So I compiled and installed the rt2860 driver using some of the helpful notes here from CIA http://forum.pfsense.org/index.php/topic,26410.msg137469.html

But the performance on this card is terrible... I'm not getting any errors but my data rate on the lan is 17m/4m on the wifi it's .4m/.2m

I'm not really seeing any errors in the syslog that give me any kind of hint about what is wrong. Is this just a poor wifi driver or what? What can I do to try to debug this and get this card working?

Is it possible to make a rule like this?

If incoming host network is 1.0.0.0/8 port 10 then accept and pass to 192.168.1.1
If incoming host network is not 1.0.0.0/8 port 10 then accept and pass to 192.168.1.2

I can't seem to figure it out.

Not off hand at the moment but this may be possible soon. I'll repost here if I ever swap the box out.

It is a MI424-WR, but I don't need to bridge it, I asked the tech not to use MoCA and went with Cat5 from the ONT.

Hmm well maybe FreeBSD is having a problem with the nics or something that Linux does not have and that slow is down? I'm not really sure, I looked at the dmesg and interfaces and did not see any errors.

I got bad news. Smoothwall on the same hardware does not have the same problem. It runs at full speed. This sucks because I really like the features in pfSense.

I'll put it back on to debug it if you like. I just need to know what data to collect from it.

Curious - what version of FreeBSD was running in the Smoothwall version?

gm...

None: Linux smoothwall 2.6.16.53 #1 Thu Aug 16 12:34:52 BST 2007 i686 GNU/Linux

I got bad news. Smoothwall on the same hardware does not have the same problem. It runs at full speed. This sucks because I really like the features in pfSense.

I'll put it back on to debug it if you like. I just need to know what data to collect from it.

Identical results with Realtek 8139 and ADMTEK AN985 nic's. I didn't think it would be hardware because wouldn't the hardware cap at the same rate in both directions if that was its max?

Tested with configured and unconfigured clients. Speed is totally horrible 1/3 what it should be.

Hmm, I'm officially stumped.

Reinstall is not necessary. I can comment out the lines and go back to default, if I like.

Default is
net.inet.tcp.recvspace=65228
net.inet.tcp.sendspace=65228

Client is configured identically.

The machine is a k7 700m with 512m in ram and 3com 3c905 cards. (Verizons router is 533m with 32m in ram, not bad.)

Maybe I'll swap out the nic's and see if I cant get better performance.

Hi all, I've upgraded my DSL to a FTTP connection (Verizon)

I have the 15m/2m package.

However pfSense seems to preform very slowly with it. My speed tests using pfSense is around 3m/768k. Now when I use the ghetto Verizon router I get around full speed (13m/1.5m est.)

I've modified several sysctl settings to configure it to values either verizon recommends or dslreports users recommend.

MTU is 1492

I have now set in /etc/sysctl.conf
kern.ipc.maxsockbuf=653400
net.inet.tcp.recvspace=522720
net.inet.tcp.sendspace=130680
net.inet.tcp.rfc1323=1

and set kern.ipc.nmbclusters="16384" in /boot/loader.conf

This should be correct for my speed.

http://www.speedguide.net/analyzer.php reports

Code:

« SpeedGuide.net TCP Analyzer Results »
Tested on: 10.12.2007 23:31
IP address: 71.164.xx.xxx
 
TCP options string: 020405ac0103030401010402
MSS: 1452
MTU: 1492
TCP Window: 1045440 (multiple of MSS)
RWIN Scaling: 4
Unscaled RWIN : 65340
Reccomended RWINs: 63888, 127776, 255552, 511104
BDP limit (200ms): 41818kbps (5227KBytes/s)
BDP limit (500ms): 16727kbps (2091KBytes/s)
MTU Discovery: ON
TTL: 47
Timestamps: OFF
SACKs: ON
IP ToS: 00000000 (0)

I'm still not seeing the speed I should be though.. hmm ??

How do I set the Unscaled RWIN value?

I think I'm getting this too. I get HUGE packet loss on the line behind their modem. Currently its setup so that pfSense is the DMZ system, so it NAT's all packets to the pfSense system. The performance is horrible.

It seems to run fine for awhile then eventually (6 hours) will start to drop packets. Also the states are very high so it must not be expiring connections ??

I'll try going into PPPoE mode.. if I can find it on that stupid Verizon Modem..

I could most likely get something working on my own and eventually I might.. but right now, I just don't have the time, so I am willing to pay someone to do it.

Posting $50 bounty for someone that can create a plug-in that will automatically download black lists from dshield.org and blocklists.org
Plug-in should have the ability to select various lists that you want to add and an update frequency.

I believe the blocklists.org lists are actually created by bluetack.co.uk and they include a dshield list. It would be extra cool if the plug-in submitted the firewall logs back to dshield but that's not a requirement for this bounty. (is now $50 for this part) Another neat concept would be the ability to use GeoIP and block IP's by country, however that is also not part of this bounty. Just get the lists auto updating and blocking, that's it.

Edit: Updated total for subject line. Added strike the above.