I have been study and exploring about pfsense.  I like it very much but in a lost to configure and implement. Scenerio: Wan1 - 2M w Public IP Address Wan2 - 2M w Public IP Address 一LAN ???????

indeed,  there are no internet routers in the mix, but there is an ipsec tunnel.  that might explain it.  thanks for helping me talk it out.

Yes, just in the semicolon separated list of custom options put dev tun99;

Thanks for the info. Please keep us updated.

The easiest way is what the previous message described. Just disable nat and leave the firewall inspection in place and setup rules allowing free flow of traffic. I use several pfsense firewalls this way.

The RRDs would be more accurate than looking at interface stats at the shell, since they will persist across reboots and don't roll over/reset like the interface counters (which wrap after a while) Relying on RRDs could end up worse because you think you're protected and it would almost always estimate low (especially with missing data) so you'd nearly always exceed what you expected.

I have about the same setup as devnull, and the same issues, i have read that the traffic shaper just will not work for multiple lans in 1.2.x. But i just have to find a solution!! no i can't go to a beta 2.0 i would love too but i just can't yet. What i have been thinking lately is setting up a 2nd pfsense box in front of my existing and using it just for shaping.  My only problem is that i just can't seam to get my head around if i'm on the right track. How can i configure PF sense to pass all my public ip traffic from one IF to the Next, traffic shape and not consume one of my public IPs. basically looking for a transparent firewall. I know i'm just missing one piece that is going to make it click i just need a kick in the butt to get me going. Anyone got a big boot to help me out.

Run the traffic shaper and enable the catch all rule and input the lowest kb speed for up and down that you want.

Actually, traffic shaping works both ways even if installed at one side of the link for any application that has flow control (like everything over TCP). A traffic shaper will take all incoming packets (with or without data - including TCP acks) and will release it according to the bandwidth min/max/priority policies that were set. This way, for example, ISPs can shape uploads with nothing installed at the subscriber home. Azi Ronen - The Broadband Traffic Management Blog - http://broabandtrafficmanagement.blogspot.com/

I can confirm that. I moved from 1.2.2 to 1.2.3 and ping issues started with nearly the same configuration. That kind of suck cause I mainly choosed pfsense for it traffic shaper and it seems that the stable version with proper shaper would be 1.2.2 only which is somehow not stable on my net5500 box :(

Well I'm quite fresh after the wizard and in the Rules tab all qOthersH are higher then the qp2pDown or qp2pUp so I guess we have different results with similar setup  :-[

Traffic shaping doesn't work properly on 1.2.x with multiple WANs, this is one of its well-known limitations. You can't fix the problem you are seeing without making traffic shaping essentially useless on the downstream side. You can upgrade from 1.2.x to 2.0 without any problems, or that is the goal. It won't be out "shortly" though, it's several months away from anything like that.

No, that doesn't work on 1.2.x. If you need to do complex shaping tasks, you really should try out the 2.0 BETA.

From what I've heard, Skype is particularly hard to classify. Like bittorrent, its clients don't always use the same port, and it opens whatever it wants via UPnP. However you can set a specific port inside of the skype client. With only 10 people it wouldn't be hard to ensure that they were all set to use a small range of ports, and then manually set those ports to make it into the proper queue. That doesn't solve the problem of the outgoing traffic, which will still be to a random client port, but it may at least help.

thanks for your reply ermal,any documentation about new shaper?