Per IP traffic shaping–share bandwith evenly between IP addresses??
-
@Ashfaq Could you post your final settings again as I 'm hoping to replicate your setup. Thanks!
-
Check my previous posts in this thread for limiter setup screen-shots.
attached are the screen-shots for floating rules added by wizard and the 2 amendment i made in the p2p rule ONLY:- added in/out limiters values
- changed port range to include ports used by my torrent client.
another observation with this setup is that sometimes my torrents dont get the FULL speed even if they are the ONLY thing running the network. disabling the floating rules gives it the complete bandwidth.
Ashfaq
-
Dear all,
I'm a first time poster here - these forums have been tremendously useful just from reading them. Sorry for my phraseology, the terms are still difficult to grasp. We have a college in a developing country - using desktop grade hardware to share 10Mbps synchronous connection among all users. It's slow but it works. We see 100 simultaneous network users regularly, and 300 at peak times. Firewall is pfsense 2.1.5.
Obviously traffic shaping is very important for us. The details given in this thread have been very useful in getting things started. I have also noticed, as some users above, that a one-click rule for this important feature (dynamic per-IP traffic shaping) would be really helpful.
The shaping using limiters described here is a great starting point. It does 'break' occasionally in ways that amateurs will probably never be able to figure out, least of all me. Also, it doesn't 'share' or 'throttle' the bandwidth from hogs (downloaders, with sustained bandwidth usage) to 'new comers' (i.e. someone just trying to load a single webpage) fast enough. Any ideas on this?
In the above scenarios, I'm wondering if this 'burst' feature that's there with limiters might work. However, you have to set that at the parent level. Does that somehow also get shared among dynamic child pipes? Anyone figure out what the units for that are (bytes, kb, mb), or if it always matches the units of the bandwidth specified. I know it's supposed to be an amount/size, not a rate, but I haven't figured out the units of it, or like I said, if it gets divided equally into the child pipes.
-
Are there any news this will be an official feature? Maybe in 2.2?
-
@ssp:
Dear all,
I'm a first time poster here - these forums have been tremendously useful just from reading them. Sorry for my phraseology, the terms are still difficult to grasp. We have a college in a developing country - using desktop grade hardware to share 10Mbps synchronous connection among all users. It's slow but it works. We see 100 simultaneous network users regularly, and 300 at peak times. Firewall is pfsense 2.1.5.
Obviously traffic shaping is very important for us. The details given in this thread have been very useful in getting things started. I have also noticed, as some users above, that a one-click rule for this important feature (dynamic per-IP traffic shaping) would be really helpful.
The shaping using limiters described here is a great starting point. It does 'break' occasionally in ways that amateurs will probably never be able to figure out, least of all me. Also, it doesn't 'share' or 'throttle' the bandwidth from hogs (downloaders, with sustained bandwidth usage) to 'new comers' (i.e. someone just trying to load a single webpage) fast enough. Any ideas on this?
In the above scenarios, I'm wondering if this 'burst' feature that's there with limiters might work. However, you have to set that at the parent level. Does that somehow also get shared among dynamic child pipes? Anyone figure out what the units for that are (bytes, kb, mb), or if it always matches the units of the bandwidth specified. I know it's supposed to be an amount/size, not a rate, but I haven't figured out the units of it, or like I said, if it gets divided equally into the child pipes.
If you have 300 people sharing only 10mb of bandwidth during peak hours, you might just be best off using the regular traffic shaper, set up just a few rules like
Interface rate: 9.8Mb
–Traffic Link Share: 95%
----UDP Link Share 50% CODEL
----TCP Link Share 50% CODEL
--Important Protocols Link Share 5%
----DNS Link Share: 50%
----ICMP Link Share: 50%From what I've read, CODEL is quite nice for fighting buffer bloat, which may or may not be an issue.
-
Are you suggesting the user build 4 queues and then run codel on two them. The reason I ask is I am a new user trying to get handle on traffic shaping for my application. I am trying to understand the best way to use codel with pfSense. There does not appear to be much information on the way to use it.
In my case it is for a home router replacement, a RT-N16 running tomato with QoS. The recent TWC upgrade to 100/5 Mb/s service has caused me to outgrow the the N16 router.
Edit:
Note, I just created some queues via the wizzard and saved them as a test. When you try an apply codel, the previous queues are erased. -
Are you suggesting the user build 4 queues and then run codel on two them. The reason I ask is I am a new user trying to get handle on traffic shaping for my application. I am trying to understand the best way to use codel with pfSense. There does not appear to be much information on the way to use it.
In my case it is for a home router replacement, a RT-N16 running tomato with QoS. The recent TWC upgrade to 100/5 Mb/s service has caused me to outgrow the the N16 router.
Edit:
Note, I just created some queues via the wizzard and saved them as a test. When you try an apply codel, the previous queues are erased.I don't have anything to back this up, but codel is an algorithm to combat buffer bloat, so it drops packets. I didn't recommend codel on the DNS and ICMP queues because those types of traffic tend to not be high bandwidth in the first place, so a bit of bufferbloat may be less detrimental than dropped packets.
I personally set my packet buffers high for low/fixed bandwidth queues that do no react to dropped packets. Dropping packets is supposed to be a signal to back-off for protocols that implement congestion control.
My logic could be wrong or real world practice may have an interesting interaction, such that non-tail drop tightly smaller queues are always best, but I see no harm in my setup since it only affects me.
P.S. I forgot to include the ACK queue in my example. It should always exist.
Since you're a home user, this is what I use and it seems to work well for me. Mind you, I have a symmetrical pseudo-dedicated connection, so you may need to tweak your upload ACK queue allocation.
https://forum.pfsense.org/index.php?topic=86347.msg474756#msg474756
-
Has anybody been successful in equally dividing the bandwidth b/w a pc with torrent download and one with simple browsing?
or a mobile device against with simple data usage and a torrent downloading pc ?with me the torrent download PC always gets almost all of the bandwidth all the time !
Ashfaq
Hi!
I got this working with torrents. First, configure as foxale08, reply #9-#12. (The only difference is that I used a floating rule instead of a LAN rule, but it should work anyhow.)
Next step: Use the limiters Upload_LAN and Download_LAN again on the bittorrent portforward rule, but use Download_LAN on In and Upload_LAN on Out, because this is a WAN rule.
I tested this and if I limit Download to 10Mb/s and start a torrent, the torrent gets no more than 10Mb/s and then if I try to download from another IP adress, I get 5Mb/s from that client and 5Mb/s to the torrent client even if the bittorrent client has many more connections.
-
I have implemented the solution provided by foxale08 and it works very well.
But if someone used VPN to connect to the network and tried to copy something from the NAS located on the network to their own drive on their homework network - would they be treated just like any other user and they get a fair share?
-
I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?
-
Been struggling getting this to work all day but got it working now :)
Just in case anyone has problems, what fixed it for me is to set the bandwidth a few megabits below what is actually available. We get around 17 mbit over ADSL but the limiter wouldn't work until I set it at 15 (or lower).
I've also had the weird side effect that port reflection seems to have stopped working when accessing from our LAN, NAT rules which forward to our DMZ. Not a big deal at the moment but does anyone know why? The port reflection still seems to work for rules that point to our LAN.
Paul
-
Hi there guys.. i did foxale08's post and it worked very well. our gaming ping is very low for online games such as lol, hon and dota2, however, whenever the lan rule is enabled, all clients seem to have a very hard time browsing the internet, any idea how to solve this issue?
our broadband is 10mbps (yes its quite low) for download and around 600 kbps for upload so i set the limiter at 6mbps download and 512 kbps upload
-
Thank you foxale08 for your documentation on this solution. I have run this for over week a week now on our private network. My colleagues are coming up and saying … "did something happen to the internet? It is running faster and more reliable." I removed all the traffic shaping and your limiter setup is perfect for us.
I'd like to do the same for our public network. However, I have one last question. Are there resources that I need to make sure we have enough before doing that like handles, file limits etc?
My box is a Pentium R 3.4 Ghz with 2 CPU x 2 Cores and 4G of memory and 64G hard drive.
2 WANs (50mbps/5mbps; 24mbps/5mbps)
1 for private interface and 1 for public.
Private only has 15 users. Public can have 0-peak 120 general users (mail & browsing)Thanks!
Rob -
I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?
I have the same issue.
Disable the transparent proxy and the limiter will works
-
I tested foxale08's method on 2.2.2
I found that sometimes it not really share bandwidth evenly.
Anyone same issue ?
-
I am using 2.2.2-RELEASE (i386). We have about 6 people for a total of around 20 devices on a 25/3 Mbit residential connection, and when everyone fires up netflix/youtube/huluu/vudu/etc I can clearly see watching the traffic graph on the lan side that this is working!
I just wanted to post to say THANK YOU foxale08! This is working like a dream.
Guides like these are great! took our pfsense to a whole new level, we have been using pfsense for like 5 years now, and it has been great, but this makes it even better!
Now the next thing I need to figure out how to do is set a limit on the number of connections per IP, I would prefer that no single IP use more than 20-30 connections, because too many connections also causes issues for other users on the network that are not abusing it.
If anyone has any tips regarding limiting connections please let me know and thanks again foxale08!
-
If anyone has any tips regarding limiting connections please let me know and thanks again foxale08!
Maximum state entries per host on the main LAN pass rule (the same one that sets the limiters) is probably what you want.
Get ready for frowning faces. You'll probably break all sorts of things if you set this low enough that people actually hit it.
ETA: This should probably be another thread.
 -
Since the default LAN rule is used to apply this speed limit, what happens if I want full speed to a transfer on my NAS between two computers on my LAN? Is the speed limit also imposed on that transfer? In that scenario, Id want full gigabit speed of the switch, not the imposed 20000 kbits.
That's exactly what I'm experiancing. With limiters set and I ping my NAS while doing a speed test the latency is 200+.
-
Communications between two computers on the same network don't hit the firewall (or the limiter) at all. Look elsewhere for your throughput issues.
If you are talking about traffic between two interfaces on pfSense, just add a pass rule on the source interface with a destination of the other interface's INTF net, above the rule that sets the limiter, but with no limiter. ezpz.
-
Thanks it worked.
Now how do I dedicate a 2mb portion of 10mb for IAX2 Voip on Wan?
