mongo DB as the reporting backend for Zenarmor

https://shop.zimaboard.com/products/zimaboard-single-board-server?variant=39283928432838

[Raptcha]

Even though the LAN speeds are almost half my real internet speed, the Zenarmor policies only work on this. Some of the blocks I have added in the policies section works if I'm running Zenarmor on WAN.

[sy]

Hi,

The performance of a CPU's single core is crucial in determining the throughput that Zenarmor can handle. To ensure compatibility, please refer to the hardware requirements for information on throughput and user size.

For Zenarmor to handle a throughput of 1Gbps, it is recommended to have a single-thread rating of approximately 1500.
For more details, you can visit the following link: [Hardware Requirements](https://www.zenarmor.com/docs/introduction/hardware-requirements)

However, the current single-thread score of the Celeron CPU is relatively low.

To check the single-thread score of the current Celeron CPU, you can refer to this link: [Celeron CPU Score](https://www.cpubenchmark.net/cpu.php?cpu=Intel+Celeron+N3450+%40+1.10GHz&id=2907)

[Raptcha]

Hey @sy,

In WAN interface, I get full upload speed and half download speed and none of the policies work. Should I not be running zenarmor on WAN?

[sy]

Hi,

The best practise is to protect the LAN interface on Zenarmor and the WAN interface on Suricata.

[Raptcha]

What does protecting the WAN interface do?
I ask because I thought protecting WAN would be the right way to filter incoming traffic through Zenarmor (To block sites, ads etc) but it turns out I need to be protecting LAN to do that.

[sy]

Hi,

Your incoming traffic will also inspect when routed the destination host on yor network if you protect all inner interface. But you can filter the WAN interface on Suricata or use Zenarmor in bridge mode.