@Yanisss: i gave high priority to gaming in general because i didnt find where to prioritize any port or ip adress, and lower everything else :-X What is your real-world upload & download bitrate? What is your configured QoS upload & download bitrate? Which queueing algorithm did you choose? and any other useful information. If you haven't read this already, you should: https://doc.pfsense.org/index.php/Traffic_Shaping_Guide

Using a quick & dirty limiter, if anyones interested :- Create an upload & download limiter via Firewall -> Traffic Shaper ->Limiters Create a firewall rule to pass traffic through the interface, Firewall -> Rules -> Interface In my case I'm limiting the GUEST Lan to 2 Mbps and they can only access the Internet. In the above rule that was created goto Advanced Options and add the 2 limiters to the IN / OUT pipe. View the limiter info via  Diagnostics -> Limiter Info and run a speed test Log in to see the screenshots :)          

If all the VLANs have the same subnet mask you should get a separate pipe for each, say, /24 mask in the limiter config. If putting them on LAN mask on source addresses on the in limiter (user uploads) and dest addresses on the out limiter (user downloads).

Oh ok, I understood you right the first time around and my suggestion still applies.  Create a limiter of 60 Mbps and create a LAN firewall rule to push the traffic from just that one client into the limiter.  The limiter will ensure that it can use up to, but not more than, 60 Mbps. You could accomplish the same goal with a properly-configured HFSC shaper, but it would be MUCH more complex than a limiter.

It's a known bug that some graphs shows twice as much as the actual traffic.

@Nullity: Matching traffic is primarily a firewall rule issue not a queues issue. If floating rules did not work, there would be many people reporting problems, but they aren't… When did I say queues match traffic? I never said either that it doesnt work full stop, I said 2 things. 1 - The FreeBSD documention does not state to use match rules for traffic classification for shaping purposes. So basically my results match what the developers of PF have documented.  But they do not match what the pfSense developers have documented. 2 - It isnt working in my case with my configuration. It is a strange way to decide if something is a bug just based on that it works for many people.  It may make it less likely to be a bug if it affects less people but it doesnt make it impossible. As I said before to you KOM, you have not requested any details of me.  I have already provided lots of information. I provided the following. step by step process to get to where I am information on my network setup information on my wan setup what options I chose in the wizard the hardware I am using I even now have posted screenshots of my floating rules, which would only be requested when someone doubts what I am saying. Also this thread is different to the other thread and we should avoid mixing the 2 up. This thread was a simply question on the correct syntax to give to PF on how to match ack packets. I of course asked it as I mistakenly thought they were not been matched due to incorrect flags in the rules before I discovered it was the 'match' issue.

Update on the issue, I think I found how to determine whether a queue will work or not.  First, here is one that is working.  This is in Diagnostics, Limiter Info.  Notice that each queue shows a speed next to it for a pipe: Now compare that to one that has broken outbound traffic.  The Outbound queue shows no speed So if you have issues where traffic isn’t flowing properly on a PFSense, check the queues to make sure they all have speeds associated with them.  If they don’t, go to the queue that isn’t working (usually easy to find by process of elimination by queue speed) and convert the values you set to Kbits instead of Mbits.  Hit save.  If you check Limiter Info again, and you see that the queues all have the correct speed values you should be OK to enable the firewall rule.   [image: working.PNG] [image: working.PNG_thumb]

Just a quick follow up on this. I've been doing some speed test on the upload & download with and without the limiters applied. With the limiters applied, the PC is restricted to the limits set.. so this does appear to be configured correctly.

It is ok, this was just a broken laptop that someone stepped on. I was just bringing life to it. This stuff is more of a hobby. I will look into some other things. It is a huge step up from the Cisco Valet M10 v1 router. Thanks for all the help.

Can you share a screenshot of qInternet and qP2P on your WAN and LAN?

Don't use the dedicated links wizard.  Use the other one instead, single-wan/multi-lan or whatever.

Shrug, it's beta. Regardless, if you want limiters working with NAT, that's the only viable option.

Also remember to enable the limiters before trying to use them. It's easy to overlook that 'enable' checkbox that needs to be set on the limiter settings.

Thanks man, although,  I did search  - but the solutions provided were to situations quite unlike mine. And then there were differing opinions expressed within the threads. So,rather than bork up my network the nth time this weekend,  I thought I'd hazard a question here. I will definitely research what you suggested. Thanks again.