Per User Bandwidth through Radius.
-
-
chillispot can also be made to use pf, although to what extent I don't know at this point. There were patches for this under freebsd earlier this year that (I think) were committed. Everything I've seen so far shows only NAT and L3 rules. IT would likely be able to be made to talk to tables using pftabled or perl or something, but I don't see any indication of if that is currently the case.
I think what sullrich wants to know is what mechanism you are using to actually perform the QoS (ipfw, pf, some kind of weird alchemy or magic, etc.).
We understand where you are getting the data from to create the rules (radius). If you post your stuff I'm sure it can be reverse engineered to see what it does. -
i am using pf not ipfw.
-
i am using pf not ipfw.
In that case is it using altq to enforce the bandwidth speed limits? We are looking to reverse engineer how this works.
-
don't understand the "reverse engineer". in any event, anyone who wants futher assistance getting it install on their box we should take it offline as to not ramble on in this thread. send me a pm, and ill help as much as I can.
-
Uhh, what else is this forum for? I would rather keep this public. If you do not wish to help us out that is fine but its not going to be taken private.
-
I am very interested in this but would prefer it if it was a proper pfsense package that way any changes in updates to the pfsense software will not result in this feature failing.
I did a little google search on chillispot this is what i came back with www.chillispot.info i think it is the package the mdouglas has used to make this work.
Thanks everyone
-
We want to add these types of features to our captive portal in the future. If someone could setup this package on a local system and get the per user bandwidth features working and show the altq/pf/ipfw configuration it would be a HUGE help for us. I would take the time to do it but I have 100 tasks currently in play on top of our pending 1.2 release.
-
don't understand the "reverse engineer". in any event, anyone who wants futher assistance getting it install on their box we should take it offline as to not ramble on in this thread. send me a pm, and ill help as much as I can.
Reverse Engineer in this case just means to look at your work and see what you've done to gain any info we either didn't think to ask or you weren't able to provide. I'm willing to look at this and I actually have a little time at the moment (dunno how long it will last till the next thing comes up, though) so if you'd be so kind, I'd really like to at least see your php gui code. Having everything you've done would be optimal. Feel free to PM it to me or email me directly if you must but I'd much rather keep it in the forum since I tend to get pulled away from stuff and don't want it to get dropped.
-
Just wanted to say I would love to see this project going somewhere good.
-
A quick guess says it has ALTQ_WFQ on :)
Not really difficult to port and extend.
Anyone interested buying me some time to do this!But i really would love to buy me some time for other cooler things like a 2 level shaper on pfSense.
One level does per user bandwidth the other on the whole traffic priorization.
If you think its worth it i will give you for bonus ipp2p(p2p traffic identification) for free ::) -
Ok i looked at the code quickly and it is all usermode and it uses a bare and bones leaky bucket algorithm for shaping(in user mode!!!). So it should be slow and not recommended by me for many users.
The shaper in user mode would be directly substituted to dummynet freebsd even gaining features.
-
@eri--:
Ok i looked at the code quickly and it is all usermode and it uses a bare and bones leaky bucket algorithm for shaping(in user mode!!!). So it should be slow and not recommended by me for many users.
The shaper in user mode would be directly substituted to dummynet freebsd even gaining features.
Okay, thanks for checking. I am not sure we want to do this in userland.
-
I've been thinking about this a little more. I'm probably out of place here, but this would be fairly simple using flow data and tables (yeah, I know I've said this before and never actually done it). It would require something like perl to munge the flow data so it probably wouldn't be self contained enough to work on the embedded platform, but nether would the coova stuff since it required sql. I'm still playing catchup so I'm not sure. Does pfsense do tables (even in RELENG_1 or HEAD)? I know it was on the roadmap but last time I looked (2006-ish) it wasn't yet available.
-
What you want to use flows for?!
Per user bandwidth?! (if yes, don't bother it is not the right solution)Something else, please explain i am not following.
-
@eri--:
What you want to use flows for?!
Per user bandwidth?! (if yes, don't bother it is not the right solution)Something else, please explain i am not following.
I beg to disagree. I've used flows to control user (IP/MAC) bandwidth for years and years with much success. It's not perfect by any means but I challenge you to find anything that doesn't control windowing to do a better job.
Coupled with static DHCP mappings it works exceptionally well. The key is the goo that reads and writes the QoS rules based on the flow data. -
On FreeBSD netgraph offers the tools to do what you want, but i am resaying this that there are better ways of doing it.
-
@eri--:
On FreeBSD netgraph offers the tools to do what you want,
Yeah, either netgraph or pfflowd could be used. I've always had problems with netgraph personally but I have not tried it in a while.
@eri--:
but i am resaying this that there are better ways of doing it.
I welcome any and all suggestions.
-
I am going to tweak my setup alittle and modify my admin gui to support the ability to auth to remote radius/mysql server. There are a couple of reasons for this idea.
#1, will provide an alternative to the CP embedded in pf. (won't debate if it is better or worse). I have recently complied a pfsense ver of coova-chilli which is the sister to chillispot. Chillispot has been a dead project since 2005.
#2, will support being installed on an embedded device since mysql will be remote. (cf r/w issues)
User management will still need to be done with whatever method you choose. Certainly you could install freeradius right in pfsense and use the pf gui to admin freeradius. Certainly will leave the door open to customization. Like I have said before, I don't know now to write a true pfsense package, but ill zip up the coova package & php files. I am assuming I can just attach the file right to this thread.
thoughts?
-
If memory serves me right, chilli spot is able to do its own packet switching, on userland.
Can WE (Myself included if i can develop with PASCAL language) develop a traffic shapping tcp/udp proxy ?
I dont need help with the daemon part, i have lots of experience developing tcp/ip apps with freepascal/synapse but i will need help to package and put this thing to work with pfsense…
-
If memory serves me right, chilli spot is able to do its own packet switching, on userland.
Can WE (Myself included if i can develop with PASCAL language) develop a traffic shapping tcp/udp proxy ?
I dont need help with the daemon part, i have lots of experience developing tcp/ip apps with freepascal/synapse but i will need help to package and put this thing to work with pfsense…
Absolutely. We can use until someone creates a kernel version of it. Or if you could create a kernel facility?
Either way, sounds great. How would we invoke the userland portion? Ipfw divert?
-
There are two ways i can think of :
A tun/tap device or a tcp and a udp proxy.
a tcp and udp proxy requires that all packets be diverted to the proxy (just like squid) but its somewhat more tricky because it needs to divert ALL ports (So the daemon will have to either install itself on all ports - not realistic - or use raw sockets…)
the tun/tap devices looks more promising, but i need to understand how to setup it using the bsd calls...
imagine the following :
[real lan device] -> pf rule to forward everything to TAP0 -> [TAP0 device … per ip bandwidth management ... TAP1 device] -> pf rule to forward everything to real WAN device
using two pairs of tap devices (one for downstream other for upstream) we can make bandwidth manager on userland.
easier yet : use two pairs of tap devices for EACH ip, so the cpu intensive task of ip checking goes to the kernel device were the code is more tight written…
but I dont know what are the performance penalties of having so many TAP devices...
- a tap device is a software only ethernet device, so we can even shape by packet/sec instead of byte/sec (packet/sec seems to be the thing that makes emule/similars kill my network...)
http://en.wikipedia.org/wiki/TUN/TAP
hmmmm seems most of the work is already done... vtund is able to speed shape...
http://vtun.sourceforge.net/
theres an option "Speed" where the speed can be limited, bet it doesnt uses dummynet because vtund is portable across multiple operating systems...
attached diagram...
-
I wonder if one could use netgraph to create virtual interfaces and pass it through them for similar purposes as opposed to using the vtun stuff. I've been reading a lot about ng and it seems to be created for purposes such as this, and should be pretty fast since it is all done in-kernel.
-
The problem is that developing for the kernel has a range of consequences, a bug can kill the system in a myriad of ways… on userland, at least, most critical work is already done for us...
-
The problem is that developing for the kernel has a range of consequences, a bug can kill the system in a myriad of ways… on userland, at least, most critical work is already done for us...
I totally agree, thats why netgraph is so cool, it allows for hooks into it with minimal impact. Granted, I'm not a netgraph expert, but everything I've read and done with it has worked really well. It's certain;y worth investigating as a "hook" into the existing system that was meant to do similar tasks.
I'm a poor developer but I can volunteer any insight I have into using NG.nb
-
even using ng, the fact that the program runs on kernel space makes it possible that a bad subscript in an array (for example) be able to overwrite other parts of the kernel… i dont like kernel programming, its too damn critical (and the fact that it must be done using C guarantees that I WILL make a mistake with pointers/arrays...) Java & Pascal have a lot of ways to avoid that classes of mistakes (unfortunately they are slower than plain C, java being the slowest)
PS.: Im a bad C programmer, most of what i did using C was in the university... But a good kernel programmer can very well write this for us, but if someone is willing to program this, the same person could just help debug the kernel PFIL ordering issues and solve the original problem...
-
even using ng, the fact that the program runs on kernel space makes it possible that a bad subscript in an array (for example) be able to overwrite other parts of the kernel… i dont like kernel programming, its too damn critical (and the fact that it must be done using C guarantees that I WILL make a mistake with pointers/arrays...) Java & Pascal have a lot of ways to avoid that classes of mistakes (unfortunately they are slower than plain C, java being the slowest)
I'll defer to your expertise, I'm a poor programmer at best. =)
-
I have a basic idea of how to solve this :
A binary captive portal app that upon login builds an TAP device for this specific user and transfers packet by packet to a (time based) bucket on the secondary TAP device (wich needs to be just one…) and vice versa. Unlogged users cant get routed trought the "virtual wires" inside de app, so it is left up to the rest of the system rules if this guy will navigate the internet...
i developed a small http(s) server using Freepascal/Synapse, now im translating tun/tap lib headers to allow me to write a "virtual wire" using it...
LAN -----> TAP1 ----virtual wire with speed control/captive portal functionality----> TAP0 -----> WAN or whatever.
In max 1 month i will come back with news...
-
Amazing, I started this a while back, had to abandon PFSense for m0n0 good to see it taking off!!!
-
Nice, now i have a virtual switch/hub :D
my little program creates two virtual ethernet devices : tap0 and tap1 and swaps packets from one another…
it doesnt do any traffic shapping yet. but... its the basis for some tests...
it is running on linux, but freebsd does have tun/tap drivers, only their setup is somewhat different (not much).
who can help me test this concept on a linux box ?
-
When you are ready to test on FreeBSD let me know. I cannot assist in Linux however.
-
This is great guys can't wait for it to be ready. Just what I'm looking for
Thanks
-
Hi Guys
Would just like to know how the development is coming along?
Can't wait to use it.Thanks
-
Any updates? I'm also very interested!
I am currently experimenting with Esomo (also a FreeBSD mod: esomoline.com), which basicaly gives me the features that I'm looking for (userbased upload/download limit), but I don't like the way you have to authenticate (users have to set up a VPN connection to get through to the internet, and the webbased login-apllication doesn't seem to work all the time).
-
It wiil be a very nice function, I'm also interested, is somebody still working on this, or exists a Bounty?
regards
Alfredo -
It is on my list for 1.3 though support wouldn't hurt ::)
-
Ok im A Wireless Internet Service Provider in my area serving over 250 people with internet but i have no control of my bandwidth m0n0wall has the feature but because we offer voip thou T-Mobile it wont work so i have to have two server one m0n0wall for normal login and pfsense for voip otherwise im sol this is a pain all i got to say is i've alot of great idea's of which has not been started or people are holding the feature to them selves which makes me mad so people get together like a team to come up with a solution to this matter it is very simple im new to freebsd/linux/unix and i have a degree im computer information system's and tech. so let come up with a common ground to where this will work in the web gui some people do not know how to program im still learning this new style but im taking the time to read books and the internet to see if a feature or php add on can be made to the index.php to make another like link to do per user bandwidth setting. If we get together with what we know how to do then each person can work on a part of it then a set of people can work on the kernel to come up with a featute package to add on to it.
-
Ok i've started a bounty so let all get involed.
http://forum.pfsense.org/index.php/topic,9068.0.html -
well, i abandoned this project because someone else demotivated me saying he was working on a kernel land patch to make pf work with dummynet (this is the REAL solution to this problem, but is damn complex).
I have some work to do (actually a lot) this month and most of my projects are stopped. After this critical month i can come back to this.
But IIRC the major obstacle for this userland traffic shaper was to get a good shaping algorithm…
Other solution i thought was to use pf pipes.
take my virtual "switch/hub" and place queues relative to the up/down sides, something like this :
tap0 is the virtual ethernet device that faces upstream
tap1 is the virtual ethernet device that faces downstreamaltq on tap0 bandwidth <sum of="" all="" clients="" upstream="" bandwidth="">queue ( <one queue="" per="" user="" ip="">)
queue bla bla bla // setup each user queue upload speedaltq on tap1 bandwidth <sum of="" all="" clients="" downstream="" bandwidth="">queue ( <one queue="" per="" user="" ip="">)
queue bla bla bla // setup each user queue download speedI.E. : Use pf own altq to shape traffic by using the virtual devices as "hooks"
then forward all incomming traffic on lan to the downstream face :
pass in on lan forward-to (tap1, tap1ip) bla bla bla (make this work with a table that lists users logged on the captive portal)
pass in on lan bla bla bla (redirect non-logged users to the captive portal, based on a table that lists non-logged users)</one></sum></one></sum> -
For all of you people that have waited for this so long lets just make you happy.
This will be available on 1.3.http://cvstrac.pfsense.com/chngview?cn=22567