Try adding another processor. IF you have one, use an Intel NIC. Not heard good things about the realtek. If you didn't specify the type it defaults to e1000 for FreeBSD VMs which is good.

Ok. Btw. it would be nice if theres a different symbol for match rules in the rules list. At the moment its the same like pass rules. In the firewall log match too (theres the block icon used afair)

EDIT: question removed, did mix up my voip/vpn problem with the traffic shaper rules (thought its necessary to direct traffic to in AND out queue)

Problem exists on 2.1.0, 2.1.1 and 2.1.2.  Below is another example.  We have a 90 Mbps symmetrical link.

QueueNumbers1.jpg
QueueNumbers1.jpg_thumb

In limiter  Bandwidth = 1024kbit/s -= >
burst 256kbit/s right?

I'm on the same boat.

My first advice is play with the traffic shaper wizard. Its a start!

Mine works for awhile with traffic shaper but not the way I wanted yet.

Its difficult to work with .

match in on ovpns9 inet from 172.16.20.0/24 to 192.168.0.240 label "USER_RULE: Queue VideoConferencia" queue qVoIP_ext

The rule above seems to work, since the queue is applied to the state, so the traffic coming back would fall into the right queue.

Limiters are handled via DUMMYNET, which is documented in the FreeBSD man pages for ipfw(8).

Sadly, the traffic shaping/limiting part of pfSense is plain unusable by ordinary users. Lot of effort required into producing working wizards for common scenarios, or even a simple checkbox. People should not have to deal with manual configuration of this thing normally, since they usually end up with completely broken setup, or a setup that has no effect at all. Way too many features, way too complicated and very hard to understand. No amount of convoluted, techblurb docs is going to change this.

@Klaws:

Out of curiosity…why would you want to remove DSCP tags on ingress traffic?

Or, even more mysterious, why would an ISP add DSCP tags to traffic?

Probably nothing, but could be something similar to what my previous ISP was doing – spying on my network so they could justify billing me for having 'too many attached devices'.  Didn't realize back then there was some fine-print stating that they could bill you for having more than 3 'devices' connected to the internet.

If you get a support contract, they will do all that for you, plus you have someone to turn to if things go south.  My company just picked one up.  It's not expensive if you're responsible for the Internet for the whole building.