Alternatively, make use of Aliases and 'Not'. Create an Alias with the subnets of LAN A, B & C. Call this alias:  LocalSubnets In your firewall rule(s) applying the limiter(s), just set the destination as "Not" (checkbox) Alias "LocalSubnets". Depending on how many rules you have applying limiters and all, either of the methods would be simpler to apply.

That's an alternative. BT traffic is not a big issue for me, I just wanted to prioritize regular traffic over BT when needed more than setting a hard limit to it. I was mostly trying to figure what I did wrong with the traffic shaping because as far as I can tell I set it up correctly, but for some reason the rules are not being applied correctly and the bulk of BT traffic still goes to the default queues.

You can't easily apply it as a per-interface limit, but you can setup a pair of limiters and direct all traffic to/from the subnet on that interface into the limiter (basically edit any rule passing traffic from/to that subnet and use the limiters on it), and get that effect.

Deagle, that is a really awesome feature.  I doubt that pfSense can do this though since all the matching happens when a connection is first setup, and then applies to the state record, so that the system doesn't need to process any more of the packets.  But the layer7 stuff must be able to look at enough of the traffic to try and match the contents and then change the queue, so maybe there is a way. If you look at pftop, it does track the bytes transferred for each state, so the info is there.  So it is probably possible for some sort of daemon to run every so often and to associate a state with a new shaper queue. I would suggest you ask on the freebsd networking list to see if freebsd supports it, and then you could open a bug/feature request to have the ability added to pfsense. I've noticed that youtube opens a new connection for each chunk of a movie though, so it would somewhat lessen the impact depending on how big the chunks are. Josh

Sorry but this isn't currently possible, I wish it was.  The traffic shapers on different interfaces/vlans cannot communicate with each other, so there is no way to allow one interface to use bandwidth until another interface needs it. You can easily setup each vlan to only allow a certain amount of download bandwidth with the wizards.  So you can setup each vlan to only allow 7Mbit/s Dividing up the upload bandwidth is harder since that all has to happen on the wan interface queues.  You can only shape traffic that is being transmitted. You will need to manually create queues, and then create rules that assign traffic to those queues based on which vlan the traffic is coming from. Josh

Good! ;) Kostas

Did any of you ever get an answer on this? I just went to set up some basic PRIQ shaping for VoIP and noticed the same thing. All the documentation states the 1 is the highest priority, 7 lowest, but pfSense seems to set it the complete opposite.

Hi, I tried this, but all the traffic went into the low priority queue. Is this because I had an 'Allow Any Any' on the LAN interface firewall rules?  I have at least one network where the requirement is that the traffic be shaped only, no egress filtering - how would I do this? Are you supposed to integrate the shaping rules into your regular firewall rules, or keep them separate in the Floating tab? Thanks, Todd

I'm not an expert by far but you'll find in the Firewall Rules -> Floating Rules where the wizard puts your VoIP queue rules. You can copy those and adjust them to make them work for FTP. As far as I understand it, usually if there is no VoIP traffic, other traffic will be able to use the whole pipe. I didn't use CBQ though so it might vary by the type.

Do not hijack threads. Start a new thread to ask new questions.

Hello, I just set floating rules for WAN and others interface but it doesn't have the result expected. In fact, the bandwidth is too much limited but I'm looking for bandwidth guarantees. What is the key to have bandwidth guarantees ? Thanks, Arnaud

No one?