Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tutorial : Per user bandwidth captiveportal (BW berbeda utk spesific username)

    Indonesian
    4
    24
    12.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      anto_DIGIT
      last edited by

      Sebaiknya dilakukan dulu langkah di
      http://forum.pfsense.org/index.php/topic,26122.0.html
      utk mengaktifkan squid ZPH
      misal :

      • username : admin,  BW down : 384kBps
      • username : guest, BW down : 128kBps
        username lain sesuai dng setting di GUI …
        modifikasi di usr/local/captiveportal/index.php (line 290)

      if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                 $bw_down_pipeno = $ruleno + 45500;
                 exec("/sbin/ipfw pipe 30012 config bw 384Kbit/s queue 100");
                 exec("/sbin/ipfw pipe 30022 config bw 128Kbit/s queue 100");
                 if ($username=='admin')      {
                           exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out not iptos reliability");          
                 else if ($username=='guest')      {
                           exec("/sbin/ipfw add $ruleno pipe 30022 all from any to $clientip out not iptos reliability");          
                 } else {
                           exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out not iptos reliability");
                           exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
                 }
                 exec("/sbin/ipfw pipe 30002 config bw 4Mbit/s");
                 exec("/sbin/ipfw add $ruleno pipe 30002 all from any to $clientip out proto TCP iptos reliability");
      } else {
                 exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");

      OPTION :
      Kemudian, jika meinginkan username guest bisa digunakan utk 10 client, modifikasinya adalah sbb
      set melalui GUI service:captiveportal:

      • Maximum concurrent connections = 9
      • Set "Disable concurrent logins"
        dan di usr/local/captiveportal/index.php (line 255) :

      _       elseif ((isset($config['captiveportal']['noconcurrentlogins'])) && ($username != 'unauthenticated') && ($username != 'guest') ) {
                 /* on the same username /
                 if ($cpdb[$i][4] == $username) {
                     /       This user was already logged in so we disconnect the old one */
                     captiveportal_disconnect($cpdb[$i],$radiusservers,13);
                     captiveportal_logportalauth($cpdb[$i][4],$cpdb[$i][3],$cpdb[$i][2],"CONCURRENT LOGIN - TERMINATING OLD SESSION");
                     unset($cpdb[$i]);
                     break;_

      Selamat mempraktekkan …

      1 Reply Last reply Reply Quote 0
      • K
        kuroishounen
        last edited by

        SANKYU SENPAI ^_^

        1 Reply Last reply Reply Quote 0
        • C
          ceprit
          last edited by

          thx pak tutornya keren, salam kenal
          sekalian mau tanya boleh ga ? :D
          klo per ip address bandwith caranya gmn yah

          1 Reply Last reply Reply Quote 0
          • A
            anto_DIGIT
            last edited by

            @ceprit:

            thx pak tutornya keren, salam kenal
            sekalian mau tanya boleh ga ? :D
            klo per ip address bandwith caranya gmn yah

            Kenapa harus per IP ? bukannya lebih leluasa per username … ? Kalau PFSENSE 2 beta, tanpa modifikasi sudah tinggal pakai ..

            1 Reply Last reply Reply Quote 0
            • A
              afry
              last edited by

              mohon petunjuk
              bro punyaku kok ngak ngaruh yah… user yang dibatasi tetep aja bisa ngedownload lebih dari bandwidth yang dibatasi...
              ini usr/local/captiveportal/index.php punya ku yang sudah diedit sesuai petunjuk bro anto

              if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                          $bw_down_pipeno = $ruleno + 45500;
              exec("/sbin/ipfw pipe 30012 config bw 384Kbit/s queue 100");
              if (($username=='nugraha_mahardika') or ($username=='giaartcraft') or ($username=='guest'))  {
              exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out proto not iptos reliability");
              } else {
                          exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out not iptos reliability");
                          exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
              }
              exec("/sbin/ipfw pipe 30002 config bw 8Mbit/s");
                                  exec("/sbin/ipfw add $ruleno pipe 30002 all from any to $clientip out proto TCP iptos reliability");
                      } else {
                          exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");
                      }

              sya coba melimit bandwidth untuk 3 orang user
              mohon koreksi kalau ada yang salah scriptnya..
              setelah coba saya bandingkan salah satu user (guest : terlimit 384Kbit/s) dengan user yang tidak di limit bandwidth nya… kecepatan downloadnya sama bro
              mohon pencerahannya
              terima kasih

              1 Reply Last reply Reply Quote 0
              • A
                anto_DIGIT
                last edited by

                Coba jangan terlalu besar dulu, misal 192kB/s.
                coba lihat di system log, mungkin ada yg error …

                if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                        $bw_down_pipeno = $ruleno + 45500;
                        exec("/sbin/ipfw pipe 30012 config bw 384Kbit/s queue 100");
                        if (($username=='nugraha_mahardika')||($username=='giaartcraft')||($username=='guest'))  {
                                    exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out not iptos reliability");
                           } else {
                                    exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out not iptos reliability");
                                    exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
                           }
                           exec("/sbin/ipfw pipe 30002 config bw 8Mbit/s");
                           exec("/sbin/ipfw add $ruleno pipe 30002 all from any to $clientip out proto TCP iptos reliability");
                           }
                } else {
                           exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");
                       }

                1 Reply Last reply Reply Quote 0
                • A
                  afry
                  last edited by

                  @anto_DIGIT:

                  Coba jangan terlalu besar dulu, misal 192kB/s.
                  coba lihat di system log, mungkin ada yg error …

                  if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                           $bw_down_pipeno = $ruleno + 45500;
                           exec("/sbin/ipfw pipe 30012 config bw 384Kbit/s queue 100");
                           if (($username=='nugraha_mahardika')||($username=='giaartcraft')||($username=='guest'))  {
                                       exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out proto not iptos reliability");
                              } else {
                                       exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out not iptos reliability");
                                       exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
                              }
                              exec("/sbin/ipfw pipe 30002 config bw 8Mbit/s");
                              exec("/sbin/ipfw add $ruleno pipe 30002 all from any to $clientip out proto TCP iptos reliability");
                              }
                  } else {
                              exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");
                          }

                  makasih atas responnya, di system log saya tidak melihat ada error… ok bro skrg saya lagi coba dengan bw kecil dulu...nanti saya laporkan hasilnya
                  terima kasih

                  1 Reply Last reply Reply Quote 0
                  • A
                    afry
                    last edited by

                    lapor bro anto, dicoba dengan bandwidth kecil pun 64Kbit/s tetap sama… alias tidak pengaruh bro
                    saya lampirkan dengan percobaan satu user (guest), ditest download hasilnya tetap sama dengan user yang tidak dilimit, yaitu dikisaran 200-400 Kb/s
                    if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                                $bw_down_pipeno = $ruleno + 45500;
                    exec("/sbin/ipfw pipe 30012 config bw 64Kbit/s queue 100");
                    if ($username=='guest')  {
                      exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out proto not iptos reliability");
                    } else {
                                exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out not iptos reliability");
                                exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
                    }
                    exec("/sbin/ipfw pipe 30002 config bw 8Mbit/s");
                                        exec("/sbin/ipfw add $ruleno pipe 30002 all from any to $clientip out proto TCP iptos reliability");
                            } else {
                                exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");
                            }
                    mohon petunjuk selanjutnya
                    makasih

                    1 Reply Last reply Reply Quote 0
                    • A
                      anto_DIGIT
                      last edited by

                      @afry:

                      lapor bro anto, dicoba dengan bandwidth kecil pun 64Kbit/s tetap sama… alias tidak pengaruh bro
                      saya lampirkan dengan percobaan satu user (guest), ditest download hasilnya tetap sama dengan user yang tidak dilimit, yaitu dikisaran 200-400 Kb/s
                      if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                                  $bw_down_pipeno = $ruleno + 45500;
                      exec("/sbin/ipfw pipe 30012 config bw 64Kbit/s queue 100");
                      if ($username=='guest')  {
                        exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out proto not iptos reliability");
                      } else {
                                  exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out not iptos reliability");
                                  exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
                      }
                      exec("/sbin/ipfw pipe 30002 config bw 8Mbit/s");
                                          exec("/sbin/ipfw add $ruleno pipe 30002 all from any to $clientip out proto TCP iptos reliability");
                              } else {
                                  exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");
                              }
                      mohon petunjuk selanjutnya
                      makasih

                      Sebaiknya lakukan juga langkah berikut ini
                      http://forum.pfsense.org/index.php/topic,26122.0.html
                      utk mengaktifkan squid ZPH

                      Setelah diedit, apakah captiveportal sudah direstart ? Kalau tdk direstart … list dari rule yg lama tetap ada, jadi harus direstart utk menghapusnya. Caranya dari webgui : service captiveportal -- > klik SAVE saja ..
                      Setelah itu coba di command shell

                      ketik
                      ipfw list
                      perhatikan yg muncul adalah list dari rule

                      lalu ketik
                      ipfw pipe show
                      perhatikan yg muncul adalah list dari pipe

                      1 Reply Last reply Reply Quote 0
                      • A
                        afry
                        last edited by

                        terima kasih…
                        kalau direstart sudah bro, bahkan mesin nya pun saya coba restart
                        $ ipfw list
                        00030 skipto 50000 ip from any to any in via rl1 keep-state
                        00030 skipto 50000 ip from any to any in via rl0 keep-state
                        00500 allow pfsync from any to any
                        00500 allow carp from any to any
                        01000 skipto 50000 ip from any to any not layer2 not via em0
                        01001 allow ip from any to any layer2 not via em0
                        01100 allow ip from any to any layer2 mac-type 0x0806
                        01100 allow ip from any to any layer2 mac-type 0x888e
                        01100 allow ip from any to any layer2 mac-type 0x88c7
                        01100 allow ip from any to any layer2 mac-type 0x8863
                        01100 allow ip from any to any layer2 mac-type 0x8864
                        01100 allow ip from any to any layer2 mac-type 0x8863
                        01100 allow ip from any to any layer2 mac-type 0x8864
                        01100 allow ip from any to any layer2 mac-type 0x888e
                        01101 deny ip from any to any layer2 not mac-type 0x0800
                        01102 skipto 20000 ip from any to any layer2
                        01200 allow udp from any 68 to 255.255.255.255 dst-port 67 in
                        01201 allow udp from any 68 to 192.168.2.1 dst-port 67 in
                        01202 allow udp from 192.168.2.1 67 to any dst-port 68 out
                        01203 allow icmp from 192.168.2.1 to any out icmptypes 8
                        01204 allow icmp from any to 192.168.2.1 in icmptypes 0
                        01300 allow udp from any to 192.168.2.1 dst-port 53 in
                        01300 allow udp from any to 192.0.0.1 dst-port 53 in
                        01301 allow udp from 192.168.2.1 53 to any out
                        01301 allow udp from 192.0.0.1 53 to any out
                        01302 allow tcp from any to 192.168.2.1 dst-port 8000 in
                        01302 allow tcp from any to 192.0.0.1 dst-port 8000 in
                        01303 allow tcp from 192.168.2.1 8000 to any out
                        01303 allow tcp from 192.0.0.1 8000 to any out
                        10000 skipto 50000 ip from 202.51.232.114 to any in
                        10000 skipto 50000 ip from any to 202.51.232.114 out
                        10001 skipto 50000 ip from any to 202.51.232.114 in
                        10001 skipto 50000 ip from 202.51.232.114 to any out
                        10002 skipto 50000 ip from 192.168.2.124 to any in
                        10002 skipto 50000 ip from any to 192.168.2.124 out
                        19902 fwd 127.0.0.1,8000 tcp from any to any dst-port 80 in
                        19903 allow tcp from any 80 to any out
                        19904 deny ip from any to any
                        29900 allow ip from any to any layer2
                        65535 allow ip from any to any                         (client dengan user guest connect, dengan ip 192.168.2.124)

                        nah kalau perintah ipfw pipe show selalu keluarnya kayak gini… apa yang salah yah?
                        # ipfw pipe show
                        ipfw: getsockopt(IP_DUMMYNET_GET): Protocol not available

                        untuk mencoba digabung pake http://forum.pfsense.org/index.php/topic,26122.0.html , terus terang saya kebingungan karena bagian yang diedit pada index.php, nya  ada di baris 290 ( bagian yang sama dengan tutorial ini )… jadi bingung nempatin/ngedit nya
                        ..
                        mohon bimbingannya
                        terima kasih

                        1 Reply Last reply Reply Quote 0
                        • A
                          anto_DIGIT
                          last edited by

                          @afry:

                          $ ipfw list
                          00030 skipto 50000 ip from any to any in via rl1 keep-state
                          00030 skipto 50000 ip from any to any in via rl0 keep-state
                          00500 allow pfsync from any to any
                          00500 allow carp from any to any
                          01000 skipto 50000 ip from any to any not layer2 not via em0
                          01001 allow ip from any to any layer2 not via em0
                          01100 allow ip from any to any layer2 mac-type 0x0806
                          01100 allow ip from any to any layer2 mac-type 0x888e
                          01100 allow ip from any to any layer2 mac-type 0x88c7
                          01100 allow ip from any to any layer2 mac-type 0x8863
                          01100 allow ip from any to any layer2 mac-type 0x8864
                          01100 allow ip from any to any layer2 mac-type 0x8863
                          01100 allow ip from any to any layer2 mac-type 0x8864
                          01100 allow ip from any to any layer2 mac-type 0x888e
                          01101 deny ip from any to any layer2 not mac-type 0x0800
                          01102 skipto 20000 ip from any to any layer2
                          01200 allow udp from any 68 to 255.255.255.255 dst-port 67 in
                          01201 allow udp from any 68 to 192.168.2.1 dst-port 67 in
                          01202 allow udp from 192.168.2.1 67 to any dst-port 68 out
                          01203 allow icmp from 192.168.2.1 to any out icmptypes 8
                          01204 allow icmp from any to 192.168.2.1 in icmptypes 0
                          01300 allow udp from any to 192.168.2.1 dst-port 53 in
                          01300 allow udp from any to 192.0.0.1 dst-port 53 in
                          01301 allow udp from 192.168.2.1 53 to any out
                          01301 allow udp from 192.0.0.1 53 to any out
                          01302 allow tcp from any to 192.168.2.1 dst-port 8000 in
                          01302 allow tcp from any to 192.0.0.1 dst-port 8000 in
                          01303 allow tcp from 192.168.2.1 8000 to any out
                          01303 allow tcp from 192.0.0.1 8000 to any out
                          10000 skipto 50000 ip from 202.51.232.114 to any in
                          10000 skipto 50000 ip from any to 202.51.232.114 out
                          10001 skipto 50000 ip from any to 202.51.232.114 in
                          10001 skipto 50000 ip from 202.51.232.114 to any out
                          10002 skipto 50000 ip from 192.168.2.124 to any in
                          10002 skipto 50000 ip from any to 192.168.2.124 out
                          19902 fwd 127.0.0.1,8000 tcp from any to any dst-port 80 in
                          19903 allow tcp from any 80 to any out
                          19904 deny ip from any to any
                          29900 allow ip from any to any layer2
                          65535 allow ip from any to any                           (client dengan user guest connect, dengan ip 192.168.2.124)

                          dari  ipfw list, ternyata belum masuk rule-nya ..

                          Di CP, tab "Allowed IP" addresses jangan diisi
                          Enable per-user bandwidth restriction harus enable dan diisi .. soalnya rule tsb baru dijalankan jika itu diisi ..

                          10002 skipto 50000 ip from 192.168.2.124 to any in
                          10002 skipto 50000 ip from any to 192.168.2.124 out
                          rule di atas justru membuat bypass ..

                          seharusnya muncul :
                          pipe 30012 all from any to 192.168.2.124 out proto not iptos reliability

                          1 Reply Last reply Reply Quote 0
                          • A
                            afry
                            last edited by

                            ok bro makasih…  akan sya coba...
                            o iya bro, Di CP, tab "Allowed IP" addresses saya isi ip dns, karena kalau ngak diisi... user ngak mau redirect ke hal login CP. gpp kan?
                            trus Enable "per-user bandwidth restriction harus enable dan diisi" ini diisi Bandwidth maximal yang kita punya yah?
                            makasih atas pencerahannya

                            1 Reply Last reply Reply Quote 0
                            • A
                              anto_DIGIT
                              last edited by

                              @afry:

                              ok bro makasih…  akan sya coba...
                              o iya bro, Di CP, tab "Allowed IP" addresses saya isi ip dns, karena kalau ngak diisi... user ngak mau redirect ke hal login CP. gpp kan?
                              trus Enable "per-user bandwidth restriction harus enable dan diisi" ini diisi Bandwidth maximal yang kita punya yah?
                              makasih atas pencerahannya

                              Sebaiknya jangan, seharusnya pakai DNS forwarder
                              Begini caranya ..
                              dari GUI

                              • System – General setup -- > diisi DNS nya
                              • Service -- DNS fowarder --- > di enable semua
                              • Service -- DHCP server --- > DNS server diisi ip local server kita.
                              • Status -- Service ---> restart DNS Masq --> restart DHCP.
                              1 Reply Last reply Reply Quote 0
                              • A
                                afry
                                last edited by

                                bro anto maaf mohon analisa nya

                                $ ipfw list
                                00030 skipto 50000 ip from any to any in via rl1 keep-state
                                00030 skipto 50000 ip from any to any in via rl0 keep-state
                                00500 allow pfsync from any to any
                                00500 allow carp from any to any
                                01000 skipto 50000 ip from any to any not layer2 not via em0
                                01001 allow ip from any to any layer2 not via em0
                                01100 allow ip from any to any layer2 mac-type 0x0806
                                01100 allow ip from any to any layer2 mac-type 0x888e
                                01100 allow ip from any to any layer2 mac-type 0x88c7
                                01100 allow ip from any to any layer2 mac-type 0x8863
                                01100 allow ip from any to any layer2 mac-type 0x8864
                                01100 allow ip from any to any layer2 mac-type 0x8863
                                01100 allow ip from any to any layer2 mac-type 0x8864
                                01100 allow ip from any to any layer2 mac-type 0x888e
                                01101 deny ip from any to any layer2 not mac-type 0x0800
                                01102 skipto 20000 ip from any to any layer2
                                01200 allow udp from any 68 to 255.255.255.255 dst-port 67 in
                                01201 allow udp from any 68 to 192.168.2.1 dst-port 67 in
                                01202 allow udp from 192.168.2.1 67 to any dst-port 68 out
                                01203 allow icmp from 192.168.2.1 to any out icmptypes 8
                                01204 allow icmp from any to 192.168.2.1 in icmptypes 0
                                01300 allow udp from any to 192.168.2.1 dst-port 53 in
                                01300 allow udp from any to 192.0.0.1 dst-port 53 in
                                01301 allow udp from 192.168.2.1 53 to any out
                                01301 allow udp from 192.0.0.1 53 to any out
                                01302 allow tcp from any to 192.168.2.1 dst-port 8000 in
                                01302 allow tcp from any to 192.0.0.1 dst-port 8000 in
                                01303 allow tcp from 192.168.2.1 8000 to any out
                                01303 allow tcp from 192.0.0.1 8000 to any out
                                10000 pipe 30002 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                10001 pipe 30002 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                10002 pipe 30012 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                10003 pipe 30002 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                10004 pipe 50504 ip from 192.168.2.124 to any in
                                19902 fwd 127.0.0.1,8000 tcp from any to any dst-port 80 in
                                19903 allow tcp from any 80 to any out
                                19904 deny ip from any to any
                                29900 allow ip from any to any layer2
                                65535 allow ip from any to any
                                pipe 30012 (192 Kbit/s) diatas dah muncul, tapi kok dibawahnya muncul lagi pipe 30002 (8 Mbit/s)yah?
                                hasilnya… user guest masih sama bandwidth nya dengan user lain yang ngak dibates
                                terima kasih

                                1 Reply Last reply Reply Quote 0
                                • A
                                  anto_DIGIT
                                  last edited by

                                  @afry:

                                  bro anto maaf mohon analisa nya

                                  _$ ipfw list

                                  10000 pipe 30002 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                  10001 pipe 30002 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                  10002 pipe 30012 ip from any to 192.168.2.124 out proto tcp iptos reliability
                                  10003 pipe 30002 ip from any to 192.168.2.124 out proto tcp iptos reliability_
                                  pipe 30012 (192 Kbit/s) diatas dah muncul, tapi kok dibawahnya muncul lagi pipe 30002 (8 Mbit/s)yah?
                                  hasilnya… user guest masih sama bandwidth nya dengan user lain yang ngak dibates
                                  terima kasih

                                  Seharusnya :

                                  pipe 30012 ip from any to 192.168.2.124 out proto tcp not iptos reliability
                                  bukan
                                  pipe 30012 ip from any to 192.168.2.124 out proto tcp iptos reliability

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    afry
                                    last edited by

                                    wah maaf bro kurang teliti saya…
                                    sesuai petunjuk bro anto akhirnya saya bikin seperti ini :

                                    _if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
                                                $bw_down_pipeno = $ruleno + 45500;
                                                  if ($username=='guest' or $username=='nugraha_mahardika' or $username=='giaartcraft' or $username=='tess')
                                    {
                                              exec("/sbin/ipfw pipe 30012 config bw 256Kbit/s queue 100");
                                                              exec("/sbin/ipfw add $ruleno pipe 30012 all from any to $clientip out not iptos reliability");
                                    }
                                    else {
                                    exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out");
                                    exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");
                                        }

                                    exec("/sbin/ipfw pipe 30010 config bw 8192Kbit/s queue 100");
                                                    exec("/sbin/ipfw add $ruleno pipe 30010 all from any to $clientip out proto TCP iptos reliability");

                                    }
                                          else
                                          {
                                                  exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to $clientip out");
                                                  }_

                                    dan hasil ipfw list

                                    10000 pipe 50500 ip from 192.168.2.98 to any in
                                    10000 pipe 30012 ip from any to 192.168.2.98 out not iptos reliability
                                    10000 pipe 30010 ip from any to 192.168.2.98 out proto tcp iptos reliability
                                    10005 pipe 50505 ip from 192.168.2.164 to any in
                                    10005 pipe 55505 ip from any to 192.168.2.164 out
                                    10005 pipe 30010 ip from any to 192.168.2.164 out proto tcp iptos reliability
                                    ip 192.168.2.164 login dengan user yang tidak saya batasi
                                    nah yang membuat saya ragu adalah ip yang 192.168.2.98 (yang dicetak tebal) login dengan user guest( pipe 30012 ), tapi kok pipe nya keluar dua-duanya yah ? ( pipe 30012 sama pipe 30010 ) apakah memang seharus nya seperti itu ?
                                    atau masih ada yang salah dengan penulisan script saya diatas ?
                                    Terima kasih…

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      anto_DIGIT
                                      last edited by

                                      memang seperti itu, itu yg satu utk membypass BW limit dari squid ZPH … tentu saja setting squid-nya harus ditambah dulu dengan zph .. sesuai dng tutorial yg .. http://forum.pfsense.org/index.php/topic,26122.0.html

                                      isikan kode2 ini ke dalam Custom Options di GUI Pfsense : Services --> Proxy Server -- > General

                                      zph_mode tos;
                                      zph_local 0x04;
                                      zph_parent 0;
                                      zph_option 136;

                                      tiap IP nanti dapat sepasang :
                                      iptos reliability – > utk yg ter hit oleh proxy -- > speed 8Mbps
                                      not iptos reliability -- > utk yg ter belum kena hit proxy -- > speed standar

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        afry
                                        last edited by

                                        @anto_DIGIT:

                                        memang seperti itu, itu yg satu utk membypass BW limit dari squid ZPH … tentu saja setting squid-nya harus ditambah dulu dengan zph .. sesuai dng tutorial yg .. http://forum.pfsense.org/index.php/topic,26122.0.html

                                        isikan kode2 ini ke dalam Custom Options di GUI Pfsense : Services --> Proxy Server -- > General

                                        zph_mode tos;
                                        zph_local 0x04;
                                        zph_parent 0;
                                        zph_option 136;

                                        tiap IP nanti dapat sepasang :
                                        iptos reliability – > utk yg ter hit oleh proxy -- > speed 8Mbps
                                        not iptos reliability -- > utk yg ter belum kena hit proxy -- > speed standar

                                        wadaw… berarti dah bener yah... Alhamdulillah... beribu terima kasih untuk anda yang tidak bosan merespon setiap pertanyaan..

                                        Kalau yang ini
                                        isikan kode2 ini ke dalam Custom Options di GUI Pfsense : Services –> Proxy Server -- > General
                                        zph_mode tos;
                                        zph_local 0x04;
                                        zph_parent 0;
                                        zph_option 136;
                                        sudah saya lakukan; kalau merujuk ke http://forum.pfsense.org/index.php/topic,26122.0.html , apakah langkah selanjutnya wajib saya lakukan untuk per user bandwidth ini? karena terus terang saya lom ngerti  membuat rule firewall,
                                        Langkah 5
                                        Buatlah firewall rule utk memblok port 3128, karena jika ada salah satu client yg mengisi opsi proxy di browser bisa membypass captiveportal.

                                        dan saya jga tidak menggunakan/mengaktifkan traffic shaper.. karena emang lom mengerti mengenai itu….

                                        Terima kasih

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          anto_DIGIT
                                          last edited by

                                          @afry:

                                          sudah saya lakukan; kalau merujuk ke http://forum.pfsense.org/index.php/topic,26122.0.html , apakah langkah selanjutnya wajib saya lakukan untuk per user bandwidth ini? karena terus terang saya lom ngerti  membuat rule firewall,
                                          Langkah 5
                                          Buatlah firewall rule utk memblok port 3128, karena jika ada salah satu client yg mengisi opsi proxy di browser bisa membypass captiveportal.

                                          dan saya jga tidak menggunakan/mengaktifkan traffic shaper.. karena emang lom mengerti mengenai itu….

                                          Terima kasih

                                          Belajar2nya satu-satu dulu ya soalnya di thread ini kan hanya sampai masalah BW … kalau mengenai rule dan traffic shapping sudah banyak yg bahas ...

                                          Selamat sudah berhasil membuat custom BW management .. Terus terang saya sendiri belum pernah mencoba ini di pfsense 1.2.3 ...

                                          kalau masalah rule, itu kan sudah adau GUI-nya ... tidak susah asal mau coba ... defaultnya kan semua port dari sisi LAN kan terbuka ..
                                          Cara lain yg lebih gampang, yaitu merubah port squid 3128 dng port lain yg tdk terpakai ..

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            afry
                                            last edited by

                                            ok bro, thank's atas semua kebaikan dan ilmu yang telah dibagi… hehehe
                                            terima kasih

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.