SOLVED (sort of):TP-Link IoT Network and OPNsense not working together

[GentlemanJimStacey]

EDIT: SOLVED. Issue 1 I ended up solving on my own (sort of - I just used an old router as my IoT network instead). I'm going to create a new thread for issue 2.

Forgive me, for I am a noob with OPNsense firewalls (or firewalls in general, other than simple things like port forwarding, etc.)
I have two TP-Link Deco XE75s as my WiFi Access Points, but connected to a switch that is connected to the OPNsense Firewall machine.

Essentially it goes Internet -> OPNsense Firewall/Router -> Switch -> Switch -> TP-Link Deco

Oh, my firewall is using Realtek RTL8125B nics, which I know are not the best, but they work reasonably well for my network, aside from this issue that I've recently discovered. (And they explode when IDS/IPS is enabled.

Issue 1:
I noticed what I feel like is a bug / incompatibility between OPNSense and the TP-Link Deco IoT Network. Essentially, my TP-Link Deco app can create three networks: Home network, Guest network, and IoT network.
I have my home network at 192.168.0.1/24. The TP-Link Deco creates a "separate" network, although it receives IP addresses from the DHCP server on the OPNsense router. So my desktop could be 192.168.0.12, and a device on the IoT network could be 192.168.0.110, etc.

What I noticed is that, specifically with ethernet devices such as my desktop PC, if I have the IoT network enabled in the Deco app, my desktop computer with ethernet, works properly until it goes to sleep. Once it wakes up, it no longer connects to the internet or anything on the local network, and eventually shows as "Not Connected".
Oh, I should note that all wireless devices continue to work just fine - because of this, I use my phone to perform step number 1 below, as my desktop no longer connects to the network.

There are two ways to temporarily fix it (but it dies again every time I let my PC go to sleep and wake it)
1. reboot the router, or
2. disable the IoT network in the Deco app. If I turn on my PC and it's not working, I disable the IoT network, and after 30 seconds or so, my desktop resumes normal function.

Naturally, I'd prefer not to have to do either one of these things EVERY time I wake my PC from sleep, and I'd like to keep the IoT network functional.

Issue 2:
For some reason, Google specific apps are incredibly slow (Google Play store is literally a snails pace, until I disconnect from WiFi, and YouTube is suuuper slow too) - on all devices in my network, both wired and wireless.

[cookiemonster]

There are a few problems to unwrap.
For starters, if your Wifi access points have multiple SSDs but all have the router giving the DHCP leases, it will be expected behaviour that the clients they all get an IP from the same pool.
If the mesh was doing router duties then it would create a different network for each SSD and route/notroute between them. Most have a setting that decides if they are to be separated.
So if you wanted to them to be separated, you'd need to do that in OPN. For that you need different interfaces to the switch or VLANs.

Next is the ethernet devices not re-establishing the network connection after waking up. You'll need to find some clues in logs to narrow down. Maybe the AP is still having a DHCP server enabled. You need to have only one running.

[GentlemanJimStacey]

I ended up going a different route for my initial main issue. I basically just found an old router and am using that as my "IoT" network, and have disabled the feature on my Deco App, since it was causing more issues than it was worth.
However, there are two issues remaining:

Issue 1:
As mentioned in my first message, for some reason, Google specific apps are incredibly slow (Google Play store on my Android phone is literally a snails pace, until I disconnect from WiFi, and YouTube is suuuper slow too)

New Issue 2:
I'm wondering how I can block the access from my "IoT" network to the web GUI of OPNsense? I've tried creating an alias, and a firewall rule to block all incoming traffic from the IP that is assigned to the IoT router (the alias / source), to "This Firewall" as my destination, but that doesn't seem to work properly.

[cookiemonster]

sorry too many variables for me to even venture a guess. Maybe if you share your network topology we might be able to spot what might be good to check. Especially when now there are two routers in the network.

[GentlemanJimStacey]

Yeah, sure!

Network is set up as follows:
(-> is wired, --- is wireless)
Internet -> OPNsense -> mainSwitch -> basementSwitch -> oldRouter --- IoT Wifi Devices

From my main switch, I also branch off, like so: mainSwitch -> upstairsSwitch -> my desktop, Mac work machine, laptop

YouTube, and Google Play Store are slow on all devices I've used, but the Apple App Store works fine.

[cookiemonster]

OK. Assuming there are no double nat, multiple services running on both routers, etc. in short not two routers duplicating services, leaves you to diagnose hardware. Wires loose, negotiating at wrong speed/half duplex, that short of problem.
If it was OPN, I expect to be an all or nothing situation with those services.
What I'd be tempted to do is to plug an eth device on the old router if possible and do iperf tests between it and main switch and even to OPN. Actually iperf from OPN to main switch then next between OPN and basement switch, then to old router should give you a baseline of speeds along the chain. Then if all good, you can focus on Wifi part.

[GentlemanJimStacey]

Hmm. Well so the issue isn't coming from my old router. The connection between my old router and my IoT devices works perfectly fine, so that issue is more or less resolved.

The "Issue 1" I subsequently mentioned was the weirdness of Google Play Store and YouTube not working properly (i.e. loading suuuper slowly) on my network. But what's weird is that everything else works fine on my network. Apple devices download from their app store just fine, I can download from Steam on my desktop perfectly fine (like 100+ MBps) but all devices struggle to load YouTube, including hardwired ones. It does eventually start to more or less work, but does take a few minutes of "lagginess" to figure itself out. And of course, my Google Play Store is just always slow (I'm talking like the 50 Kbps range) on Wifi. But my phone get likes 300+ Mbps in SpeedTest, and my internet service from my ISP is 1 Gbps, so I don't have any speed issues.

The reason I believe it's "something" to do with my OPNsense box - whether that's hardware, software bugs, or configuration, is because it worked perfectly with my old router. When I switched to my OPNsense box, I started to notice these behaviors.

[GentlemanJimStacey]

Not sure if this is "allowed", but I haven't gotten a solution to my YouTube and Google Play Store slowness issue yet, even though absolutely everything else works perfectly fine. So I guess... bump? Lol

[doktornotor]

What's the point of the oldRouter? Is it routing? Or is it bridged (as it should be) and only used as an access point? VLAN there or not? Static routes set for the IoT network?

[GentlemanJimStacey]

The "old router" is just for my IoT network. it does DHCP and NAT inside of my current network, but for it's own network. So essentially, inside my main network, I've got my old router plugged in with the WAN port, so it gets an IP address from the OPNSense DHCP server and treats that IP address as it's WAN IP for it's network, and does NAT to translate between that IP and it's own "internal" network.

Regardless, that's not what is causing the YouTube and Google slowness issue I'm encountering, as YouTube and Google were performing poorly as soon as I switched my network to my OPNSense box, rather than having my entire network go through my previous router. I'm wanting to determine why OPNSense is causing slowness with ONLY those things - YouTube, and Google Play Store. What a random group of web applications to have problems with.

[doktornotor]

I'd suggest to start a new thread, this one is cluttered with completely irrelevant info and pretty much nothing usable for diagnosing the YT/Google issue.

[GentlemanJimStacey]

Yeah, I thought about doing that, but I saw in the forum rules that if a forum contains content you're searching for, to comment on that instead of creating a new one. However, you're right. The YT/Google issues are a side issue to my original question, which has been resolved. I'll go ahead and see what I can do about marking this as done.