@Harvy66: QoS only works when you go from fast to slow. Unless you have a 10Gb internet connection, your 1Gb LAN is going to make it not work correctly. Thanks Harvy66, I've seen some of your responses on other PRIQ posts which have helped me understand a few things on traffic shaping. With what you said, would it be best to have LAN bandwidth set to 24Mbps instead of 1Gbps?  I've seen some conflicting comments on the bandwidth being below Internet speed and some either not set or being higher.

Thank you very much  Derelict for confirming.  I've now adjusted my firewall rules per your suggestion.

Was trying to follow along, but if you test whatever your scenario is and you ping from your LAN, is there any load going on? You shouldn't really see much difference at all from a few pings with no utilization. The purpose of Traffic Shaping would be to prioritize and ensure that key hosts/ip/protocols/etc get bandwidth when they need it. I ensure that ICMP/DNS/my XBox all get a dedicated part of my pipe regardless of what anyone else is doing in the house. You wouldn't bypass traffic shaping, you'd use it to prioritize or 'carve' out part of your pipe to ensure you get that allocated.

Your issue sounds similar to this:  https://redmine.pfsense.org/issues/7116

That is correct. The firewall must be enabled to use any sort of traffic shaping.

So if the interface LAN has a queue bandwidth of 40mbit, that would mean DMZ to LAN would get put in the default queue?

Those who are not afraid to experiment, welcome to https://forum.pfsense.org/index.php?topic=126637.msg699341#msg699341 Thanks to qubit, everyone now can try playing with FQ_CODEL at least.

I just wanted to say THANK YOU.  I've been like a whole month searching for this and couldn't find it anywhere and you were kind enough to not only state the exact same problem I was having but also to show up with a tutorial. You're pure gold !

You can't use limiters with policy routing. You'd have to use floating rules to set limiters to match outbound traffic on the WANs in order to limit with policy routing/failover/LB The problem with doing that on 2.3.x and 2.2.x is that limiters have some problems there where you can't use limiters on rules that perform NAT, which would cause the traffic to be dropped. We've fixed that on pfSense 2.4, which is currently in beta

[image: YsbKHg1.gif] I think ISP fixed something.

I met the same issues. Thank you guys! have a nice day!

pki would you conside hfsc to simply limit the bw ? I followed the approach suggested here for multi wan and hfsc: https://forum.pfsense.org/index.php?topic=120380.0 Not tested it on pipes, though but it may work. Let you know if I get chance to try it out in my test lab. A

dropped packet inbound, which means the receiving computer will not report the chunk of data as arrived as pfsense will have prevented the packet been passed on, so the ack never gets sent back to the sender, as a result the sender will backoff as it will assume its congestion.

This post is a litte bit old, but i had success configuring a limiter in a floating rule. The options used in my case were: Action: Match Direction: in Protocol: any Source: any Target: NOT internal_networks Schedule: working_hours In/Out: UploadLimiter/DownloadLimiter The idea was to limit every PC to a maximum BW usage (which requires the limiters to be configured in a certain way). I tested it with speedtest.net, and it limited upload and download ok.

Yeah, I'd like to see a simple solution to this as well. For now, I just cap the iOS device's upload to like 40%.

What I did for plex is go to floating rules copy the high priority rule for https and put the plex port 32400. btw I gave http high priority in the wizard