Try and uncheck this for each queue in your traffic shaper: Explicit Congestion Notification Then test again. You will probably see that you now get close to your max speed. Aparently the "Explicit Congestion Notification" need all network equipemnt to be configured just right to work as intended. If just one piece of equipment drops packets at a lower treshold your will see significantly lower speeds. Please try and post your findings

Turns out, I was still getting a few ACK drops on my WAN connection with bandwidth set to 30%.  I've slowly inched it up to 38% bandwidth and I no longer appear to be getting ACK drops when both my upload and download bandwidth are saturated.

Hello I do have a similar issu update: My setup is all IPv4. But still similar to your issue. The issue may not be specific to IPv6 at all…. First issue First of all, there seem to be trouble with the limiters. I set a limiter for 50Mbit down and 100Mbit up. Later changed to 55Mbit down and 50Mbit up. In limiter info it says: limiter 1: 55Mbit (from after I changed the speed) limitre 2: 100Mbit (from before I changed the speed) Now how is that possible? Second issue When doing a speedtest I get aprox. 50Mbit throughput in download (thats is fine with a 55Mbit limiter) But I get an initial 40-45Mbit upload fast dropping to somewhere between 10 and 17Mbit during the test. [image: limiterissue.png] [image: limiterissue.png_thumb]

I have just finished configuring this option. http://people.pharmacy.purdue.edu/~tarrh/Transparent%20Firewall-Filtering%20Bridge%20-%20pfSense%202.0.2%20By%20William%20Tarrh.pdf Turn pfsense into bridge mode with firewall filtering turned on, this then allows all public IP's to be on the LAN side of the bridge and the limiter rules specified in the LAN firewall rules also still work. Fantastic!

@georgeman: Bear in mind that L7 filtering puts a heavy load on you CPU… What hardware are you running on? You might be short on CPU power Hi, thanks for your reply. I'm running a Quad Core Xeon. Pretty sure the CPU usage never peaks really.

Is it really that hard to do it ? I might only need a guide I could read… Please help Thanks

Sorry, I didn't clarify. I did mean for you to shape the VPN itself and not the traffic going into the tunnel.

Thank you for your answer. But actually, as i have set high priority for IPSec protocol itself, everything i pass through the tunnel is automagically high priority. Did you enable priority on both IPSec protocol itself and the ports / protocols that goes through the tunnel ? Or did you only apply queues on the inside of the tunnel ? Thanks.

ISA server had that on every rule you specified. Loved that possibility!

Thanks very munch for the reply

I solved my own problem. I'm telling what i did and what i use for a reference for other people. I had an ADSL connection with 830 kbit upload limit and 8 Mbit download limit (i tested with speedtest.net). I had to set traffic shapers upload limit to 450-500 kbit to prevent high packet loss. Besides of that from LAN to WAN upload bandwidth was almost getting doubled. Setting upload limit to 500 kbit was reducing my upload capability. It should be around 800-850 kbit. Solution: I had set pfsense's BOTH lan and wan's MTU to 1454 and MSS to 1414. I also set my Nas4Free (which is on 24/7) rig's and my main computer's MTU to same values. These steps solved the problem, i raised my upload limit to 800 kbit, packet loss is between 0% and 4% under heavy upload and download. According to my research these values are normal. Still problem: From LAN to WAN upload graph is still getting doubled, for example under heavy upload i see a graph revolves around 800-900 kbit under LAN, and 1.40-1.60 Mbit graph under WAN. It doesn't affect the internet or network though but  it still remains a mystery to me

@jpalacio: Hi all: I am using the latest amd64 version 2.1 and I am trying to configure some limiters . I found that there is a limit of 30 limiters, when trying to add the 31st , it comes with an error  " you need at least one bw specification". I've checked the shaper.inc code and certainly its limited to 30 limiters : Line 3045  of shaper.inc for ($i = 0; $i < 30; $i++) {                         if (!empty($data["bwsched{$i}"])) {                                 if ($data["bwsched{$i}"] != "none")                                         $schedule++;                                 else                                         $schedulenone++; https://github.com/pfsense/pfsense/blob/dda9c67f7f8fdc3401a0d3c7b885630d128e2fbb/etc/inc/shaper.inc#L3045 Is this right?? Any advice on how to manage the situation when you want to use more than 30 limiters?? Thanks No one???  :'( :'(

As far as I know, vmxnet3 via the official vmware tools doesn't support altq. I think vmxnet2 using the open-vm-tools package might, but I can't confirm or deny it either way 100% I wouldn't count on it being supported though.

I also posted a blog on creating a firewall rule to place traffic into a specific queue; not sure if this will help: http://pfsensesetup.com/traffic-shaping-rules-in-pfsense-2-1/

Hi LiquidSmoke Can the clients ping to the wan ? We had a smiliar issue already. Check out this thread http://forum.pfsense.org/index.php/topic,67012.0.html regards supermega

I have the same problem! :(