• Transparent Squid Ignores Bandwidth Limiter Rules

    5
    0 Votes
    5 Posts
    2k Views
    perikoP

    Hi, did it work pierre_rs?

  • Traffic shaper queues do not appear on 2.1.5-amd64

    4
    0 Votes
    4 Posts
    1k Views
    A

    Ok… thank you for your confirmation.

  • Traffic shaping per users

    11
    0 Votes
    11 Posts
    3k Views
    S

    @Derelict:

    When you set the destination slots there's really no reason to set burst.  They get the full download speed unless someone else is in contention for it anyway.  Unless there's a reason you don't want someone to run free if the capacity is available, I'd just ditch it.

    Actually, looking at it, it's really not going to do much for you, because the "Limit" that's going to be applied after the burst is exceeded will be the same as if no burst was applied at all.

    Thank you once again for the explanation - I see your point. I need to study up more on this. If bandwidth is available, I'd certainly want to allow any host to run free. However, when it's peak hours, I'd like to split evenly among hosts, which is what it does now and works great. The last think I'd love to have happen is to actually have it not quite split evenly between hosts when certain hosts have been downloading steadily while others are just trying to pull up a website. I thought that was something that burst would help with but perhaps I need to configure it differently.

  • Jitter Buffer

    6
    0 Votes
    6 Posts
    2k Views
    DerelictD

    I think you're going to have a hell of a time trying to get a TDM circuit transported over a 300ms RTT VPN link.  No amount of traffic shaping is going to make that any better.  SIP trunking would probably be better, but 300ms is a lot for that too.

  • Bandwidth Limitations on Individual VLANs

    3
    0 Votes
    3 Posts
    2k Views
    DerelictD

    Do you want to set, say, a hard limit on VLAN100 of 10Mbps down or do you want the whole 45Mbps available if nobody else is using it? (The latter is harder and I'm not sure if it's even possible using the limiter when multiple interfaces/bandwidth goals are present.)

    If you switch to HFSC you will run into the multi-LAN interface config issues.  See the first part of this post for an brief explanation: https://forum.pfsense.org/index.php?topic=79589.msg434856#msg434856

  • Traffic Shaping & Squid Caching Proxy

    2
    0 Votes
    2 Posts
    1k Views
    E

    Well, there's this, https://forum.pfsense.org/index.php?topic=62188.0 but I can't say I had the best of luck with it. Then there's this which I haven't tried yet: https://forum.pfsense.org/index.php?topic=66537.msg366615#msg366615

    In theory if you can separate "traffic coming from the pfSense box to the LAN" and "traffic coming from the internet to the LAN" it "should be easy." Due (in my frustrated opinion) to the dismal, out of date, and incomplete documentation, nothing on the shaper is ever easy.  IF I grok the sense of the "short form approach for pfsense 2.1" in the second linked message (not the link to an older thing the linked message is replying to) I believe it's trying to do exactly that. But I have no idea if it actually accomplishes the desired effect or not.

    I did successfully get shaping to work, but it shaped cache hits. I don't know who would want that behavior, but it's not me.

    I strongly suggest making a backup of the configuration before you start working on the shaper, as every time I have tried to get it to shape without shaping cache hits, it's blown up in my face and needed to be reset to a working configuration from before that point.

    I'm just about ready to try tilting at this particular windmill again, which is why I'm here reading your unanswered post. I wish I could offer you a more hopeful answer, but I can't, as it's all poking at things with clear as mud directions and holes you can drive a truck through in those.

    Another approach suggested from the "olden days" is to just put squid on a separate box, i.e.
    Internet <–>pfSense (and shaper)<-->Squid (all by itself)<--> users.
    Annoying, but might be easier than trying to get this to work.

  • Traffic Shaping Question

    4
    0 Votes
    4 Posts
    1k Views
    DerelictD

    https://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

  • A good PRIQ Howto?

    20
    0 Votes
    20 Posts
    11k Views
    M

    @sideout:

    1.)  The config files you provided.  Shaper config appears to be the shaper queues, filter config appears to be the supporting firewall rules, but what is aliases?

    Seriously you don't know what aliases are after reading the tab in PFSense?

    2.)  When setting up HFSC you need to tell it how much bandwidth you have up and down to make sure that prioritization occurrs locally, rather than remotely.  I can't seem to find where this setting is in your PRIQ example.  Is it not required for PRIQ?  Only one of your queues has a "Queue limit" of 500, and it is qLink, which doesn't appear to be assigned to anything in rules.

    Multiple forums post on this - HFSC does not use the priority setting but the wizard puts it in there.  Also if you look at all the check marks on qLink you would see it is the default queue on the LAN interface so you would know that typically if there is not a rule allowing or disallowing something then it goes to the default rule.

    3.) I'm gathering from your rules that traffic rules should be floating rules?  What is a floating rule?

    Again - you dont know what a floating rule is after reading the tab in PFSense?  Plus if you went here https://doc.pfsense.org/index.php/Category:Firewall_Rules then you will see the very same question you asked answered already.

    4.) Some of your queue's are assigned to WAN and some to LAN.  Does this correspond to incoming and outgoing traffic?  Which is which?  If I had to wager a guess upstream would be on the LAN side and downstream on the WAN side.  Is this correct?

    All the queues on the floating rules tab should be assigned to the WAN interface only.  There are specific rules that get assigned to the LAN for things like the limiter.
    5.) Clicking through all of your queues, I can't seem to find where I tell the queue if it is HFSC or PRIQ?  How do I define this?

    Again you can only have HFSC or PRIQ not both.  That is defined on the interface so if you go under Traffic Shaping and read what the drop down box says , you know what you have set.
    6.) Do you recommend starting with the wizard and modifying the queues as needed from there, or creating them manually?

    I recommend creating them manually unless you dont know what you are doing then start with the wizard and choose a very basic simple setup and modify it from there.

    7.) I can see how I can assign hosts to each queue using rules.  How do I tell the system to send all other clients that have not been manually assigned to a "Default client" queue?  Is it just like other firewall rules, where I create an ALL rule at the bottom, that assigns everything that hasn't been otherwise specified to my "default" queue?

    https://doc.pfsense.org/index.php/Firewall_Rule_Basics

    8.) In your example, you have specified UDP or TCP for all of your rules.  Is there any reason I can't just tell it to apply to all protocols for the specific host?

    In my experience I have found that using a combo rule for TCP/UDP with HFSC shaping does not work that well in high packet situations.  I prefer to separate them as when using floating rules with TCP you need to define qACK but with UDP you do not need qACK.

    9.) It would seem all of your rules are associated with the WAN interface.  Some specify the source and some the destination.  I'd imagine that this is to create rules for upstream and downstream for each.  Is that accurate?  I would have expected based on the observation in #4 above, that downstream would need to be assigned to WAN, and upstream to LAN.  Is this not the case?

    https://doc.pfsense.org/index.php/Firewall_Rule_Basics

    Thank you.  I do appreciate you taking the time, and having a little patience with me.

    I think part of my problem is a terminology gap.  Been doing a lot of googling and browsing around the pfsense documentation, but obviously not for the right terms!

    This - hopefully - should point me to the right reading to understand all of this.

    Thanks!

  • Graphs from latest LAN party

    6
    0 Votes
    6 Posts
    5k Views
    S

    Final Graphs.

    nexuwanrddfinal.jpg_thumb
    nexuwanrddfinal.jpg
    nexuslanwanrddfinal.jpg_thumb
    nexuslanwanrddfinal.jpg
    nexuslanrddfinal.jpg_thumb
    nexuslanrddfinal.jpg
    NexulanPrtgfinal.jpg_thumb
    NexulanPrtgfinal.jpg

  • How to prioritize non-p2p when required

    2
    0 Votes
    2 Posts
    1k Views
    M

    The greatest difficulty lies in properly identifying p2p traffic, by which I assume you mean bittorrent. It will just move to any allowed port.

    The fact you have it on only one PC does make shaping/prioritizing possible though.

    The two ways you can go about it are use the Traffic Shaper Wizard and create a PRIQ shaper, then make a floating rule to place all traffic for that p2p PC's IP in the p2p or low priority queue. If it is the only PC using the internet it would be using all your bandwidth. As other PC's started surfing etc. their traffic would get priority over the p2p PC.

    Alternatively setting up a limiter to evenly share the bandwidth among each PC actively using the internet. Only one PC on? It gets all of it. Two? Each gets 1/2 etc. Follow this thread to set it up:
    https://forum.pfsense.org/index.php?topic=63531.msg364520#msg364520

    You can also combine both methods as well which would grant even more control and likely a better experience for those surfing when a p2p download was occurring.

  • Rule to assign all traffic based on ip address?

    2
    0 Votes
    2 Posts
    755 Views
    jimpJ

    Your rule is on WAN – NAT happens before firewall rules, including outbound NAT. The private IP you referenced is not visible in outbound WAN rules since it has been translated by the time the rule is processed.

    To match that you would need to do so inbound on the LAN interface and not outbound on WAN.

  • PRIQ QoS on HTTP/HTTPS with squid transparent proxy enabled

    2
    0 Votes
    2 Posts
    971 Views
    X

    Anyone?

  • Simple Traffic priorisation

    1
    0 Votes
    1 Posts
    901 Views
    No one has replied
  • How to limit total bandwidth per interface AND limit by individual IP ?

    9
    0 Votes
    9 Posts
    17k Views
    Z

    Hello all. I want to ask you something.
    I have this scenario. I want to put a pfsense only for QoS purposing with 2 NICs WAN & LAN but this 2 are bridged in br0 so WAN & LAN don't have ip only br0.
    I'm trying to limit my hosts download & upload speed by Queues & every host has a different speed limit.
    I make first queue on br0 with my isp speed limit and then 1 child download and other 1 upload, and into these 2 I make children for every host down and up. but rules where do i have to create them in br0 or where?.

    Sorry for my English.
    Thanks

  • 0 Votes
    8 Posts
    3k Views
    DerelictD

    When you leave the bandwidth empty on the interface, the shaper gets the bandwidth from the link speed (10/100/1000Mbit).

    If you were to take a gig-e interface and, say, define qLink as 20% and qInternet as 850Mbit, you would have a total of 1050Mbit which is greater than 1000Mbit and would generate the error.

    As qInternet approaches link speed, the wizard is going to start making mistakes.

    At least that's how I understand it.

  • Trafice shaping if it working

    1
    0 Votes
    1 Posts
    667 Views
    No one has replied
  • 0 Votes
    6 Posts
    1k Views
    B

    Ok. I've removed the bridge. same issue.

    :(

    According to the docs it should only ratelimit if the queue is congested/contested right?

    Like it says I should have 60M for my "high" priority/bandwidth queue.  Yet, it seems to be limited around 170M.  :(

  • Traffic shaping and causing bandwidth loss?

    2
    0 Votes
    2 Posts
    752 Views
    B

    Strangely I tried this on another piece of hardware at my office it SEEMS to work as expected (15 meg there = 15 meg).

    Currently tested my home setup again and set it to 300/20.  Speedtest reports 128 down and 17 up.  Remove the traffic shaper and get 300 down.

    I'm using a bridged lan interface. Could this have something to do with it? I'm setting all of my rules on the bridge.

  • Media Streaming Bypasses Limiter

    1
    0 Votes
    1 Posts
    986 Views
    No one has replied
  • Active congestion control

    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.