I’m working on moving from pfSense to VyOS as I want to use DMVPN between a few sites. I’m currently trying to add my port forwards to VyOS, and I’m having a problem with the performance of a couple of Wordpress sites.
When I’m using pfSense, the sites each take about 3.3 seconds to load. When I switch to the VyOS router, they both take over 20 seconds to load. I did a speedtest from behind the firewall and I get over 300mbps (limited by the vCPU of the machine I’m doing the test from).
Any suggestions?
Here’s my configuration:
root@colo:~# cat vyos.conf
firewall {
all-ping enable
broadcast-ping enable
name OUTSIDE-IN {
default-action drop
rule 15 {
action accept
destination {
// address <wan-ip>
port 53
}
protocol tcp_udp
state {
new enable
}
}
rule 16 {
action accept
destination {
// address <wan-ip>
port 80
}
protocol tcp
state {
new enable
}
}
rule 17 {
action accept
destination {
// address <wan-ip>
port 443
}
protocol tcp
state {
new enable
}
}
// rule 18 {
// action drop
// state {
// invalid enable
// }
}
rule 20 {
action accept
state {
established enable
related enable
}
}
}
name OUTSIDE-LOCAL {
default-action drop
rule 19 {
action accept
icmp {
type-name echo-request
}
protocol icmp
state {
new enable
}
}
rule 20 {
action accept
state {
established enable
related enable
}
}
}
}
interfaces {
ethernet eth0 {
address <wan-ip/cidr>
description WAN
firewall {
in {
name OUTSIDE-IN
}
local {
name OUTSIDE-LOCAL
}
}
}
ethernet eth1 {
address 192.168.5.1/24
description LAN
}
loopback lo {
}
}
nat {
destination {
rule 10 {
description "Public DNS"
destination {
port 53
}
inbound-interface eth0
protocol tcp_udp
translation {
address 192.168.5.10
}
}
rule 11 {
description "Traefik HTTP"
destination {
port 80
}
inbound-interface eth0
protocol tcp_udp
translation {
address 192.168.5.11
}
}
rule 12 {
description "Traefik HTTPS"
destination {
port 443
}
inbound-interface eth0
protocol tcp_udp
translation {
address 192.168.5.11
}
}
}
source {
rule 100 {
outbound-interface eth0
source {
address 192.168.5.0/24
}
translation {
address masquerade
}
}
}
}
protocols {
static {
route 0.0.0.0/0 {
next-hop <gateway> {
}
}
}
}
service {
}
system {
config-management {
commit-revisions 100
}
conntrack {
modules {
ftp
h323
nfs
pptp
sip
sqlnet
tftp
}
}
console {
device ttyS0 {
speed 115200
}
}
host-name vyos
login {
user vyos {
authentication {
encrypted-password <password hash>
plaintext-password ""
}
}
}
ntp {
server time1.vyos.net {
}
server time2.vyos.net {
}
server time3.vyos.net {
}
}
syslog {
global {
facility all {
level info
}
facility protocols {
level debug
}
}
}
}
// Warning: Do not remove the following line.
// vyos-config-version: "bgp@2:broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@3:firewall@7:flow-accounting@1:https@3:interfaces@26:ipoe-server@1:ipsec@9:isis@1:l2tp@4:lldp@1:mdns@1:monitoring@1:nat@5:nat66@1:ntp@1:openconnect@2:ospf@1:policy@3:pppoe-server@5:pptp@2:qos@1:quagga@10:rpki@1:salt@1:snmp@2:ssh@2:sstp@4:system@25:vrf@3:vrrp@3:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2"
// Release version: 1.4-rolling-202207301340
I forgot to mention in the initial post that VyOS and pfSense are running in VMs on Proxmox server. I tried the speed and duplex commands, and VyOS doesn’t like them together.
Proxmox reports the physical interface is running at 1gbps full duplex. The VyOS vm is using VirtIO NIC drivers, the pfSense is using an emulated Intel E1000.
I’m working through the different adapters now, but my home internet connection is having some latency issues itself, so my numbers aren’t accurate. My testing methodology is to change a setting, and ping the WAN IP of VyOS 100 times then average the latency in localc. I’m checking to see if my girlfriend can do the tests from her internet connection.
Proxmox is running on a Dell R330. I think I’m using the integrated NIC, but I honestly don’t remember. The server has been on the other side of the country for a few years now so I’ts been a while since I’ve seen it.
I think the actual problem has been solved - it was an issue involving the webhost VM not being able to reach DNS as the VyOS VM didn’t have the site to site vpn setup yet. Bottom line: the issue was not related to VyOS, and I need to do some research as to why wordpress needs DNS to generate pages.
I still have a little bit of latency weirdness, but I’m working on trying each virtual NIC driver and seeing which is best.