@teamits But they try to fit new packets in the queue by dropping new ones (tail drop) or randomly (Random Early Detection), right? Or I got it wrong?

@adrianx

in the mean time you could try and find the differences between the DDOS packets & the good packets by doing packet captures (& analyzing them in wireshark)

@oliver42
the ftp itself works fine, problem is limiting the bw at the router side
i actually made a tcpdump right before making this post and looked at it in Wireshark, but not sure what to look for that will help me limit it

not sure if it matters, but found out its not just glftp, seems like all FTPS traffic is a problem (happening when using filezilla on a windows machine also)

@ipfftw
this is old but is it still working for you? I do not see any screenshots, probably cause this is so old...

@gcon Post above supposed to say "and TUN_LT2_GT1 OpenVPN tunnel is admin disabled), " but I'm now getting spam blocked from too many edits.

@rj said in Traffic Shaping on SG-5100:

Couldn't all the traffic shaping be done on the WAN interface since that is where the real bottleneck is

Shaping happens when packets leave an interface. (https://docs.netgate.com/pfsense/en/latest/trafficshaper/index.html#traffic-shaping-basics)

@tman222 when using limiters I disabled all altq shapers, using tail drop for management algorithm, worst case weighed fare queue for schedulers.
When using shapers I was using hsfc. Default queue size from wizard.

So...

I deleted and recreated limiters, etc. from scratch, now BW is throttled as expected. Gotta love computers.

All I had done previously was uncheck "Use this limiter and children" and check "Disable this rule" in the Floating Rules and it seemed to break it for good.

@thondwe said in Two Lans - ones an invisible LAG!?:

so LAGG not supported by queues - fair enough.

Hello,

https://docs.netgate.com/pfsense/en/latest/interfaces/lagg.html

4b0b98a3-f992-4d74-902e-8b455f068515-image.png

Looks like support for ix drivers and ALTQ might be fixed in 2.5.0?

See last comment at end of:
https://redmine.pfsense.org/issues/7378

@tiger-0 said in Access Point Bandwidth Management:

We are hoping to have things less work by limiting the bandwidth per access point instead of the user

Just put limiters on each LAN interface.

@edmond

I am just using PfSense for the PPPoE part. I have an external Freeradius server runnning on Ubuntu 18.04.

You need to add the dictionary as per the "redmine" link in a post before this one.

See https://redmine.pfsense.org/issues/11102

@Modesty How much the protocol is universally used for illegal or legal activities isn't relevant, you're making an assumption of your tenants use which unless you have data, or notices from your ISP could be incorrect. For example, you mention they use Steam, Steam uses the BitTorrent protocol to distribute data between players so they may not be doing anything illegal at all. I would say though that if the legal ramifications are a concern then you should consider having your tenants subscribe to their own service rather sharing yours. Depending on your ISP you might also be breaching your ISPs ToS by providing service to tenants not leaving you in a great defensible position should they be up to no good post gaming.