Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Traffic shaper changes

    Scheduled Pinned Locked Moved Expired/Withdrawn Bounties
    34 Posts 7 Posters 31.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wcoolnet
      last edited by

      I changed my mind. I'll donate $200

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        This is a great idea.  Hope some others can find this feature useful and donate.  I know the author of the original shaper is sorta burned out atm so this may get him interested again :)

        pfSense will donate 50$ to the project.

        1 Reply Last reply Reply Quote 0
        • B
          billm
          last edited by

          BTW, I'm the original author.  I have the test gear for this (if I can figure it out!) and have spent some time thinking about the shaper code recently and have worked on some code that I'm hoping will help us perform layer 7 shaping (a seperate project altogether).  As Scott said, getting the shaper code to the point we're at was kind of time consuming and draining.  If there's serious interest in this, I'm willing to dedicate some time on this.

          –Bill

          pfSense core developer
          blog - http://www.ucsecurity.com/
          twitter - billmarquette

          1 Reply Last reply Reply Quote 0
          • S
            sai
            last edited by

            I've read up on the ALTQ theory and its really mindbendingly  difficult!

            Would the new code handle more than one interface? If yes then $100 from me to be added to the bounty.

            1 Reply Last reply Reply Quote 0
            • N
              Numbski
              last edited by

              I'll check around to see if I can rustle up some funding here too.

              1 Reply Last reply Reply Quote 0
              • C
                Christian
                last edited by

                I'll donate $75, if the new traffic shapper support the following:

                • shapping an all interfaces
                • shaping traffic inside individual IPSEC tunnels, that is tunnels terminating at the local pfsense box.

                I might be able to donate more if it will be somehow possible to route traffic depending on the amount of traffic queueing. What I mean, is something like this:
                Route everything through IPSEC tunnel X on Interface 1, prioritise VoIP. If there isn't enough bandwidth available, route everythoing except VoIP through Interface 2 instead of Interface 1.

                Christian

                1 Reply Last reply Reply Quote 0
                • W
                  wcoolnet
                  last edited by

                  We're at $425  :o

                  1 Reply Last reply Reply Quote 0
                  • W
                    wcoolnet
                    last edited by

                    If interest grows anymore, I think we should have a section on the wiki to keep track of specific features that we want implemented into traffic shaping.

                    1 Reply Last reply Reply Quote 0
                    • B
                      billm
                      last edited by

                      I wanted to comment on this one specifically as there are certain limitations.

                      @Christian:

                      I'll donate $75, if the new traffic shapper support the following:

                      • shapping an all interfaces

                      Consider this on the list.  I'm struggling trying to figure out how to implement this in HEAD with the new bridge infrastructure (you can bridge more than two interfaces…essentially making a firewalling switch)

                      @Christian:

                      • shaping traffic inside individual IPSEC tunnels, that is tunnels terminating at the local pfsense box.

                      This may not be possible.  ALTQ works outbound on the interface.  While we could in theory shape the traffic coming in to your network via the tunnel (assuming you aren't doing tunnel to tunnel routing), the best we could do for outbound is shape the entire tunnel.  The traffic is already encrypted by the time it hits the WAN interface and can't be inspected to see what ports it's on.

                      @Christian:

                      I might be able to donate more if it will be somehow possible to route traffic depending on the amount of traffic queueing. What I mean, is something like this:
                      Route everything through IPSEC tunnel X on Interface 1, prioritise VoIP. If there isn't enough bandwidth available, route everythoing except VoIP through Interface 2 instead of Interface 1.

                      Hmmm, that digs into kernel space that I don't think I can modify in a satisfactory way.

                      –Bill

                      pfSense core developer
                      blog - http://www.ucsecurity.com/
                      twitter - billmarquette

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by

                        Please, lets keep this thread on track.  I know everyone is excited for new features but this bounty is for a filtering altq bridge only.  We can address the new kitchen sink down the road.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wcoolnet
                          last edited by

                          To give you an idea of what I need:
                          T1 line multiple IPs
                              |
                          pfsense (bridge)
                              |
                          router–-------------------------------------------------------------
                              /                            \                  \                           
                          workstation lan ip        mail1        webserv2                  server3(voip)

                          I need pfsense to manage my bandwidth. Give VOIP the highest priority, mail the lowest, have a fast web browsing experience when the bandwidth is available, etc. So I would need port and ip based shaping.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mrt_ok
                            last edited by

                            hi guys,

                            I would donate $1000 after my first successful deal with the transparent shaper box.

                            my requirements are low:
                            just shaping in bridged mode (two interfaces) to give certain services the QoS they need (e.g. web / citrix / shh etc…)

                            kind regards,
                            mrt_ok

                            1 Reply Last reply Reply Quote 0
                            • W
                              wcoolnet
                              last edited by

                              Would it be possible to make this work on a larger scale?
                              For example: OC12 connected to a few hundred servers in a datacenter. PfSense would limit the maximum amount of bandwidth each ip could use…

                              If this can realistically be done, then the funding options for pfsense would dramatically increase.
                              This could open the door to companies with lots of money, as they could use pfsense on their own infrastructure.

                              1 Reply Last reply Reply Quote 0
                              • S
                                sullrich
                                last edited by

                                @mrt_ok:

                                hi guys,

                                I would donate $1000 after my first successful deal with the transparent shaper box.

                                my requirements are low:
                                just shaping in bridged mode (two interfaces) to give certain services the QoS they need (e.g. web / citrix / shh etc…)

                                kind regards,
                                mrt_ok

                                Sorry but we need the cash up front.  We have already been fooled into believing this from others and the policy now is half is due up front and half on completion.  With this many people pooling their funds together we will need to gather the money up before starting the project.  Sorry!

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sullrich
                                  last edited by

                                  @wcoolnet:

                                  Would it be possible to make this work on a larger scale?
                                  For example: OC12 connected to a few hundred servers in a datacenter. PfSense would limit the maximum amount of bandwidth each ip could use…

                                  If this can realistically be done, then the funding options for pfsense would dramatically increase.
                                  This could open the door to companies with lots of money, as they could use pfsense on their own infrastructure.

                                  Per user bandwidth is a little more difficult.  ALTQ does not have a per user distribution classifier so it would require a rule and queue for every user which is not doable in your case (it sounds like).

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wcoolnet
                                    last edited by

                                    Would it be possible to limit any connection to any server to something like 10Mbps?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sullrich
                                      last edited by

                                      @wcoolnet:

                                      Would it be possible to limit any connection to any server to something like 10Mbps?

                                      Yes.  1 rule + queue.

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        wcoolnet
                                        last edited by

                                        Question:
                                        100 servers connected to oc12. all are web servers. 1 server is experiencing a traffic spike and receiving thousands of connections.

                                        Is there no way to prevent a single server from hogging the entire oc12, using altq?

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sullrich
                                          last edited by

                                          Again, 1 queue and 1 rule per server or ip.

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            billm
                                            last edited by

                                            @wcoolnet:

                                            Question:
                                            100 servers connected to oc12. all are web servers. 1 server is experiencing a traffic spike and receiving thousands of connections.

                                            Is there no way to prevent a single server from hogging the entire oc12, using altq?

                                            You'll need a queue per server (I expect that we'll need a wizard for that…or a way to branch the existing wizard code...not terribly difficult) to make this work.  Then all you do is specify realtime guarantee's on each queue such that each web server is guarantee'd a certain amount of bandwidth, but could burst to whatever limit you set (or don't set).

                                            --Bill

                                            pfSense core developer
                                            blog - http://www.ucsecurity.com/
                                            twitter - billmarquette

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.