Hi all, I have talked about this many times, and I have solved the heavy NAT problem. But there is another problem, far more serious for me. The number of NAT-session is solved because other people jumped in and helped Belgium in traffic offloading. However, I ran into a new underlying problem, a…

@ccb056 , You may be right. net.netfilter.nf_conntrack_max = 1048576 was 262144… If that is the solution, I buy you a beer!!! I hope so. I raised it, let’s see what it does. I suspected the connection-tracking for a long time, is it really this simple? My current adjustments: net.netfilter.nf…

[image] Changed “Net speed” from 1 gbps to 3 gbps Changed “Firewall Optimization Options” from “Conservative” to “Normal” - CPS is now up ["Conservative"] ["Normal"] Also increased the max state table size to 10,000,000 [image] [Packets Per Second] [States] Seems to be working fine 2…

Try setting UDP first to 10 and UDP single to 15 and set multiple to 60. Then the states will drop fast in numbers. There is no need to set UDP states so high today as the entire internet can be reached in about 200ms-300ms, apart from some real bad routes that you probably won’t use for UDP anywa…

NTP round-trip times also includes the server internal delay (T3-T2). In unusual situations this may be on the order of seconds. 30 second timeouts seems to be a reasonable compromise.

Mine is set at 10 seconds and it’s more then enough. If I send a command to an NTP-server like ntpdate, typical the response is less then 2 seconds. I also think pool-monitors should report timeout at 2-4 seconds (rtt including server delay), not wait much longer. As then, there is no point to wa…

Instead of setting all UDP states to have a 10 second timeout, I was able to select only the single rule NAT port forward to have a 10 second state timeout [image] Traffic and CPU usage doesn’t seem to have changed much [image] Client distribution seems to continue growing - at what point does …

[image] ccb056: Client distribution seems to continue growing - at what point does it stabilize? Around three days .

I wonder, now you set the UDP to 10 secs, does it affect memory and CPU load? I would love to compare them on your heavy loaded system.

I didn’t notice much of a change pf uses about 1 kB of RAM per state, not sure about other firewalls [image] Hardware Sizing Guidance | pfSense Documentation Active network connections through the firewall are tracked in the firewall state table. Each connection through the firewall …

That’s what I thought would happen, my router runs out of states-memory because it’s limited. But it’s running well now, no issues with short lived states. [afbeelding]

How much RAM does your router have? Do you have console access?

Modem/Routers slowdown on heavy traffic

Server operators

avij January 28, 2026, 6:52am 79

Around three days.

Topic		Replies	Views
Joining the pool kills my Internet Pool Development	29	3609	June 7, 2021
Network: i/o timeout Server operators monitoring	32	949	November 20, 2024
Using an NTP-server behind NAT, it works! After testing a lot. No not many routers/OS can handle it. Really not many Server operators	39	555	July 22, 2026
Discussion of client traffic in BE (Belgium) zone Server operators	14	375	February 2, 2026
Disable monitoring emails for a single server Server operators	38	1341	January 24, 2025

Modem/Routers slowdown on heavy traffic

Related topics