0

Having 2 pfsense FWs in a large populated area with 3 VLANs, (students + teachers + admins), I set up limiters in the firewall rules to avoid the connection speed limits to be reached (30Mb up/dwn) This seams to work nicely on tests I've been running on devices of the 3 vlans, for whom I created firewall alliases to. Surprisingly, it still occurs that, as before I set those rules up, I notice wan traffic being on the max of the Internet connection, with no such lan traffic. So, what I am looking for is the reason why the wan traffic differs from the sum of my LANs. The 2 graphs shows both of my FWs, the problem can occur on one like on the other.

Thanks for any ideas.

Pierre

enter image description here enter image description here

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 10, 2017 at 13:49

4 Answers 4

Reset to default
1

You might want to look at your RRD graphs to see what's going on with blocked traffic, and/or examine what you have exposed to the WAN that could be getting beat on [that would be services that originate from the pfSense box and which might well be only intended for your local network, but which may have default (or non-default) settings that make them available on the WAN interface as well.]

You might also want to consider moving up to 2.3.2.

Improve this answer
0

It is possible you are being DDoSed - an external entity is sending as much traffic as they can towards your public IP (thus filling your 30Mbps link), but this is not being passed through to your LAN segment, because it is hidden behind a NAT.

What is interesting though is that during this time that your LAN interface outbound is pretty consistent at 2Mbps.

It would be good to see a capture of this traffic to work out what is going on in more detail.

Improve this answer
0

Your most likely getting beat up from the Internet. My firewall is regularly scanned from multiple places. Since it seems to be flooding your pipe, I would recommend looking at your firewall blocked log to see if you can identify the offending IP's. If its one or 2, your ISP may be able to block that for you upstream to get that load off your connection.

Improve this answer
0

Running pftop on your pfSense box should give you good insight into the In and Out traffic in a side by side manner with the byte count. This should tell you exactly where it is not matching up.

pftop running on pfSense showing side by side In and Out connections with byte count.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.