Home Network Security – Installing OPNsense and SLOW SPEED PROBLEMS! (part 3)

I chose OPNsense over pfSense, from solely reading about it being easier to start with, as pfSense is more “oldschool”. Both OPNsense and pfSense is based on FreeBSD. pfSense apparently contributes to the core underlying FreeBSD project and thus have faster security updates. pfSense has shifted focus onto paying customers, and word is that the open source community suffers somewhat from that.

First download OPNsense in your preferred file / method of making an installation image. I am using the VGA for a USB stick. I use balenaEtcher for easy USB stick flashing.

I will follow the official documentation from OPNsense: https://docs.opnsense.org/manual/install.html#installation-instructions

Boot your computer from USB drive and proceed as installer, with default password opnsense, or you can login as root, if you want to boot from the USB and try out OPNsense without installing.

• I chose Danish keyboard layout and tested it
• ZFS file system is recommended for SSD over 16 GB
• Stripe is selected for partitioning
• Only SSD is listed, nda0. Be aware that da0 can be listed and it is your USB stick!
• Set a new root password and do write it down somewhere safe 🙂
• Installation is finished, remember to remove bootable USB stick to avoid rebooting into installer

Login into OPNsense console and start by setting up your WAN / LAN interfaces. We need this in order to access the web GUI. Menu bullet 2) I setup LAN on igc0 and WAN on igc1, you can do this to your own liking. Do not panic over questions about VLANs, that can be setup at a later time.

Use menu bullet 11) to reload and fetch a IP address if you made changes like setting up DHCP on the WAN interface. LAN interface should have a static IP as OPNsense is going to be the LAN DHCP server.

OPNsense Download Speed Problems

The first test I made after OPNsense was running as firewall between ISP supplied router and switch, was a speedtest.net test. This revealed a serious issue with only around 40 Mbps in download speed, but upload speed was around the usual 130’ish Mbps.

Searching online for this problem, reveals its not uncommon. I tried the following solutions proposed on Reddit r/opnsense: https://www.reddit.com/r/opnsense/comments/1maph1l/download_speed_limited_but_upload_is_not/

• Forced speed & duplex to 1000baseT full-duplex, on both LAN and WAN
• Disabled HW offloading / CRC.TSO.LRO

This did not make any changes. Here I also made a crucial mistake, I tried to force the LAN interface to 2500Base-T, into a 1000baseT switch, which locked me out of the web configuration tool. The fastest route back to access, was a factory default reset from the console with monitor and keyboard on the computer.

• VLAN filtering

I doubled the download speed from disabling VLAN filtering. However, enabling all hardware settings again, one at a time for LAN and WAN, did not get me back to the slow 40 Mbps, but now stays at 80 Mbps. Weird.

Next I read about iperf plugin, to run speed tests locally. First I had to upgrade to OPNsense 25.7.10 and could then install the os-iperf plugin. You need to tick off “Show community plugins” to find it.

Download iperf client to run on f.ex. your Windows PC: https://iperf.fr/iperf-download.php

Create a iperf test instance in OPNsense, one for LAN and one for WAN. Make sure the iperf service is running. To clear instances, restart the service in the main dashboard. Instances are single use, you need to create a new instance for each test.

Results from both LAN and WAN interface, which essentially can only be from PC to LAN, shows that the there is 1Gbps speeds across the switch.

A sanity check on the switch connection between PC and OPNsense also shows 1000 Mbps, full-duplex and flow control off.

Sanity check on OPNsense shell “ifconfig” command, shows both Ethernet autoselect at 1000baseT or 2500Base-T, depending on which port I connect on the ISP supplied router.

Using speedtest.net on my smartphone, connected through 2.4 Ghz WIFI on the ISP supplied router, gets a result at around 600 Mbps. So there is still a bottleneck somewhere in the OPNsense firewall / Minisforum TH50 computer.

Using the 1) Assign interfaces, and answering no to everything, exit with ctrl+ c. Here we get the NIC names:

• igc0: Intel(R) Ethernet Controller I225-V
• igc1: Intel(R) Ethernet Controller I225-V

Searching for this NIC brand and model, I found this pretty depressing topic: “Intel i225/i226 2.5G NIC Information/Issue Tracking Thread” https://forum.opnsense.org/index.php?topic=38055.0 with a linked Intel I225 Specifications Updates.

2.1 I225 v1 Minimum Supported Receive Inter-Packet Gap (IPG) is 8 bytes instead of 5 bytes
Problem Summary: The minimum received inter packet gap (IPG) in the GMII interface between the PHY and the MAC is 8 bytes. This minimum gap is specified through 1Gpbs operation. For a controller to operate at 2.5Gpbs, the IEEE standard requires that the MAC be able to tolerate a minimum IPG of 5 bytes. The I225 v1 silicon supports an IPG down to 8 bytes, but not down to 5 bytes in 2.5Gpbs operation.
Implications: Packets received by the I225 v1 product link partner (the switch, router, or back-to-back controller it is connected to) that are received with a smaller IPG than 8 bytes on the MAC/PHY interface are dropped. When this occurs, the network connectivity is reduced from 2.5Gpbs to
below 1Gpbs operation. In some scenarios with certain link partners, the operation can be as
low as 1-10Mbps.
Workaround: The impact of this IPG issue can be mitigated when connected through a switch/router by setting the link speed in the driver (Windows or Linux) to 1Gpbs operation to enable a 1Gpbs line rate. Also, the latest Windows drivers and I225 firmware available for download (driver version 1.0.0.30 or later NVM version 1.38 or later) can detect when the IPG packet drops occur and will automatically reset the link speed to 1Gpbs. Please see downloads here: https://downloadcenter.intel.com/product/184686/intel-ethernet-controller-i225-series

I forced 1000baseT on the switch for LAN side. ISP suppled router does not have any settings for forcing Ethernet speeds. I tried inserting a 1Gbps switch between router and OPNsense computer.

• Netgear 8-port Gigabit Switch G5608v4 did not resolve the issue
• 3COM 5-port Gigabit Switch 3CGSU05 did not resolve the issue

As these switches are 10/100/1000base auto negotiating, unmanaged, there is no way to tell what they handshaked with the Minisforum TH50 computer i225 NIC. But from the speedtest alone, its safe to say it is properly 100Mbps.

Last resort with the issue isolated is to set up two ports in a separate VLAN on the managed switch.

Update January 4th 2026: The issue was not resolved. I got fooled by ports set to Trunk, not Access. So I got an IP address directly from the ISP routers DHCP.

The speedtest.net is finally a succes! The expected 800’ish Mbps is coming through from ISP supplied router, to 3COM Gigabit switch (maybe this can be omitted now), to Grandstream GWN7802P managed switch with separate 1000baseT full-duplex on VLAN8, to Minisforum TH50 WAN interface and its LAN interface feeds back into Grandstream switch on VLAN2 for connection to the PC.

This troubleshooting took out a good 4 hours of my time, over two days! I was planning to include some basic configuration of OPNsense into this post, but that will have to wait for another day/year 🙂

Happy new year 2026!

Update January 4th 2026

I thought 2026 would be a happy year, but it is not.

A tracert command to the speedtest.net server revealed that OPNsense was not part of the chain.

Removing the VLAN 8 and cables from managed switch, plugging ISP router directly into OPNsense WAN port and running tracert again, shows what is expected.

Here is a summary of the speed tests done in December -> January. The red lines indicate the days where I installed and plugged in OPNsense on the Minisforum TH50. After that, the period where I got fooled by Trunk ports and last speed tests, is after making sure it is running through OPNsense.

Still troubleshooting on the issue 🙁

Update January 17th 2026

The issue was solve by running OPNsense as a VM in Proxmox. The issue is OPNsense FreeBSD not behaving nicely with the older Intel i225-v1 network cards in the Minisforum TH50 computer. Read this article below on how I managed this:

Installing Virtualized OPNsense as VM in Proxmox