Traffic Shaping

Using FQ_CoDel Limiters to share Internet bandwidth per-LAN-IP

SteveITS — Thu, 14 May 2026 01:43:36 GMT

@strannik 2.8.x is out. See also https://forum.netgate.com/topic/200595/this-is-how-i-used-limiters-to-fairly-share-bandwidth-among-all-devices-on-lan

This is how i used limiters to fairly share bandwidth among all devices on LAN

fsr — Sun, 26 Apr 2026 01:50:33 GMT

@strannik Why would you want to do something like that? Too complex, you would be underutilizing you bandwidth, and it won't be fair anyways. I'm pretty sure that the configuration presented on the first message up there would manage bandwidth, fairness and latency much better than that. With this, it would be impossible for one user to "hijack" all of the bandwidth. Of course, if other users are not using much of the bandwidth at all, it can look like one user has hijacked the link, but in reality he's just using the bandwidth that no one else is using anyways. You want that to happen. Why would you pay for a 800 Mbps link to download at 100 Mbps if you could be using almost the 100% of it? The whole point of traffic shaping is to be able to share bandwidth between all users in the most efficient way, fairly, and for latency-critical protocols to continue to work well even when the link is under heavy load. This seems to accomplish this task quite well. In a "live" network it's hard to see if the bandwidth is being fairly shared, because the hosts are likely not even attempting to download at the same rate (using different amount of connections/flows, using different protocols, etc), they're downloading from different servers with different bandwidth and different amount of clients connected to them, etc. That said, i have seen several times in the traffic graph than two PCs from LAN were downloading at nearly the same rate. And bandwidth tests off-hours when the link is not utilized should show good "host fairness" with this configuration, even if not mathematically perfect. Just check that the per-IP queues are being created in the way you think they are in the limiter diagnostics (the default scheduler shows this), check the firewall logs to see if the traffic is hitting your rules correctly. Test off-hours when you can control which PC or PCs are downloading/uploading, etc. It's odd that you continue to see problems when switching schedulers in 2.8.1, even after restarting. I didn't found such issues. At most you could need to reset the state table. You could try to delete all limiters, restart and create them from scratch, to see if that fixes the odd behaviour. Or if you continue to find such problems, you could resort to keep one set of FQ_Codel limiters and another set of limiters with the default Scheduler (for testing). Then you only need to modify the Queues configured on the rules to apply one or the other.

Limiter not working with floating rules on non-default WAN (multi-WAN + PPPoE + qBittorrent)

SteveITS — Mon, 30 Mar 2026 10:11:04 GMT

@dorabiatto I would just try the various scheduler options and see what works best.

Whats the latest on CAKE

w0w — Wed, 25 Mar 2026 14:15:01 GMT

@SteveITS said in Whats the latest on CAKE: I’m just going to put this here… ;) Yeah, the traditional thick April trolling. Which, sooner or later, will become reality. We just need to wait another ten-something years.

Configure dynamic change in limiter bandwidth allocation during multi WAN failover

richardsago — Mon, 16 Mar 2026 01:34:52 GMT

Good day. I would like to follow up on this. How is the bandwidth allocated in your multi-wan failover setup? Please let me know also if my understanding is not correct or if this is not doable. Thank you

FQ_CODEL not super effective and really hits throughput; how to tune?

provels — Sat, 07 Feb 2026 17:57:03 GMT

FWIW, I spent the day yesterday playing around with settings and found I could get a repeatable A+ at Waveform and generally random results A/B/C at LibreQoS with the same settings. I use the settings in the Netgate docs with in/out bandwidth set just a hair below unmanaged speeds. So there's that! Cable modem 150/20 nominal 175/43 actual 166/40 shaped Or did I miss the point completely that this is only a PPoE issue being addressed?

Interfaces not capable of traffic shaping?

SteveITS — Fri, 23 Jan 2026 23:39:14 GMT

@opoplawski There is a list here: https://docs.netgate.com/pfsense/en/latest/trafficshaper/limitations.html ix is listed but not ixl.

Bandwith Issue with netaget 8300

RaymondChauke — Thu, 15 Jan 2026 15:45:54 GMT

Make sure that you testing the speed being the only person/single device that is connected to the network... don't allow any other device to be connected until you have done with speed testing. Unless your converter is set to auto..then it might be auto setting itself to your available internet speed and read it as the highest speed.

Inquiry About “config_acm Unable to configure flowset, flowset busy!” Message

smsigroupit — Tue, 13 Jan 2026 00:31:48 GMT

Good day!

I’m encountering the following message and would like to ask what might be causing it:

config_acm Unable to configure flowset, flowset busy!

Thank you.

Prioritizing Traffic From Specific LAN Client

SteveITS — Thu, 04 Dec 2025 07:53:24 GMT

@johnpoz Right, it could help outbound on WAN, or for outbound on LAN it doesn't need tagging and that could be done via the shaping wizard. Floating for that direction looks similar: [image: 1764867798698-69746095-2ba1-4f33-8ca7-2674680c2c9c-image.png] (dest = VoIP_devices)

Best parameter of speed limiter for my use case?

left4apple — Mon, 01 Dec 2025 04:38:51 GMT

I have a guest VLAN and would like to set a collective speed limit of 100Mbps on it. May I ask for the best parameter, or is there a document of fine tuning the parameters?

Here's my current setting using the default value.

Traffic Shaping with Multiple WANs Sharing 1Gb Single Connection

teetotal_mike — Fri, 21 Nov 2025 16:04:15 GMT

Our ISP operates 3 separate VLANs over a single 1Gb fibre connection, for each of which we have a WAN interface setup, routed to the relevant VLAN Gateway IP of the ISP's router. All our of internal traffic comes from a single LAN connection (due to the way UniFi's L3 routing works).

WAN1 (VLAN2)
WAN2 (VLAN3) <> LAN1 (VLAN4040) <> Internal Network (L3 Switch)
WAN3 (VLAN4)

I am hoping to set up traffic shaping, in order to improve connection quality for our VoIP calls, but I am at a loss as to the best way to do this correctly. Do I use the multi-WAN wizard and distribute the bandwidth, or do I set each WAN the same?

Is anyone able to offer any pointers?

PRIQ Affecting LAN Networks

SteveITS — Tue, 11 Nov 2025 18:34:45 GMT

@shellbr I know the docs say "It does not care about bandwidth on interfaces, only the priority" but in my experience the limits on WAN and LAN are enforced.

Problem setting up tail drop/codel

TheNarc — Mon, 03 Nov 2025 13:13:19 GMT

@zennb1 Okay, what stands out to me are target and interval values of 0 for your WAN down limiter. I don't think that is valid. I feel like I've seen other posts from people claiming that somehow those can end up being defaults, but I'm betting that's what's breaking things for you. I would start by setting target to 5 and interval to 100 like your upload limiter. As to all the other parameters, I don't feel like I can give great advice, especially for such a fast symmetric connection. To be honest, in my experience it seems like almost everywhere you look for information about how to set the few "knobs" available with FQ_CODEL, the advice is different :) But I bet that just changing those target and interval values will get traffic flowing for you. Clearly, you can try changing various settings and test to see what works best for you. I have found some advice that the "queue length" should be set equal to "limit", and also that for an 8Gbps symmetric connection you may want "limit" and "flows" both set to something like 4096. But, I am not an expert on these FQ_CODEL settings so if anyone chimes in who is, I would defer to them.

Limiters don't always work?

ash 0 — Mon, 27 Oct 2025 01:24:25 GMT

@SteveITS Hmm, yeah, I don't think that bug is applicable to my situation, beacuse they're using source masking to apply limiters to individual /32s, wheras I'm looking to throttle traffic collectively on a gateway, no source mask in play.

Lag spikes despite fq_codel limiters

Inety — Fri, 26 Sep 2025 09:39:38 GMT

Thanks @SteveITS I want to clarify that I am already applying fq_codel globally to my entire WAN interface by following the official Netgate tutorial and using floating rules. After setting this up I also reset the firewall state table so that all connections had to be rebuilt. Other clients in my network are shaped correctly this way. I tested this, by setting the limits to 50% of my maximum bandwidth (upload and download). My PC's bandwidth got cut in half, whereas the storage server still uploaded with 100% of my maximum upload bandwidth (with bursts above 100%, as measured with btop) What confuses me is that the Storage Server still does not appear to be shaped. All other devices respect the fq_codel limits, yet the Storage Server continues to burst above the configured bandwidth and the lag spikes remain whenever it is active. This is very puzzling to me, since my expectation was that fq_codel at the WAN level should catch all traffic. My goal is to get bufferbloat under control, because the added latency is very noticeable while gaming and also during normal web browsing. Do you have an idea why the Storage Server in particular might be bypassing the limiter, even though everything else seems to be shaped correctly?

Determining minimum bandwidth IoT (IPv4) devices need with 4200?

Joe0x7F — Sat, 13 Sep 2025 01:28:07 GMT

@chpalmer Thanks for your experience and thoughts. Good points all.

How to tune FQ_CODEL for IPv6?

ChrisJenk — Thu, 04 Sep 2025 09:48:54 GMT

I have a NetGate 6100 unit running pfSense+ 25.07.

My LAN network is 10 GbE and the LAN connection to the 6100 is a 10 Gbit/s SFP+ uplink from my main switch. LAN is dual stack with internal traffic being mainly IPv6.

My WAN connection is a 2.5 Gbits FTTH connection using PPPoE over VLAN 911. WAN is dual stack with over 50% of my traffic using IPv6. This includes some of my most important traffic.

I've configured FQ_CODEL as per the recipe in the pfSense documentation, with some small tweaks, to try to optimise latency while minimising the impact on throughput. My results have been great for IPv4 where my bufferbloat test score has gone from A/B to A+. However results are not so good for IPv6.

Specifically:

Simply having the firewall rule in place to apply FQ_CODEL to IPv6 traffic reduces IPv6 multi-stream iperf3 throughput by ~10% (I do not see any measurable impact on IPv4).
My bufferbloat score for IPv6 is only marginally improved.

I've also run my own tests (as opposed to using various bufferbloat test sites) and I see the same results as above; IPv4 is performing really well, IPv6 much less so.

Is it just that FQ_CODEL isn't very good for IPv6? Or are there additional things that I can do to improve things for IPv6?

Traffic shaping FQ_CODEL - what should 'Limiter Info' look like under heavy load?

Wolf666 — Sun, 31 Aug 2025 14:57:13 GMT

I cannot say more about questions Q1 and Q2. About Q3. I have a PPPoE line, 1Gbps/300Mbps, MTU is 1492. My line is fine also without limiters, I had a solid A for bufferbloat, RTT is 6ms (first hop) I tried limiters, using 1506 as quantum (1492 + 14 interface overhead), set limit at 7ms for download and 5ms for upload, bandwidth (950/285) I tested with thoese limiters, set the floating rules as per netgate instructions, and now I have a solid A+ on bufferbloat test, with average speeds of 930/280. I suggest to test against bufferbloat issues before using limiters, then repeat the test using limiters so you can see if they are working and improving latency management.

I used the traffic shaping wizard (multi_all.xml) but am confused by the results (firewall rules only on WAN interface).

ChrisJenk — Sat, 30 Aug 2025 16:47:10 GMT

I used the 'multi_all' wizard to set up PRIQ traffic shaping and it all seemed to go fine. but I'm a bit confused by the results.

Firstly it setup queues on all my interfaces, which is fine and expected.

Q1: However for all of the LAN interfaces the default rule, qLink, has a lower priority (2) than qOthersLow (3). This doesn't seem correct? On the WAN interface the default rule, qDefault, has a priority of 3 and qOthersLow has 2, which is how I imagine it should be. Is this a bug or am I misunderstanding something?

Q2: The floating firewall rules that it created are all on the WAN interface, so I'm not sure how they can affect traffic on the LAN interfaces and if they can't then why did it create queues on the LAN interfaces?

Thanks for any insights.

Limiter source mask now after NAT when using gateway groups - 2.8 change?

stephenw10 — Tue, 01 Jul 2025 11:36:43 GMT

No support are in the same situation we are. It would require building a 25.07.2 release. It's fixed in 25.11 snapshots if you're able to test there. The first public beta is close.

[2.8.0] Limiter rule not honored on LAN download with multiple limiters & queues

whitehatmiddleman — Tue, 17 Jun 2025 02:36:13 GMT

I too noticed the problem, but I'm noticing when I disable the floating rule, not only do my original limiters work but bufferbloat doesn't seem to be an issue any more. I'm not sure if 2.8 fixed an old issue, or now has some kind of SQM.

Bandwidth Limiter Per Client Not Working with Alternate WAN Gateway

Konan 0 — Thu, 12 Jun 2025 20:18:43 GMT

@maliaga If you can find a way to report bugs in a way that Netgate respond to, let us know!

Is there a way to assign higher priority to traffic going to a specific URL?

VassiliTN — Mon, 02 Jun 2025 15:20:02 GMT

Update: It turned out to be some issue with the ISP. Took multiple calls, people and hours of troubleshooting, works much better now. Still curious if prioritizing traffic to a specific URL is possible

Traffic Shaper Firewall Rules for WANv6 traffic with globally routable IP

WhizzWr — Thu, 22 May 2025 08:19:12 GMT

@Bob-Dig I don't know how and why, but it does. :( I confirmed the unintended traffic shaping with simple iperf3 between local devices. With floating rules off there is shaping, with the floating rules off, I get gigabit speed again. The shaping is bidirectional. Are you saying regardless of the traffics IPv6 adress being globally routable, they should be treated as local traffic since the interface is still LAN?