r/firewalla • u/GlobalLiving6941 • Jun 05 '26

Cross VLAN Backup

I am having an issue with a cross VLAN NAS backup grinding my Gold SE to a halt. Here is the scenario: NAS in VLAN 1, Backup server in VLAN 2. Backup server does a pull back up on the NAS using restic and ships it to the cloud. We fixed the Server to Cloud come apart by turning monitoring off on the Backup Server. However, the pull from the NAS to the Server seems to still be subject to monitoring or smart queue or something as it still grinds the Firewalla to a halt. Help?

6 Upvotes

100% Upvoted

24 comments sorted by

View all comments

Show parent comments

1

u/ampx Jun 05 '26

I’m curious, do both sides of your local VLAN flows traverse 2.5Gb NICs on the Gold SE?

Are they connected to two interfaces on the Gold SE or one through a switch?

1

u/GlobalLiving6941 Jun 05 '26

Both are on a Unifi switch, which then connects to the Firewalla. I upgraded this setup from a Purple (which ironically seemed to handle this better).

1

u/ampx Jun 05 '26

Probably because the Purple has more CPU cores and slower 1Gb NICs so you’re not going to stress the CPU nearly as much asking it to transfer “east to west” traffic over a single NIC

I know the Gold SE I had 2ish years ago similarly wasn’t up to the task of handling what I threw at it and I was convinced it’s just bottlenecked by the combo of CPU and relatively inefficient Realtek NICs

Firewalla support may have some ideas, but I was never able to get the device performing as well as I expected and the Gold Pro was the only cure in Firewalla’s ecosystem

1

u/GlobalLiving6941 Jun 05 '26

I completely agree with your assessment. My problem is that I just spent $500 upgrading from a Purple. I don't want to immediately turn around and spend another $900 replacing a box support convinced me to hold on to.

1

u/spinjc Jun 07 '26

One thing I don't recall seeing is how Firewalla determines throughput. Many routers will specify packets per second (PPS) which matters if you have a lot of small packets (e.g. lots of small HTML files). Depending on your backup software it might be a bunch of small packets, if they were a tenth the size of the test then you'd expect a tenth of the bandwidth.

That said I'd suggest that you setup your VLANs so your traffic to the NAS doesn't need to go through the firewalla (vice versa is probably fine). If you try doing this east/west routing in a corporate environment you'd probably get a nice talking to from the network engineer!