Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall rules, Traffic shaping, LAN vs WAN & In vs Out

    Scheduled Pinned Locked Moved Traffic Shaping
    19 Posts 6 Posters 8.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Tripplesixty
      last edited by

      I am using floating firewalls rules to filter traffic into different buckets in a priority Q.  I'm doing simple shaping, I want to de-priortize torrent traffic, and prioritize video streaming to the WAN, all other traffic should be in the catch all bucket. All the ports on both p2p traffic and video streaming are known, I wan to use floating rules that catch this traffic and put it in the queue.

      I don't fully understand how the filtering settings work. Lets say I want any outbound traffic originating from LAN IP 192.168.1.1:8888 to be filtered into a specific bin, how would I go about specifying that?  What LAN vs WAN settings to I select?  Am I supposed to use for the direction (in/out/any).  What if the connection originated from an inbound request on that port but I want to continue to bin the outgoing traffic back to the remote client?

      Please help explain how the stateful filtering works so that I an correctly filter data going in and out of my network.

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        It's a lot simpler than it looks.  To get what you wanted, any outbound traffic originating from LAN IP 192.168.1.1:8888 to be filtered into a specific bin, you would create this floating rule (note that I only list options that you change from their defaults):

        Action: Match
        Protocol: TCP/UDP
        Source: Single host or alias, 192.168.1.1. Click Advanced and set ports to 8888
        Destination port range: any
        Ackqueue/Queue: Click Advanced, select qACK/qWhateverQueueYouWant
        Click Save

        That's it.

        1 Reply Last reply Reply Quote 0
        • G
          G.D. Wusser Esq.
          last edited by

          Which interfaces should be selected for this floating rule?

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            None, unless you want the floating rule to only apply to particular interfaces.  If you leave all unchecked, it seems to be the same as selecting all.  Create a traffic shaper with some options and then look at the auto-generated rules.  They never have an interface selected.  My own rules seem to work just fine without an interface selected.

            1 Reply Last reply Reply Quote 0
            • G
              G.D. Wusser Esq.
              last edited by

              Do you know why wizard created rules affect LAN interfaces (and LAN to LAN traffic), even though thy have only the WAN interface explicitly selected? Is there something going on behind the scenes, not reflected in the floating rules GUI?

              1 Reply Last reply Reply Quote 0
              • KOMK
                KOM
                last edited by

                I don't know.  Can you give an example of what you are seeing?

                1 Reply Last reply Reply Quote 0
                • G
                  G.D. Wusser Esq.
                  last edited by

                  Yes, just clicking on any floating rule created by the traffic shaping wizard you can observe that this rule has WAN interface explicitly selected and no others.

                  Attached is a screenshot.

                  Thanks

                  Wizard_Floating_Rule.gif
                  Wizard_Floating_Rule.gif_thumb

                  1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    I went and checked all my floating rules.  Some have WAN selected, most have nothing selected.  What is happening for you?  Do you have a WAN rule that is affecting LAN traffic somehow?

                    1 Reply Last reply Reply Quote 0
                    • G
                      G.D. Wusser Esq.
                      last edited by

                      Yes, I run the traffic shaping Wizard with one WAN and eight LAN interfaces. It created the rules, and traffic shaping works.

                      The problem is; traffic shaping works everywhere, so my LAN-to-LAN traffic slowed down to the crawl.

                      I am not afraid of manual configuration, to make the LAN traffic go around the queues; but to start doing that, first I need to understand how the traffic shaping system works. And, I do not understand where the rules that assign traffic to the LAN interfaces are.

                      Every single rule the traffic shaping wizard created for me has the WAN interface selected and no others.

                      1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        If all your rules have WAN selected then I don't know how it is affecting your LAN traffic.  As far as I understand, all traffic shaper rules are put in Floating Rules, and the entire floating rules system was designed with shaping in mind.  Most rules use ports to distinguish typical Internet traffic types (WWW, FTP, DNS, etc).  I'm not sure how these kinds of specific rules would interfere with your inter-LAN traffic, unless your rules use the wildcard * for everything like Source * Port * Destination * Port * Gateway * Queue Whatever.

                        1 Reply Last reply Reply Quote 0
                        • G
                          G.D. Wusser Esq.
                          last edited by

                          They (wizard created rules) do use wildcard for source, source port, destination, and gateway. All uncategorized traffic is categorized as P2P.

                          I guess, then, interface is ignored, for queue settings, and always applies on all interfaces, no matter what interface is selected in the floating firewall rule?

                          It does not matter if I put my LAN-to-LAN traffic in the least restrictive queues; they are still going to be slowed down 500 times, because I have very slow Internet.

                          The right way to do it would be to ether have the LAN-to-LAN traffic not put into the queues in the first place. Or have separate queues for it with different bandwidth settings.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            The HFSC multi-lan wizard creates a link queue for full-lan-speed traffic (qLink) and nested queues for shaped traffic.  I don't think that's available in priq.

                            I have had limited success using HFSC, having many of the same questions you have about exactly how the floating rules should be defined.  Every time I try it again, I blow out all the rules and start with the wizard.  When I try to customize it some seems to work (traffic seems to be going in the proper queue) then I do something else that I think should work and no traffic goes into the queue.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • KOMK
                              KOM
                              last edited by

                              Make sure that the action for your floating rules is MATCH, not PASS.  I used to trip on this at first because you're used to writing firewall rules where PASS and BLOCK are common actions.

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                They're all match.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • KOMK
                                  KOM
                                  last edited by

                                  If you have a specific example in mind, let's see the rules.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    Tripplesixty
                                    last edited by

                                    To get the firewall to categorize any of my data I had to set the following settings:

                                    (using PrioQ)
                                    Action: PASS
                                    Quick: Checked
                                    Interface: LAN
                                    Direction: any
                                    Proto: TCP/UDP
                                    Dest Port Range: torrent ports
                                    Ack/Que: qAck/qP2P

                                    I had to create two rules, one for LAN and one for WAN, but I had to set them to pass or the firewall would not categorize the traffic… I'm not sure why match was not working and why I had leave interface/direction on LAN&WAN /any.. but thats the only way I seem to capture all of the data. Does this seem like an overly aggressive rule?

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      georgeman
                                      last edited by

                                      @G.D.:

                                      Yes, I run the traffic shaping Wizard with one WAN and eight LAN interfaces.

                                      Not your fault, since it is not explicitely explained anywhere besides some forum posts (most of them written by me…), but shaping multi-LAN does not work as you expect. For reasons and an explanation on how the shaper works, check this post I have just written.

                                      Regards!

                                      If it ain't broke, you haven't tampered enough with it

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        vindenesen
                                        last edited by

                                        @georgeman:

                                        …
                                        shaping multi-LAN does not work as you expect. For reasons and an explanation on how the shaper works, check this post I have just written.

                                        Regards!

                                        Sorry if this is considered hijacking a thread, but just one small question: Does this apply to all shaping disciplines? I'm considering using the PRIQ shaper in a LAN party (which will have multiple subnets/VLANs) to prioritize gaming and other important traffic to/from the Internet. The Internet connection speed will be 1Gbps, if that makes any difference.

                                        Support the project by buying a Gold Subscription at https://portal.pfsense.org
                                        Running pfSense on SuperMicro A1SRI-2758F with ESXi 5.5

                                        1 Reply Last reply Reply Quote 0
                                        • G
                                          georgeman
                                          last edited by

                                          @vindenesen:

                                          @georgeman:

                                          …
                                          shaping multi-LAN does not work as you expect. For reasons and an explanation on how the shaper works, check this post I have just written.

                                          Regards!

                                          Sorry if this is considered hijacking a thread, but just one small question: Does this apply to all shaping disciplines? I'm considering using the PRIQ shaper in a LAN party (which will have multiple subnets/VLANs) to prioritize gaming and other important traffic to/from the Internet. The Internet connection speed will be 1Gbps, if that makes any difference.

                                          Yes, it is the same for any scheduler since this is originated from the fact that you cannot have the same queue applying to multiple interfaces simoultaneously. Since download is "shaped" (and I put it in between quotes because you cannot really shape download, but do some TCP based tricks) on the LAN side, you are actually having multiple download pipes not communicating with each other

                                          If it ain't broke, you haven't tampered enough with it

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.