• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Per IP traffic shaping–share bandwith evenly between IP addresses??

Traffic Shaping
75
172
137.2k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    blablablablabla
    last edited by Jun 18, 2013, 3:26 AM

    I would like to share something that has annoyed me literally for years.

    In m0n0wall you can check a box called "share bandwidth evenly on lan", which performs some utter magic that does QoS based on IP address NOT traffic type. It works 1000x better than any other traffic shaping i've tried because it only screws up the connection for somebody abusing it, not everyone else. It creates a dynamic queue for each IP address and gives them equal priority, which results in VERY even sharing when multiple users are trying to max out the connection, yet still allows someone to go all-out when nobody else needs bandwidth.  It doesn't seem to exist in PFSense. WHY WHY WHY WHY WHY WHY WHY????  I have been using m0n0wall for years and missing out on a lot of great features because PFsense doesn't support it.

    google is filled with people asking questions about various firewalls providing this exact feature. Traditional service based QoS is great when you have a couple computers trying to do VOIP and stuff, but IP based QoS is much more effective when you have 20+ users connected or multiple people streaming netflix.

    PLEASE ADD THIS CHECKBOX TO PFSENSE

    1 Reply Last reply Reply Quote 0
    • F
      foxale08
      last edited by Jun 18, 2013, 4:30 AM

      Pfsense has equivalent functionality with limiters.

      http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

      1 Reply Last reply Reply Quote 0
      • B
        blablablablabla
        last edited by Jun 18, 2013, 5:44 AM

        @foxale08:

        Pfsense has equivalent functionality with limiters.

        http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

        Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

        1 Reply Last reply Reply Quote 0
        • F
          foxale08
          last edited by Jun 19, 2013, 1:14 AM Jun 19, 2013, 12:44 AM

          @blablablablabla:

          @foxale08:

          Pfsense has equivalent functionality with limiters.

          http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

          Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

          I have implemented exactly what your talking about by using two parent limiters (up and down) and creating three child queues under each (the child queues are for each of my three lan subnets. The upload child queues have a 'source address' mask set and the download queues have the 'destination address' mask set.) I set the default pass rules for said subnets to use their appropriate child queues.

          I do not know if the limiters will behave in the desired fashion if you are assigning traffic directly to a parent limiter, even with the mask set. At the very least, a single child queue, used in the way I am, would work.

          1 Reply Last reply Reply Quote 0
          • W
            wdbrs
            last edited by Sep 3, 2013, 1:50 PM

            @foxale08:

            I have implemented exactly what your talking about by using two parent limiters (up and down) and creating three child queues under each (the child queues are for each of my three lan subnets. The upload child queues have a 'source address' mask set and the download queues have the 'destination address' mask set.) I set the default pass rules for said subnets to use their appropriate child queues.

            I too am interested in setting up a fair speed sharing system like this in pfSense.  I'm a bit lost though.  Foxale08, is there documentation of this child queue of limiters feature available somewhere?  If not, could you explain a bit how this works?  First off, my scenario involves basically a simple home network but with many devices, maybe 20 at a time.  Do I understand correctly that your approach would require an extra child queue and rule for each device to share among them evenly?  I have devices coming and going frequently, so I want a system that will automatically and equally share with whatever devices happen to be there at the moment, and doesn't require manual setup for each new device.

            And blablablablabla, have you tried this approach, if so did it work for you?

            Thanks

            1 Reply Last reply Reply Quote 0
            • T
              taktje
              last edited by Sep 4, 2013, 8:57 PM

              this would be nice for a hotspot setup.
              somebody got this  working or is it better to use monowall?

              1 Reply Last reply Reply Quote 0
              • E
                eri--
                last edited by Sep 5, 2013, 8:33 AM

                Check the mailing lists of pfsense i have described there how to do this setup.

                1 Reply Last reply Reply Quote 0
                • T
                  taktje
                  last edited by Sep 5, 2013, 9:49 AM

                  cannot find IT.
                  do you have a link?

                  1 Reply Last reply Reply Quote 0
                  • T
                    Tillebeck
                    last edited by Sep 12, 2013, 7:47 PM

                    I came from m0n0wall as well. That "share evenly on LAN" is the best checkbox ever made.
                    Would be so nice to have in pfsense. More than nice.

                    1 Reply Last reply Reply Quote 0
                    • F
                      foxale08
                      last edited by Sep 17, 2013, 6:31 PM

                      I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

                      1.0.JPG
                      1.0.JPG_thumb
                      1.1.JPG
                      1.1.JPG_thumb
                      1.2.JPG
                      1.2.JPG_thumb
                      1.3.JPG
                      1.3.JPG_thumb

                      C M 2 Replies Last reply Nov 20, 2019, 5:03 AM Reply Quote 0
                      • F
                        foxale08
                        last edited by Sep 17, 2013, 6:32 PM

                        continued

                        2.0.JPG
                        2.0.JPG_thumb
                        2.1.JPG
                        2.1.JPG_thumb
                        3.0.JPG
                        3.0.JPG_thumb

                        1 Reply Last reply Reply Quote 0
                        • F
                          foxale08
                          last edited by Sep 17, 2013, 6:33 PM

                          continued 2

                          3.1.JPG
                          3.1.JPG_thumb
                          3.2.JPG
                          3.2.JPG_thumb
                          3.3.JPG
                          3.3.JPG_thumb

                          1 Reply Last reply Reply Quote 0
                          • F
                            foxale08
                            last edited by Sep 17, 2013, 6:34 PM

                            continued 3

                            4.0.JPG
                            4.0.JPG_thumb
                            4.1.JPG
                            4.1.JPG_thumb
                            5.0.JPG
                            5.0.JPG_thumb
                            5.1.JPG
                            5.1.JPG_thumb
                            5.2.JPG
                            5.2.JPG_thumb

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfNoobNum9000
                              last edited by Sep 28, 2013, 7:37 PM

                              Thanks foxale08!  This setup seems to work great.  Allows full bandwidth use if the connection is idle and splits it fairly if its not.

                              Worked great at a LAN party.

                              1 Reply Last reply Reply Quote 0
                              • M
                                myke
                                last edited by Oct 14, 2013, 3:16 PM

                                Hi,

                                I tried this setup on pfsense 2.1 but it seems to be the same way with and without the limiter.

                                The bandwith is not separetely equally for each computer.

                                I'm not sure it's working correctly.

                                Ermal,

                                I found a post of you on the mailing list :

                                http://lists.pfsense.org/pipermail/list/2011-December/000980.html

                                is this post ?

                                Best regards.
                                Myke.

                                1 Reply Last reply Reply Quote 0
                                • G
                                  georgeman
                                  last edited by Oct 15, 2013, 10:15 PM

                                  Even if it can be manually configured with the limiters, the checkbox looks indeed as one of "the best checkboxes ever created".

                                  +1 to add this functionality to pfSense in a future version :)

                                  Anyway I will try to configure it as indicated by foxale08 and report back my findings. Maybe at least we can come up with a tutorial

                                  If it ain't broke, you haven't tampered enough with it

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    Hercules201
                                    last edited by Oct 16, 2013, 10:21 AM

                                    @blablablablabla:

                                    @foxale08:

                                    Pfsense has equivalent functionality with limiters.

                                    http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

                                    Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

                                    That CAN NOT be the problem The computers connected with 1Gb/s nowadays trying to send it to router/modem with usually no more than 10-100Mbit will cause latency issues. That is what you want to fix. Unfortunately pfSense trafficshaping DOES NOT WORK. Because it would have fixed the problem if you limited trafic to 9Mbit or whatever and then ALL QOS ENABLED devices you have obeyed it. If you DON'T HAVE QoS enabled devices like LINUX, BSD, OSX then it DOES NOT WORK!!!(and that's why monowall ip based is a very good solution). If QoS is not CORRECTLY IMPLEMENTED in pfSense it WILL NOT WORK.

                                    PLEASE FLAME ME ON THIS IF YOU CAN

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      georgeman
                                      last edited by Oct 16, 2013, 9:59 PM

                                      What?? The traffic shaper works, and works great. It could get somewhat tricky to properly configure if you lack the proper knowledge, but it works. It doesn't matter if the devices are QoS aware or not. Queueing occurs at the router

                                      If it ain't broke, you haven't tampered enough with it

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        foxale08
                                        last edited by Oct 23, 2013, 11:04 PM Oct 23, 2013, 11:00 PM

                                        @Hercules201:

                                        @blablablablabla:

                                        @foxale08:

                                        Pfsense has equivalent functionality with limiters.

                                        http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

                                        Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

                                        That CAN NOT be the problem The computers connected with 1Gb/s nowadays trying to send it to router/modem with usually no more than 10-100Mbit will cause latency issues. That is what you want to fix. Unfortunately pfSense trafficshaping DOES NOT WORK. Because it would have fixed the problem if you limited trafic to 9Mbit or whatever and then ALL QOS ENABLED devices you have obeyed it. If you DON'T HAVE QoS enabled devices like LINUX, BSD, OSX then it DOES NOT WORK!!!(and that's why monowall ip based is a very good solution). If QoS is not CORRECTLY IMPLEMENTED in pfSense it WILL NOT WORK.

                                        PLEASE FLAME ME ON THIS IF YOU CAN

                                        Some of what you are saying is correct. Latency occurs where bottlenecks are present, the limiter is an artificial bottleneck. QOS can control latency and delivery priority but only at points designed to do so. QOS can only effectively control latency for higher priority packets. As far as I know, the pipe based limiters discussed in this thread are content agnostic, basically they don't care about QOS. It's not so much as the limiters don't work, they work as designed, just not the way you thought they did. It might be possible to use the QOS aware traffic shaper and the limiters on the same firewall rule such that the traffic shaper has limits set at the WAN max up/down, not to shape but to prioritize packet delivery to the pipe based limiter. This could work if packets are handled by the traffic shaper prior to being handled by the pipe based limiter and that the traffic shaper completely passes all packets in the highest priority queue before passing packets in sequentially lower queues.

                                        If I had my way I would like to see the pipes use the ECN flag and be QOS aware.

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          blablablablabla
                                          last edited by Mar 6, 2014, 8:29 AM

                                          I'm back again to revive this thread from the dead :) . Still stuck on M0n0wall waiting for a reasonable solution to this.

                                          Here is the issue:
                                          With m0n0wall bandwidth is shared equally per ip when you check that box by dynamically creating a queue for each ip address.

                                          • it is NOT a limiter. Each person gets the whole pipe unless one or more IP's is trying to max it out, then it treats them as queues and transfers data fairly.

                                          • You can get a similar effect in PfSense by creating two queues of equal priority and assigning one to each IP address. However you must do this MANUALLY for each ip on lan.

                                          • For the life of me I cannot figure out how to get PfSense to do this without manually creating a queue for each ip address on the lan. This is a pain in the ass and not even possible with how many different devices I have on my network

                                          For those of you that haven't tried the feature in M0n0wall I can say it is incredibly valuable. Without it our network would be completely unusable due to heavy bittorrent and netflix traffic. We upgraded our network repeatedly until our speed was 50 megabits down and no matter what somebody would be downloading a patch on WoW or Steam or streaming something and our ping would skyrocket to 1000+. Therefore no matter what the PfSense advantages are I cannot switch without such a feature. It would also be great for hotspots, keeping a single user from soaking up all the bandwidth without liimiting everyone to a low speed all the time.

                                          ppplleeeaaseee show me how to do this.  foxale08's solution doesn't seem to work and the post on the mailing list I found basically tells you how to limit each user to a certain bandwidth. I don't know how many people are on the network at any certain time so I cannot reliably set a limit per person to keep the link from saturating. Also it's quite a waste of an expensive 50 megabit connection when almost nobody is online

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.