Selfhosted

Have you checked all the ethernet links are actually connected at 1G and not 100M?

how can it be that my little mini J1900 Celeron (2 GHz) with 4 GB RAM cannot handle this bandwith?

Because it's ancient, and when it was new it was bottom-of-the-barrel.

The question is what you do with your pfsense. IDS/IPS are quite CPU hungry and Celerons are not really fast CPU’s.

So my first question is how can it be that my little mini J1900 Celeron (2 GHz) with 4 GB RAM cannot handle this bandwith?

• check ethtool for link speed: sudo ethtool enp2s0 | egrep 'Speed|Duplex' Your device name may be different from enp2s0. use ip link to see all devices. if it's not

Speed: 1000Mb/s
Duplex: Full

then that's probably a bad sign.

• that is a 10 year old celeron processor. celeron were the budget (a.k.a. cheapest, slowest) class processor at the time. it's quite likely that it cannot keep up.
• If you still think it's not CPU directly, use iotop to see if you have I/O bottleneck.

Something to look for besides bandwidth is actual packet routing throughput. It's possible you enabled a feature (ex. Deep packet inspection) that is limiting how many packets can be routed per second given the speed of your hardware.

That Pentum is a budget CPU from just over 10 years ago. It has PCIe 2.0. Maybe the "gigabit" ethernet is connected to the CPU by a single 500Mbit PCIe lane.

Is the laptop connected to 2.4 or 5 GHz Wirth WiFi? In my setup I never get more than 80 Mbit with 2.4 GHz.

Do yuo have IDP/IPS turned on on pfSense? My OPNsense on my 1Gbps fibre will easily drop from an average of 900Mbps down to around 300Mbps-500Mbps, if I turn on IDS.

By the way OP, similar but worse is the ability to handle 25Gbits. But someone made a working router for that as well and CPU was also a factor: https://michael.stapelberg.ch/posts/2022-04-23-fiber7-25gbit-upgrade/

Might be pfsense? My little J1900 box running Ubuntu Server gets 920Mbps.

Another piece of the puzzle is probably your WiFi router, as you normally won't get speeds near 1Gbps over WiFi. In order to benefit maximally from it, you need to connect your devices (laptops, stationary PC, TV, etc.) with a cable to get the most of it.

You should also try to disable some pfSense plugins, like OpenVPN, zenArmor, etc. as they will severely limit your bandwidth throughput. But as others said, most likely you will also need to upgrade your hardware box, and you can migrate to OPNsense while at it.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

5 acronyms in this thread; the most compressed thread commented on today has 11 acronyms.

[Thread #861 for this sub, first seen 9th Jul 2024, 21:35] [FAQ] [Full list] [Contact] [Source code]

I have been using similar hardware setups in A LOT of installations. This is mostly an issue with the pfSense hardware. There's a lot of decent options around $200, mostly focus on getting a modern CPU (if it supports AES-NI there's a good chance it will be fine). A lot of them have 2.5g nics these days too.

Sadly, sg300 line is also getting pretty old. In recent years I'm seeing more and more issues with them, especially in the models with poe. Sg350 is even eos now, with cbs350 being the current.

I'm also now using r610 as the absolute minimum ruckus ap. I was using r510 for a long time, but the r610 has noticable improvements.

For what it's worth, since it sounds like you will be hardware shopping soon: I am using a 2.4GHz Intel Atom C2758 running pfSense and get 2Gb/s down and around 1.5Gb/s up through it. I am using an add-on Intel-based PCIe network adapter, so I'm not sure if that is helping with the CPU load. But it works well.

I had to upgrade my pfsense hardware when I got fiber several years ago, which was in a similar situation as yours. The CPU just couldn't handle the connection table.

CPU and RAM are not the only limiting factors. Not only that but not everything runs multithreaded. Maybe some piece of the puzzle is not multithreaded and is using all it can from a single core (assuming that cpu is multi- core)

Depending on how much you value your time, you're almost certainly better off getting a new machine to run pfsense.

Maybe look into hardware offloading

What's your ram speed?

The process is to go step-by-step. First direct connect to modem you have, bridged connection if possible, and test with multiple bandwidth measurements (speedtest, fast.com, downloading a big file from some university ftp...) and work your way downstream of the network. And on every step test multiple scenarios where it's possible, preferably with multiple devices.

When I got a 1Gbit fiber connection few years back I got an Ubiquiti Edgerouter-X with PoE-options. On paper that should've been plenty for my network, but in theory with NAT, DNAT, firewall rules and things like that it capped on 6-700Mbps depending on what I used it for. With small packets and VPN it dropped even more. So now that thing acts as an glorified PoE switch and the main routing is handled with Mikrotik device, which on manufacturers tests should be able to push 7Gbps on optimal conditions. I only have 1/1Gbps, so there's plenty of room, but with very specific loads that thing still is still pushed to the limit (mostly small packet size with other stuff on top of it) but it can manage the full duplex 1000Base-T. And on normal everyday use it's running at 20% (or so) load, but I like the fact that it can manage even the more challenging scenarios.