Per IP traffic shaping–share bandwith evenly between IP addresses??

myke

Hi,

I tried this setup on pfsense 2.1 but it seems to be the same way with and without the limiter.

The bandwith is not separetely equally for each computer.

I'm not sure it's working correctly.

Ermal,

I found a post of you on the mailing list :

http://lists.pfsense.org/pipermail/list/2011-December/000980.html

is this post ?

Best regards.
Myke.

georgeman

Even if it can be manually configured with the limiters, the checkbox looks indeed as one of "the best checkboxes ever created".

+1 to add this functionality to pfSense in a future version :)

Anyway I will try to configure it as indicated by foxale08 and report back my findings. Maybe at least we can come up with a tutorial

Hercules201

@blablablablabla:

@foxale08:

Pfsense has equivalent functionality with limiters.

http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

That CAN NOT be the problem The computers connected with 1Gb/s nowadays trying to send it to router/modem with usually no more than 10-100Mbit will cause latency issues. That is what you want to fix. Unfortunately pfSense trafficshaping DOES NOT WORK. Because it would have fixed the problem if you limited trafic to 9Mbit or whatever and then ALL QOS ENABLED devices you have obeyed it. If you DON'T HAVE QoS enabled devices like LINUX, BSD, OSX then it DOES NOT WORK!!!(and that's why monowall ip based is a very good solution). If QoS is not CORRECTLY IMPLEMENTED in pfSense it WILL NOT WORK.

PLEASE FLAME ME ON THIS IF YOU CAN

georgeman

What?? The traffic shaper works, and works great. It could get somewhat tricky to properly configure if you lack the proper knowledge, but it works. It doesn't matter if the devices are QoS aware or not. Queueing occurs at the router

foxale08

@Hercules201:

@blablablablabla:

@foxale08:

Pfsense has equivalent functionality with limiters.

http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

That CAN NOT be the problem The computers connected with 1Gb/s nowadays trying to send it to router/modem with usually no more than 10-100Mbit will cause latency issues. That is what you want to fix. Unfortunately pfSense trafficshaping DOES NOT WORK. Because it would have fixed the problem if you limited trafic to 9Mbit or whatever and then ALL QOS ENABLED devices you have obeyed it. If you DON'T HAVE QoS enabled devices like LINUX, BSD, OSX then it DOES NOT WORK!!!(and that's why monowall ip based is a very good solution). If QoS is not CORRECTLY IMPLEMENTED in pfSense it WILL NOT WORK.

PLEASE FLAME ME ON THIS IF YOU CAN

Some of what you are saying is correct. Latency occurs where bottlenecks are present, the limiter is an artificial bottleneck. QOS can control latency and delivery priority but only at points designed to do so. QOS can only effectively control latency for higher priority packets. As far as I know, the pipe based limiters discussed in this thread are content agnostic, basically they don't care about QOS. It's not so much as the limiters don't work, they work as designed, just not the way you thought they did. It might be possible to use the QOS aware traffic shaper and the limiters on the same firewall rule such that the traffic shaper has limits set at the WAN max up/down, not to shape but to prioritize packet delivery to the pipe based limiter. This could work if packets are handled by the traffic shaper prior to being handled by the pipe based limiter and that the traffic shaper completely passes all packets in the highest priority queue before passing packets in sequentially lower queues.

If I had my way I would like to see the pipes use the ECN flag and be QOS aware.

blablablablabla

I'm back again to revive this thread from the dead :) . Still stuck on M0n0wall waiting for a reasonable solution to this.

Here is the issue:
With m0n0wall bandwidth is shared equally per ip when you check that box by dynamically creating a queue for each ip address.

it is NOT a limiter. Each person gets the whole pipe unless one or more IP's is trying to max it out, then it treats them as queues and transfers data fairly.
You can get a similar effect in PfSense by creating two queues of equal priority and assigning one to each IP address. However you must do this MANUALLY for each ip on lan.
For the life of me I cannot figure out how to get PfSense to do this without manually creating a queue for each ip address on the lan. This is a pain in the ass and not even possible with how many different devices I have on my network

For those of you that haven't tried the feature in M0n0wall I can say it is incredibly valuable. Without it our network would be completely unusable due to heavy bittorrent and netflix traffic. We upgraded our network repeatedly until our speed was 50 megabits down and no matter what somebody would be downloading a patch on WoW or Steam or streaming something and our ping would skyrocket to 1000+. Therefore no matter what the PfSense advantages are I cannot switch without such a feature. It would also be great for hotspots, keeping a single user from soaking up all the bandwidth without liimiting everyone to a low speed all the time.

ppplleeeaaseee show me how to do this. foxale08's solution doesn't seem to work and the post on the mailing list I found basically tells you how to limit each user to a certain bandwidth. I don't know how many people are on the network at any certain time so I cannot reliably set a limit per person to keep the link from saturating. Also it's quite a waste of an expensive 50 megabit connection when almost nobody is online

hbanko

I followed foxale08 tutotrial. Its actually quite simple.

For me it works perfectly (pfsense 2.1).

As soon as more than one user downloads something, you can see in the traffic graph how the bandwidth is split between them. With usual browsing its in the graph not so noticeable.

But it had an extreme positive impact for all users here. Our internet line is finally useable for everyone and browsing is now always fast!

bfts

@foxale08:

I have implemented exactly what your talking about by using two parent limiters (up and down) and creating three child queues under each (the child queues are for each of my three lan subnets. The upload child queues have a 'source address' mask set and the download queues have the 'destination address' mask set.) I set the default pass rules for said subnets to use their appropriate child queues.

I'd love to know how you figured it out with the 3 subnets as I need to accommodate 3 LANs too.

I'd like to evenly share between the 3 subnets and what gets to subnet X share that evenly between the 80+ users of that subnet.

EDIT:I set this up for one of my LANs as described by foxale08 but I'm quite sure this limits the whole traffic to the values set in the limiter on a global level, not on a per user base ???

Sifter

Since the default LAN rule is used to apply this speed limit, what happens if I want full speed to a transfer on my NAS between two computers on my LAN? Is the speed limit also imposed on that transfer? In that scenario, Id want full gigabit speed of the switch, not the imposed 20000 kbits.

bfts

Is this still working under 2.1.2? (or 2.1.1 for that matter)
For me it seems not to work properly anymore or maybe it is because I'm in a MultiWAN environment?
I have the limiter set for all my MultiWAN failover rules…

My limiter is set to 6 Mbit/s, though the traffic graph shows some constant 10 Mbps throughput.

Any Idea what I'm doing wrong?

Limiter.png_thumb

Traffic.png_thumb

LAN3-Rules.png_thumb

FWRule.png_thumb

orangetek

I just tried this on a single lan/wan 2.1.2 fresh install and it is flawless. It splits the bandwidth perfectly.

wcrowder

@foxale08:

I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

Awesome! Seems to work well. Thanks very much.

Ashfaq

So its all good that total bandwidth is divided b/w the active users equally. now what if i want to go a step further and want to have a MINIMUM bandwidth for a specific IP or for a group-of-IPs-together and then divided the rest of the remaining bandwidth b/w the other active users: e.g:

total download is 4Mbps
total connected users 6
2 users are idle and the remaining 4 are downloading at full capacity so 4Mbps/4 users, each one gets 1Mbps
now the 2 idle also starts to download at full capacity so now 4Mbps/6 users, each one gets 682Kbps
now if i want 1 of the users to have minimum 1Mbps and the rest of the 5 gets equal share in remaining 3Mbps, so each of the 5 gets 614Kbps

is it possible ???

as far as i know limiters are used to upper bound, while queues are used for lower bound (min guaranteed), can we somehow use queues in combination with limiters to achieve that.

Update:
found this link https://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Using_Limiters_for_Bandwidth_Guarantees
but i dont think this serves the purpose and this will probably not allow to use the entire bandwidth that is available to the guaranteed device. i think the guaranteed limit will be the upper limit for the devices.

Thanks
Ashfaq

sideout

I just tested Foxale's setup and it worked for me.

I made a rule on the LAN side before the any any allow all rule that said:

IF Protocol = TCP , Source = LAN , Destination = NOT LAN then Upload_LAN for out and Download_LAN for in.

I had 2 steam clients downloading and both would be balancing out. The first one always seemed to get a bit more bandwidth but it would keep them decently even.

Going to test this out this weekend at a 125person LAN party.

orangetek

I have taken this a bit further and implemented QOS using just limiters while retaining the equal bandwidth sharing. Not 100% sure it works properly but seems to be. I have ACK, DNS, ICMP, HTTP/S, and OTHER in 3 priority groups, High,Mid,Low with weights set on each child limiter. I tested it by setting upload and download speeds on the parent limiters to 1/4 of my upload/download speed. I then proceeded to max both of them out while pinging an address on the internet. The pings remained steady like i wasn't even using any bandwidth. :)

jly2680

@orangetek:

I have taken this a bit further and implemented QOS using just limiters while retaining the equal bandwidth sharing. Not 100% sure it works properly but seems to be. I have ACK, DNS, ICMP, HTTP/S, and OTHER in 3 priority groups, High,Mid,Low with weights set on each child limiter. I tested it by setting upload and download speeds on the parent limiters to 1/4 of my upload/download speed. I then proceeded to max both of them out while pinging an address on the internet. The pings remained steady like i wasn't even using any bandwidth. :)

i want to try this on my pf box..would you mine if you can share your setting wiht us?TIA

sideout

So I used Fox's limiter config this weekend at my LAN party and it worked out great. I could see on the traffic graph where Pfsense was balancing out each connection bandwidth wise. It did seem that the first 3 or 4 would always get a little more but it worked out fine.

We had 125 people on 2 50MB cable modems. I set the limiter at 35Mbit for the first 4 hours of the event then dropped it down to 20Mbit during the main gaming hours then bumped up to 35Mbit again during the nite and back down to 20Mbit the next day.

We passed a little over 327GB of data this weekend , had no real issues and even kept the League of Legends players happy with sub 120MS ping times.

NexusLANRRD1.jpg_thumb

waldopulanco

Thanks! hope it will work to pfsense 2.1.2, I try it later. how about in squid proxy no limit for bandwidth?

Ashfaq

Hi,
On my test the limiter and queue method did not make any difference.
i configured one queue for each LAN and assigned the default rule in LAN with the limiter queues.
i had two devies 1 laptop on torrent download and 1 android phone on download, both on the same LAN.
the laptop got almost all the data, all the time !.
i could see both devices/IPs on the limiter info screen in the same configured queue. I am running pfSense ver 2.0.2.

what could i be doing wrong?

Regards
Ashfaq

sideout

One thing I did was create a new rule above the ANY / ANY rule on the LAN rule page for assigning this limiter. Basically this rule says:

Protocol - IPv4 / TCP
Source - LANLIMIT - I use an alias here that defines my DHCP pool that I assign out.
Ports - I set to any on both source and destination
Destination - NOT LAN Subnet - anything but other LAN clients
Gateway - FWGATEWAY - I have 2 WAN's that round robin load balance so I use that , you can leave at default.
IN/OUT - Upload_LAN / Download_LAN - these are the queues with destination address set under the traffic shaper.

Put this rule above the any / any rule.
I have a floating rule that sends HTTP / HTTPS traffic to my qACK / qHTTPSTEAM queue that I have defined in my shaper. I used quick match on this rule and all my shaper rules.

Here is how I have the limter set as well . See the pics below.

I did not test with a bittorrent client , I tested using Steam to download. I know it was working for me as during the LAN I could see IP's getting allocated bandwidth on the Traffic Graph for the LAN side and I went around to some of those PC's and was able to see them downloading on Steam and that it as matching what I was seeing on PFSense.

FWRULESLAN.jpg_thumb

FWRULELAN1.jpg_thumb

FWDLLIMIT.jpg_thumb
FWDLLIMIT2.jpg_thumb