@steveits said in bufferbloat / limiter = hair pulling:

ely 2.5.1 should be out shortly (days

im wondering if after i upgraded to 2.5.0 things started happening . i cant confirm .

ill keep looking , thanks for the info all

@bigtfromaz After further investigation this appears to be an upgrade issue. The Rule in question was disabled during the upgrade. Apparently there was a breaking change somewhere along the way and the upgrade process did not fix up this rule. I made an innocuous change to the rule and saved it. The syntax errors stopped.

To be sure, quality has suffered recently, especially with IKEv2 tunnels. It's causing us concern.

Here is the first finding:

When these rules active, pfsense can not make any connection to internal or external endpoints.

I was trying to deprioritize a specific download (IP) tonight and having trouble. I found if I view Diagnostics/States the states are shown with the server IP (behind pfSense) as the destination (on both WAN and LAN). If I set the floating rule to use the IP as the destination, it puts the traffic in the qOthersLow queue. So I suspect the state bytes count is the count of the inbound URL request (several dozen bytes), and not the amount of the traffic actually going into the queue (multiple GB of download).

@emikaadeo In case your not aware already, the limiters are applied per gateway meaning if you apply limiters on your WAN gateway it does not apply to your VPN gateway regardless of being on the same interface. There is also several threads on using the same limiter on multiple gateways and none seemed to be able to get it to work if i remember right.

Seems to be resolved in 2.5

@jimp Thanks, will do!

There is an issue that has been identified with dynamic IPv6 gateways (for example, if you use DHCPv6 to obtain an address/prefix). The gateway is not being populated properly behind-the-scenes, which has a ripple effect to other areas in pfSense, including gateway selection in rules, which I believe is what all here are experiencing.

There is no fix available yet (the fix for "dpinger" was to manually specify a monitor address, but that won't have an effect on gateway selection in rules), but if you want to track the bug: https://redmine.pfsense.org/issues/11454

@vmac I know it’s not much help, but I’m getting the same after upgrading to 2.5.0 with an igb driver.

I seem to recall somewhere in the docs that Netgate recommends using the same speed measurements everywhere but I couldn't find it in a quick search. I don't seem to recall that issue though.

The traffic shaper wizard should do that by default for you. https://docs.netgate.com/pfsense/en/latest/trafficshaper/index.html If that's all you want you can basically ignore the other options (e.g. VoIP or P2P).

@scurrier I'm glad that I was able to help! I spent so much time doing my head in on this one hehe, glad to have saved someone else some of the headache.

Take a look further down on https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html#creating-limiters in the Creating section and it may describe it better. Masking to the IP creates one limit per IP and as I understand it masking to a subnet would create a bucket for that subnet to share. "When set to none, the limiter does not perform any masking. The pipe bandwidth will be applied to all traffic as a whole."