Check the limiters on Firewall->Traffic shaping.

Ignore me. There is always simple answer. DMZ port wasn't connected to anything. Once I plug the cable into the switch I could create rules without errors what I've mentioned in first post.
Hopefully it will help someone.

Maybe open a ticket at pfsense bugtracker http://redmine.pfsense.org/projects/pfsense attaching the full contents of your /tmp/rules.debug and shaper-related portion of your config.xml file?

Hello,
I've made this working as it should be in version 1.2.3. It was definitely down to our ISP provider as I didn't do to many changes, then we've switched over to fibre optic and QoS for VoIP is working as a charm.
Even though I'm going to switch to 2.0 version of pfsense. Already some problems with the config but overall I think 2.0 version is a way to go right now.

Thanks
Andre

and apparently you have to register on that site….

@gderf:

Where are you initiating the pins from?

I think I know where the problem comes from, it's just the pipe on my machine is probably full, all ping came from my laptop.
I'm changing the status of the post to [solved] :)

Now I am really confused.  You say you agree with me, but my complaint is that I never see anything in qACK - and that makes sense as the generated rules don't reference qACK.  ???

try to look failover and loadbalance settings for your wan connection.
and look also for policybased routing

Hi,

thanx for the info. I am searching for a good solution to block skype in our network. I don´t understand how to integrade it in L7. Can you help?

Regards, Valle

Thanks Metu69salemi.
sorry i shoudn't have asked such simple issues.
Feels like i'm being spoon feeded.
thanks anyways
kalu

Hi again,

It's look to they have a problem with the wizard and the Penalty Box, actually I don't have any queue who's maid by the wizard, just one in Firewall -> Rules -> Floating who refer to a queue who don't exist.
in this rules I don't see the Alias or the Ip I put in the wizard.

Regards

Totorux

Update your snapshot.

Hi,

need this too. Do you have a solution for this problem? Need this for the captive portal.

Thanks for the input!

I agree that the shaper wizard in 2.0 should put as much as possible in terms of % of bandwidth.

And actually after reading the forums some more, it appears as though we would have to add the qLink queue to the LAN side so that internal traffic could go from lan to vlan or vice-versa without being shaped.

I've tried messing around with pf and it appears the challenge in getting this scheme to work is to be able to match a packet coming in on an interface, regardless if it is an established connection or not.  Right now it appears that PF will only match a new connection on an interface.  Maybe the pfsense folks would have some influence over the pf developers to get this feature added?

WAN
– qInternet 1.5Mbit
---- qAck
---- qDefault
---- qVoIP

OPT1
-- qInternet 256Kbit
---- qAck
---- qDefault
---- qVoIP

LAN
-- qLink
-- qInternetWan 1.5Mbit
---- qAckWan
---- qDefaultWan
---- qVoIPWan
-- qInternetOpt1 256Kbit
---- qAckOpt1
---- qDefaultOpt1
---- qVoIPOpt1

L7 rules - they don't work so well catching torrent, and particularly utorrent. Only a very small amount of packets are identified - uTorrent encrypts its protocol and that feature is on by default mostly - so you aren't really going to be able to block it.
At our site we use the bandwidthd package to find who is using torrent and add them to a penalty box type queue. The limiters are best for that because they can be set to a per individual speed.
I have had issues that if you try to filter all your traffic via the L7 rules performance can take a hit depending on your CPU power - it was maxing out my dual core ATHLON!

Anyway, I have been trying to stop it for years.
On Zentyal firewall the L7 rules seem to work slightly better, but that thing gives you very little ability to analyse your network traffic. Even then, when you force encryption in uTorrent it becomes unstoppable.

Good luck