did you get this to work this is what i am trying to figure out and want to do it by mac address so that things like the ps3 can sign on easily but not go over 5 gigs a day

–- LONGER VERSION ---

I thought it would not be that hard and tried to implement it using limiters, but that did not work.

Right now I have a server on my LAN side listening on a specific port. I have a NAT port-forward rule to redirect traffic with that specific port from the WAN interface, to the server on the LAN interface. Everything works perfectly fine except that I have a home internet package which the upload speed is a lot lower compared to the download speed, and just a few clients connecting to the server could easily fill up the upload bandwidth. Ideally I want to limit connections to 500 kbps (both download and upload) PER CLIENT connecting to the server.

I went ahead with using limiters because I am also using limiters to control bandwidth for LAN to internet traffics, and they work without any problem. For the LAN to internet bandwidth control, I have an UploadPipe (mask the source address), and a DownloadPipe (mask the destination address). The firewall rule that allows traffic from LAN to the internet has advanced features set for the In/Out queue with UploadPipe/DownloadPipe. This allows each device on the LAN network to have its own bandwidth control.

I thought the same effect where each client connecting from the internet to the local server having their own bandwidth control could be achieved easily using the same idea, but applying it on the WAN interface. I set up 2 pipes – ServerInbound (mask source address), and ServerOutbound (mask destination address). And on the auto-generated NAT port-forward rule, I set the In/Out queue to ServerInbound/ServerOutbound. It did not work. I tried to connect to the server from outside and there was no response.

I set the In/Out back to none/none, and I was able to connect to the server successfully like before. Setting the In/Out to ServerInbound/none also worked, but this only limited the server’s download speed (client’s upload), which would not solve my initial problem.

I set the In/Out back to ServerInboud/ServerOutbound and did packet dumping on the server. When I tried to connect to the server from my computer on the internet, SYN packets from the computer appeared in the dump, and SYN ACK packets from the server to the computer also appeared. I checked the firewall log, the traffic was passed to the server, but the packets going back out was dropped. What I don’t understand is that for the incoming traffic, the source and destination is shown as:

Source Destination
[Internet-Device-IP]:[Random-Port] [Server-LAN-Address]:[Server-Port]

However, the dropped traffic shows

Source Destination
[pfSense-WAN-Address]:[Server-Port] [Internet-Device-IP]:[Random-Port]

I don’t know if this is normal or has anything to do with it being dropped, but I was expecting the source to be [Server-LAN-Address]:[Server-Port] so I thought that was strange and could be something to consider.

Also, according to pfSense, the rule that triggered the drop were:

@4 scrub on pppoe0 all fragment reassemble
@4 block drop out log inet all label “Default deny rule IPv4”

If I understand how pfSense firewall works correctly, the second line means that the traffic did not match any rule so it got denied by the default policy – but this did not happen without the limiters set, so why would having limiters changed how rules are applied? I checked the state table and there were 2 states with status CLOSED:SYN_SENT and ESTABLISHED:SYN_SENT for the internet device to the server with that port, so there could not have been a problem with states either. Does it have anything to do with the nature of the limiters – a limit of the limiter maybe? Or am I doing anything wrong? Basically I couldn’t connect to the server because the request was sent but the reply got dropped by the pfSense. What is going on? If anyone knows an answer to this and could clear up my understanding of how this whole thing works I would appreciate it very much.

If my initial problem of limiting clients’ connections to the server could be implement in any other ways (a more correct way perhaps?) please tell me! The –- LONGER VERSION --- section is just me being curious why my method did not work and trying to understand how pfSense works.

Thank you in advance!

Usually you open it up to allow initial synchronization, and then throttle it back for incrementals.  He needs to determine the size of the dataset he's sending per day and then break it down to see how much bandwidth he has to play with, how much he can dedicate to the backup job, and how long it will take at that rate.  Then he can craft a limiter that gives it just enough bandwidth to complete the daily job in the allotted time.

@vindenesen:

@georgeman:

…
shaping multi-LAN does not work as you expect. For reasons and an explanation on how the shaper works, check this post I have just written.

Regards!

Sorry if this is considered hijacking a thread, but just one small question: Does this apply to all shaping disciplines? I'm considering using the PRIQ shaper in a LAN party (which will have multiple subnets/VLANs) to prioritize gaming and other important traffic to/from the Internet. The Internet connection speed will be 1Gbps, if that makes any difference.

Yes, it is the same for any scheduler since this is originated from the fact that you cannot have the same queue applying to multiple interfaces simoultaneously. Since download is "shaped" (and I put it in between quotes because you cannot really shape download, but do some TCP based tricks) on the LAN side, you are actually having multiple download pipes not communicating with each other

@klou:

Thanks for all of your help.

klou, did you get this working correctly?  Just wondering . . .

Fun he says.. LOL.  Nah I read you, this QoS/Shaping stuff is damn confusing enough without the GUI lying to me hehe.

I don't think there is anything you can do about it. If you haven't noticed any in-game issues or network gameplay features not working then I really wouldn't be concerned.  It may be as simple as a heartbeat check for game clients that are no longer there.

I haven't played with L7 rules as it seems extremely complicated, and you have to know packet byte-patterns etc.

little update: i have rebooted my pfsense and now all is ok.

Ok ping, ok limiter.
But i have another problem, i hope that is a little problem.

in my case i have:

wan - pfsense guest03 - lan1
                                  - lan2
                                  - lan3

If i try to ping from lan1 to lan2, it run. But this is not right, because each lan is for one customer.

I try with this step:

i created aliases with: Type: network(s) and 192.168.0.0 CIDR 16, in this mode i have all local lan in an alias. i created 3 rule for each lan, in this mode:
                a) pass from LAN net to LAN net – no limiters
                b) block from alias to alias -- no limiters
                c) pass from LAN net to any --- with limiters

Now, i have a good ping, i have my limiters and i cannot ping other lans from my lan.

But i want ask: can i do this with Interface Groups?
I thins that this is more simple and fast. One rule for all interfaces!

Tnx for your reply

Floating rules are used in conjunction with a traffic shaper to allow you to apply rules regardless of interface (the rule "floats" above the interfaces, so to speak.)  Typically, you use it to shunt traffic in to a particular queue but you can also use it to shunt that same traffic into a limiter.

I have the rule setup on the lan side.  With a single host which is his ip and at the bottom theres a choice for a limiter and i added the inbound and outbound limiter.

At the top of the list.

When i get a chance today ill take some screen shots.

Limiters are assigned using firewall rules via the In/Out section under Advanced features.  Bittorrent can be very hard to trace because the torrent clients these days use encryption and that can't be handled by a layer7 rule.  You might be better off using an opposite approach where you elevate known traffic like web and mail, and all others can be limited or shaped.

The old pfsense shapper was one idea easy for configuration.

From what I understand, a limiter is just a dumb pipe that will limit all traffic routed to it to its maximum capacity, and not per client/server.  IN on the WAN interface means traffic coming from the Internet, OUT means traffic destined to the Internet.  Set your OUT to 10MB/s, set rules to move your server WAN traffic to the limiter, put them under load and see it it holds steady at ~10MB.

Don't be concerned about packet drops.  When you have an active shaper in place, drops are expected when the router is under load.  You want packets from your lower-priority queues to get dumped in favour of packets from higher queues when there is contention or service guarantees to maintain.  That's how the whole thing works.  If you don't have any drops, you likely don't even need traffic shaping at all.

per second