• We have solutions from A - Z

Business Computer Repair

Youtube, Does it take forever to start streaming? It might be your pfsense firewall!

 1024 481 rdwild
By:
0

Is Your pfSense Configuration Buffering Your YouTube Experience? Let’s Talk IP Offloading

Have you ever found yourself staring at a spinning wheel on YouTube, waiting for a video to start, despite a perfectly good internet connection? Or perhaps your videos are constantly buffering, turning your streaming session into a stop-and-go nightmare? If you’re running pfSense as your firewall and router, a seemingly innocuous setting called IP Offloading might be the culprit.

Many pfSense users, in an effort to ensure maximum compatibility or troubleshoot other network oddities, often follow advice to disable IP offloading settings. While this can be a valid approach in certain scenarios, particularly with specific hardware, it’s not always the optimal solution – and it can have a direct, negative impact on your streaming experience, especially with platforms like YouTube.

The IP Offloading Dilemma: Enabled (Not Offloaded) vs. Disabled (Offloaded)

Let’s clarify what “IP Offloading” means in this context. When IP offloading is enabled (which is typically the default), your network card’s hardware takes on some of the processing burden for tasks like checksum calculations. This frees up your main CPU, allowing pfSense to handle other critical routing and firewall tasks more efficiently.

Conversely, when IP offloading is disabled, these tasks are pushed back to the main CPU. While this might sound safer or more robust, it can bog down your system, especially if you have a less powerful CPU or are dealing with high traffic volumes.

The YouTube Connection: Why Disabling Offloading Hurts

YouTube and other streaming services rely heavily on efficient, low-latency data transfer. When IP offloading is disabled, and your CPU is burdened with tasks that your network card could otherwise handle, it can lead to:

  1. Increased Latency: The additional CPU cycles required for offloaded tasks can introduce delays in packet processing. This extra latency is precisely what causes videos to take longer to start.
  2. Reduced Throughput: A bogged-down CPU might not be able to process network traffic as quickly, leading to a bottleneck that manifests as constant buffering and poor streaming quality. Your internet speed might be phenomenal, but if your firewall can’t keep up with processing the packets efficiently, it won’t matter.
  3. Session Establishment Issues: The initial handshakes and session establishment with YouTube’s servers can be particularly sensitive to these processing delays, making that first video load excruciatingly slow.

The Realtek Exception (and Why It’s Often Misinterpreted)

It’s true that for a long time, certain Realtek network interface cards (NICs) have had documented issues with IP offloading. In these specific cases, disabling offloading has often been the recommended workaround to achieve stable network performance.

However, this advice has often been generalized, leading many users with non-Realtek hardware to disable offloading unnecessarily. If you’re running a pfSense box with Intel, Broadcom, Chelsio, or other reputable enterprise-grade NICs, the likelihood of encountering offloading issues is significantly lower.

Recommendation: When to Enable (and When to Disable)

Here’s the takeaway for optimizing your pfSense setup for smooth YouTube and streaming performance:

  • If you DO NOT have Realtek NICs: It is generally recommended to keep IP Offloading settings ENABLED in pfSense. This allows your network hardware to do its job efficiently, freeing up your CPU and improving overall network throughput and latency, which is crucial for streaming.
  • If you DO have Realtek NICs: If you are experiencing stability issues or random network drops, then disabling IP offloading might be a necessary troubleshooting step. However, be aware that this could come at the cost of streaming performance. If you have Realtek hardware and encounter streaming issues, consider upgrading your NICs to a more robust brand like Intel if possible.

How to Check and Adjust Your Settings

You can find the IP Offloading settings in pfSense under System > Advanced > Networking. Look for options related to “Hardware Checksum Offloading,” “Hardware TCP Segmentation Offloading,” and “Hardware Large Receive Offloading.”

Experiment with these settings, always making one change at a time and testing the results. A good test involves watching several YouTube videos to see if the start times improve and if buffering is reduced.

Don’t let an outdated or misapplied configuration setting cripple your streaming experience. By understanding the role of IP offloading and applying the right settings for your hardware, you can get back to enjoying your favorite content without the frustrating waits and interruptions.

Proxmox support

 150 150 rdwild
By:
0

One of the things that a lot of people that run proxmox done know is that even if you have a support contact support (help) is provided during Austrian Business days which for Proxmox is: Monday to Friday, from 7:00 – 17:00 (CET/CEST). For those of us in North America that means support is available from 1 AM EST to 11 AM EST which can be difficult support wise. And that is why we provide primary support here in North America for many companies as a first line of support. That means when it is 5 pm in Toronto and its 8 pm at Proxmox and support is closed you will still get the support you need.

One other thing that for some of our clients is very important … you don’t need to open a port on your firewall as long as you have access to your proxmox servers from an admin machine. You watch, while we fix!

Linux LVM2 : How to rename a duplicate VG volume

 150 150 rdwild
By:
0

I have had a few cases where I had to take an old Linux system drive with data on it and move data over to a new system drive. In this case, it was when one of my Ubuntu systems stopped working and would not even boot (it froze during boot up and I could not get any info out of it). At the time I prepped a new Ubuntu system drive and booted up with it and then installed the old drive so I could get data off of it. The problem at the time was that I could not mount the volume due to the fact that it was an LVM volume with the same volume group name at the new system drive so it would not mount. This problem is actually two problems in one. The first one is obvious in that we have two volumes with the same volume name. The second is that it does not show the relationship between the device name and the lvm volume.

If you do an “fdisk – l” it gives you the disk identifier but no volume group names

Disk /dev/sdb: 837.75 GiB, 899527213056 bytes, 1756889088 sectors
Disk model: PERC H710
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: A4AC923B-B4F9-444F-BC48-86591E1A0302

Device Start End Sectors Size Type
/dev/sdb1 2048 2203647 2201600 1G EFI System
/dev/sdb2 2203648 6397951 4194304 2G Linux filesystem
/dev/sdb3 6397952 1756887039 1750489088 834.7G Linux filesystem


Disk /dev/sdc: 837.75 GiB, 899527213056 bytes, 1756889088 sectors
Disk model: PERC H710
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 4EDFCB23-DE1E-41F2-B3DF-6207AD3C0B94

If you do a “lsblk” you get the device device and volume group name but no vg uuid

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 9.1T 0 disk
└─sda1 8:1 0 9.1T 0 part
sdb 8:16 0 837.8G 0 disk
├─sdb1 8:17 0 1G 0 part /boot/efi
├─sdb2 8:18 0 2G 0 part /boot
└─sdb3 8:19 0 834.7G 0 part
└─ubuntu–vg–1-ubuntu–lv 253:1 0 834.7G 0 lvm /
sdc 8:32 0 837.8G 0 disk
├─sdc1 8:33 0 1G 0 part
├─sdc2 8:34 0 2G 0 part
└─sdc3 8:35 0 834.7G 0 part
sr0 11:0 1 1024M 0 rom
nvme0n1 259:1 0 1.5T 0 disk
├─nvme0n1p1 259:2 0 1G 0 part
├─nvme0n1p2 259:3 0 2G 0 part
└─nvme0n1p3 259:4 0 1.5T 0 part
└─ubuntu–vg-ubuntu–lv 253:0 0 1.5T 0 lvm

If you do a “sudo vgdisplay” you get the following …. two VGs with the same name andit does give you the UUIDs but no device name.

WARNING: VG name ubuntu-vg-1 is used by VGs 0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh and VkCMJn-0IyH-DPjA-4hdZ-GqOl-eNkj-4Plf12.
Fix duplicate VG names with vgrename uuid, a device filter, or system IDs.
— Volume group —
VG Name ubuntu-vg-1
System ID
Format lvm2
Metadata Areas 1
Metadata Sequence No 2
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 1
Open LV 0
Max PV 0
Cur PV 1
Act PV 1
VG Size <834.70 GiB
PE Size 4.00 MiB
Total PE 213682
Alloc PE / Size 213682 / <834.70 GiB
Free PE / Size 0 / 0
VG UUID 0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh

— Volume group —
VG Name ubuntu-vg-1
System ID
Format lvm2
Metadata Areas 1
Metadata Sequence No 2
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 1
Open LV 1
Max PV 0
Cur PV 1
Act PV 1
VG Size <834.70 GiB
PE Size 4.00 MiB
Total PE 213682
Alloc PE / Size 213682 / <834.70 GiB
Free PE / Size 0 / 0
VG UUID VkCMJn-0IyH-DPjA-4hdZ-GqOl-eNkj-4Plf12

If you use the vgs with some additional parameters “sudo vgs -o vg_name,vg_uuid,pv_uuid” it will give you the VG UUID and the physical ID

WARNING: VG name ubuntu-vg-1 is used by VGs 0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh and VkCMJn-0IyH-DPjA-4hdZ-GqOl-eNkj-4Plf12.
Fix duplicate VG names with vgrename uuid, a device filter, or system IDs.
VG VG UUID PV UUID
ubuntu-vg-1 0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh QTTC9X-p0Yn-70o3-rVg0-KvK0-dyUx-yel5Ti
ubuntu-vg-1 VkCMJn-0IyH-DPjA-4hdZ-GqOl-eNkj-4Plf12 bI07eL-EHoI-iAnr-AoVg-jWfm-GaON-eSiyd8

You can now type the following command “sudo pvdisplay” to get a list of PV UUID and their physical drives.

WARNING: VG name ubuntu-vg-1 is used by VGs 0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh and VkCMJn-0IyH-DPjA-4hdZ-GqOl-eNkj-4Plf12.
Fix duplicate VG names with vgrename uuid, a device filter, or system IDs.
— Physical volume —
PV Name /dev/sdc3
VG Name ubuntu-vg-1
PV Size <834.70 GiB / not usable 3.00 MiB
Allocatable yes (but full)
PE Size 4.00 MiB
Total PE 213682
Free PE 0
Allocated PE 213682
PV UUID QTTC9X-p0Yn-70o3-rVg0-KvK0-dyUx-yel5Ti

— Physical volume —
PV Name /dev/sdb3
VG Name ubuntu-vg-1
PV Size <834.70 GiB / not usable 3.00 MiB
Allocatable yes (but full)
PE Size 4.00 MiB
Total PE 213682
Free PE 0
Allocated PE 213682
PV UUID bI07eL-EHoI-iAnr-AoVg-jWfm-GaON-eSiyd8

If you look at the lsbk command above you will note that sdb3 is our new boot volume and sdc3 is our old drive that we need to rename and it has a pv uuid of QTTC9X-p0Yn-70o3-rVg0-KvK0-dyUx-yel5Ti

If we look up the pv uuid when we used the vsg command above we get the following VG UUID (0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh) that we can use to rename the duplicate volume group using vgrename to rename the volume group. vgrename (vg uuid) (name of the new volume group)

It would look like the following in our situation: vgrename 0FSzGi-emNx-ILEO-MjLt-2RAa-Sn40-mn2voh backup

At this point activate the changes via “vgchange -ay” and I would suggest you could reboot and then do an lvscan to pickup the new volume.

sudo lvscan
ACTIVE ‘/dev/backup/ubuntu-lv’ [<834.70 GiB] inherit
ACTIVE ‘/dev/ubuntu-vg-1/ubuntu-lv’ [<834.70 GiB] inherit

We are now going to mount the backup volume with the mount command.

sudo mount /dev/backup/ubuntu-lv /mnt/backup

Bob’s your uncle, we now have access to our backup os volume so we can get data off of it.

we are now a proxmox reseller

 800 800 rdwild
By:
0

We are glad to announce that we have become a proxmox reseller. That means when you want to purchase proxmox product support licenses you can come to us. Please visit the proxmox menu on the main page to find out more or visit our store to purchase licenses.

ISPCONFIG Free Virus scanning

 1024 507 rdwild
By:
0

If you are running ISPCONFIG to host client website and email at some point you are going to run across an infected website or two. As a host, you can encourage your clients to make sure their content management systems (joomla, wordpress) is regularly updating their code base and plugins. Keeping them updated is what is going to keep your hosts websites virus and trojen-free as hackers often target plugins which have security issues. It is important to stay vigilant when it comes to hackers that might want to use your website to do bad things … send out spam emails, attach other systems etc.

You could subscribe to a pay service that will provide a plugin to scan for Viruses and Trojens and the cost is quite reasonable.

https://ispprotect.com/

But there is another way … and its free!

Installing Clamwin (Ubuntu)

First – Update the installation

apt update -y

Then Install Clamwin

apt install clamav clamav-daemon -y

You should be able to check that clamwin is installed with the below command

clamscan -V

This should look something like: ClamAV 0.103.8/26984/Sat Jul 29 07:26:39 2023

Once clamwin is installed we next need to add our scanning script.

use your preferred editor (I use nano) to create “clamscan_daily.sh”

nano clamscan_daily.sh
#!/bin/bash
LOGFILE_EMAIL="/var/log/clamav/clamav-email-$(date +'%Y-%m-%d').log";
LOGFILE_WEBSITES="/var/log/clamav/clamav-website-$(date +'%Y-%m-%d').log";
set HOST="$(hostname -f)"
EMAIL_FROM="clamav-daily@myinkbooks.com";
EMAIL_TO="rdwild@rayolightmedia.com";
DIRTOSCAN="/var/www";
EMAILTOSCAN="/var/vmail";

echo "Starting a daily scan of Websites";

for S in ${DIRTOSCAN}; do
 DIRSIZE=$(du -sh "$S" 2>/dev/null | cut -f1);

 echo "Starting a daily scan of "$S" directory.
 Amount of data to be scanned is "$DIRSIZE".";

 clamscan -ri "$S" >> "$LOGFILE_WEBSITES";

 # get the value of "Infected lines"
 MALWARE=$(tail "$LOGFILE_WEBSITES"|grep Infected|cut -d" " -f3);

 # if the value is not equal to zero, send an email with the log file attached
 if [ "$MALWARE" -ne "0" ];then
 # using heirloom-mailx below
 cat "$LOGFILE_WEBSITES" | mail -s "Malware Found on $HOST" "$EMAIL_FROM" "$EMAIL_TO";
 fi
done

echo "\n";
echo "Starting a daily scan of email";

for S in ${EMAILTOSCAN}; do
 DIRSIZE=$(du -sh "$S" 2>/dev/null | cut -f1);

 echo "Starting a daily scan of "$S" directory.
 Amount of data to be scanned is "$DIRSIZE".";

 clamscan --remove yes -ri "$S" >> "$LOGFILE_EMAIL";

 # get the value of "Infected lines"
 MALWARE=$(tail "$LOGFILE_EMAIL"|grep Infected|cut -d" " -f3);

 # if the value is not equal to zero, send an email with the log file attached
 if [ "$MALWARE" -ne "0" ];then
 # using heirloom-mailx below
 cat "$LOGFILE_EMAIL" | mail -s "Malware Found on $HOST" "$EMAIL_FROM" "$EMAIL_TO";
 fi
done


exit 0

You will notice a few parameters that need to be changed in the above code to change it for your needs. The first one is EMAIL_FROM and the second one is EMAIL_TO. If the above script finds a virus or trojen it sends and email using the from address to the email box in the email to address so both of those need to be changed for your system.

Once the clamscan_daily.sh script has been created it needs to be made executable.

chmod +x clamscan_daily.sh

Once you have added the above script to your system you can test it using the below command to do a pilot run.

sudo ./clamscan_daily.sh

You will notice that we use the sudo command here. The script needs to run as it would when running as a cron job which is the root user.


Once you have tested the script to make sure everything is working as it should you will need to add it to a daily cron job so that it runs every day.

I’m currently doing this by moving the script into the /etc/cron.daily folder.

 sudo mv clamscan_daily.sh /etc/cron.daily/clamscan_daily.sh

If the script finds something you will see an email similar to the one below

You will notice in the above email that nothing was found for websites (or they would have been listed here), but there were some spoofing emails that were found in the junk and trash folder. These were caught by other means and moved to trash but Clamav removed them. You will also notice that I obfuscated some of the text so I don’t get a bunch of junk emails.

Links

https://clamwin.com/ (main project website for clamwin)

Proxmox website admin web page

VMware vs proxmox

 1024 576 rdwild
By:
0

For a great number of years, I have been using VMware (vsphere) as the virtual environment for my company’s virtual hosting environment. This has been overall a great product and still is.  But a number of years ago I started looking for alternatives because of the high cost of using and keeping vsphere up to date, the licensing cost is quite high.  At the time I came across a new product called proxmox that has some fairly good potential to be the replacement.  After several months of testing, I came to the conclusion that proxmox just was a little too buggy and was not ready for primetime.  Most of this was due to there not being a good backup system in place to create backups.  But there were critical bugs at the time that I could just not pass.  Despite these issues, I still felt that proxmox had potential and kept an eye on it.

Moving along three or four years and there is now a reasonable backup solution for proxmox and a lot of the original bugs I had have now been resolved so proxmox is now ready to be used in production.

Proxmox is an open-source virtual hosting environment and although proxmox is open source it is a  good idea to purchase a support package if you are using it in production so that each machine gets access to production (stable) updates and support for the proxmox environment.  This is going to be way less than what you would pay for vmware.

Links:

Proxmox: https://www.proxmox.com/en/
Proxmox Backup: https://www.proxmox.com/en/proxmox-backup-server
Downloads: https://www.proxmox.com/en/downloads

Rodney Wild
A-Z Computer Solutions Logo Black

Privacy Preferences

When you visit our website, it may store information through your browser from specific services, usually in the form of cookies. Here you can change your Privacy preferences. It is worth noting that blocking some types of cookies may impact your experience on our website and the services we are able to offer.

Click to enable/disable Google Analytics tracking code.
Click to enable/disable Google Fonts.
Click to enable/disable Google Maps.
Click to enable/disable video embeds.
Our website uses cookies, mainly from 3rd party services. Define your Privacy Preferences and/or agree to our use of cookies.
L i v e C h a t
Live Chat
Call Now!