2

Last week we had to replace our PFSense firewall because it had a catastrophic hardware failure. All but one of the NICs were taken out of the old server and put into the new one. The one NIC that was not moved was the LAN NIC as this is on-board. The other NICs are all WAN connections and the must all be present (i.e. I can't disable one just for the sake of testing)

After re-installing PFSense and restoring our backup of the configuration, everything came back online just fine, however on the new hardware any download that takes longer than about 10 seconds just times out in the middle.

Example 1: Downloading from Microsoft.com goes at about 900k/sec and times out after about 10 seconds (thus, just under 10Mb of content)

Example 2: Downloading from cnet.com goes at about 300k/sec and times out after about 10 seconds (thus, about 3Mb of content).

By times out, I mean that the download just stops, and you have to pause/resume to get the next part done, repeat and rinse until the download is complete.

However it's not consistant, sometimes it's 10 seconds, sometimes it's 4 seconds, and it sometimes you can't even load a heavy HTML page because the page never finishes.

I assume this is most likely because PFSense does not like the onboard NIC, as this is the primary difference between the two servers. It's recognised as NFE0, and there's no room in the server for any more NICs and I don't have any dual-port NICs handy to experiment with a different LAN connection.

I've never had to troubleshoot this sort of issue before. Can anyone give me some pointers about where to start? BSD/*nix is not my forte so please be kind!

update

As per Josh's suggestion, I tried downloading a 500Mb file using links on the box itself, and it failed after 20 seconds (and 5.7Mb).

6
  • What kind of NIC/motherboard is it? Realtek NICs can be troublesome on *BSD.
    – gravyface
    Apr 15, 2010 at 23:54
  • @gravy - The WAN cards are all Realtek 8169's and the LAN appears to be some nForce NIC. The WANs (Realteks) were pulled directly from the old firewall, which did not have this issue (could be an incompatibility I guess). The motherboard is an Asus, but that's all the information I have on it. Apr 16, 2010 at 0:02
  • I've dug up some old Realtek NICs. I can't take the system offline during business hours (some functionality is better than none), I'll swap them over if I can't get this resolved today. Apr 16, 2010 at 0:15
  • It might be worth while trying another NIC for the LAN just to see if it makes a difference. I've only used nForce on Windows and must say that I'm quite unimpressed with them. Apr 16, 2010 at 0:19
  • 3
    Do yourself a favor and get some server-grade Intel NICs. Well worth the money.
    – gravyface
    Apr 16, 2010 at 0:23

4 Answers 4

2

Going with what Josh said, only one NIC should come into question when you're running links locally from the pfSense box.

Are you sure that the Realtek 8169s are assigned to your WAN interfaces? If you hit up the console and drop to a shell you can run ifconfig to be sure (the Realtek NICs should be re0 re1, etc.).

2
  • Yep, the Realteks are definately the WAN interfaces. I'm going to try changing the default gateway to push the traffic over one of the other WAN links, see if that makes any difference. Apr 16, 2010 at 0:24
  • 1
    Giving you the accepted answer, but note it's because of your comment regarding crappy Realtek NICs. They worked fine on the old hardware, but seemed to have some compatibility issues on the new motherboard. Swapped them for some netgear cards I was able to source and hey presto :) Apr 23, 2010 at 5:25
3

Try disabling checksum offloading under System > Advanced. That functionality on your NIC may be broken, or the driver may not work properly with it on that NIC for some reason. That would be my first guess, given the NIC change, and the fact that you aren't exactly using the best NICs on earth.

Another problem with similar symptoms could be some sort of path MTU issue. If you're black holing large frames, that's the kind of thing you'll see at times. The only time I would suspect that with only a NIC change would be if you're using VLANs and the hardware doesn't properly handle long frames for the 802.1q tags. Doesn't sound like you're using VLANs.

1
  • No, no vlans. Straight forward setup. I'll try the TCP Checksub offloading now. Apr 16, 2010 at 6:49
1

If you download the files directly on the PFSense box, what happens? You can test this by SSHing into the box, getting a shell (Normally 8 in the menu) and running:

links http://url.of.some/content

If that works without error, it's probably an issue with the LAN. Otherwise it is most likely an issue with the WAN.

Also, the Status > System logs or Status > Traffic Graph sections of the web admin might help.

1
  • Thanks for the tip. Unfortunately the same issue occured after 20 seconds when using links over ssh. Maybe it's not the LAN after all... Apr 15, 2010 at 23:23
0

I had the same issue with "device polling" enabled. Make sure it's not active. (In System > Advanced > Networking)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .