Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Per IP traffic shaping–share bandwith evenly between IP addresses??

    Scheduled Pinned Locked Moved Traffic Shaping
    172 Posts 75 Posters 139.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • cwagzC
      cwagz
      last edited by

      Just to clarify.

      I can use one upload and one download limiter to cover my LAN / OPT1 /OPT2 interfaces and it will share the bandwidth evenly between all clients on each subnet, right?

      Thanks.

      Netgate 6100 MAX

      1 Reply Last reply Reply Quote 0
      • N
        n3by
        last edited by

        On 2.2.3-RELEASE (amd64) it is a bug ???

        Limiter enabled and set as in foxale08 posts… accessing from LAN a device on external IP:PORT is NOT WORKING… NAT Reflection probably broke ( NAT setting attached ).

        Limiter disabled and accessing from LAN a device on external IP:PORT is WORKING OK.

        Untitled.jpg
        Untitled.jpg_thumb

        1 Reply Last reply Reply Quote 0
        • I
          ismaelnoble
          last edited by

          so to clarify, when u enable limiters lan ips are unable to connect to systems located on the WAN subnet through NAT ??? ??? ??? …i have not had this issue but mabe i am interpreting this incorrectly, i have found that limiters do not function (for me) in the 2.2.3 build but it may be a misconfiguration on my part and im still experimenting with it (multi vlan + WPAD-DNS-DHCP + Squid 3 + squidguard + explicit proxy setup).

          1 Reply Last reply Reply Quote 0
          • cwagzC
            cwagz
            last edited by

            When I had limiters on NAT Reflection stopped working.  I could no longer access internal servers via their external addresses.  Turn off limiters and they would start working again.  Limiters also break Squid Transparent proxy.  There are several bugs in Redmine about this and I believe they are marked as targeted to be fixed in 2.3.

            This was a no go for me since I rely on dyndns SRV records to route my kids internal computers to our external facing Minecraft servers.  The solution at the start of this thread works great for sharing bandwidth but it broke too many things for me to be able to continue using it.

            Chad

            Netgate 6100 MAX

            1 Reply Last reply Reply Quote 0
            • I
              ismaelnoble
              last edited by

              understood, it is worthwhile that these things are noted. mabe it could be posted up on the limiter doc so no one else is tripped up by this..

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Limiters are currently completely broken as far as I'm concerned.  Limiters breaking NAT is a known bug.  Don't feel like looking it up.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  https://redmine.pfsense.org/issues/4326
                  https://redmine.pfsense.org/issues/4590

                  1 Reply Last reply Reply Quote 0
                  • U
                    unlimited1981
                    last edited by

                    hello guys i dont seem to find any answear to my problem

                    i have 2 wan interfaces 1 30mbit and 1 50 mbit

                    if i set the limiters i will set the total bandwith of the 2 lines or i have to create 2 sets of limiters?

                    if i set limiters it will make my nat records not working?

                    thank you in advance

                    1 Reply Last reply Reply Quote 0
                    • A
                      Abhishek
                      last edited by

                      @foxale08:

                      I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

                      I setup my Limiters as shown in this post when limiters are enabled my Users (50)  telling me they are unable to access internet  i am able to Ping to Site Name and IP but webpage is not opening

                      when i disabled limiter from lan rule everything is working properly  ,last night i tested this when there were only around 4-5 users they didnt report any issue

                      Version 2.2.3-RELEASE (amd64)
                      built on Tue Jun 23 16:37:42 CDT 2015

                      Package Running - Snort - squid for http -bandwidthd-ntopng -openvpn

                      –-edit

                      « Reply #70 on: March 14, 2015, 04:32:32 pm »

                      another user also facing same issue

                      ---edit

                      @jiunnyik:

                      @cmutwiwa:

                      I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?

                      I have the same issue.

                      Disable the transparent proxy and the limiter will works

                      We are using proxy server for caching files and http website monitoring

                      Is there any way to fix it without disabling transparent proxy ? because if i disable transparent proxy i will need to manually configure proxy in all computers (can do it from Server but due to some reasons i cant do it )

                      any alternate solutions please

                      2.3-RC (amd64)
                      built on Mon Apr 04 17:09:32 CDT 2016
                      FreeBSD 10.3-RELEASE
                      Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                      darkstat 3.1.2_1
                      Lightsquid 3.0.3_1
                      mailreport 3.0_1
                      pfBlockerNG 2.0.9_1  
                      RRD_Summary 1.3.1_2
                      snort 3.2.9.1_9  
                      squid 0.4.16_1  
                      squidGuard 1.14_1
                      syslog-ng 1.1.2_2

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        @Abhishek:

                        any alternate solutions please

                        No. Get rid of the proxy.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Is there any way to fix it without disabling transparent proxy ?

                          A second transparent proxy upstream of your limiter node?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • A
                            Abhishek
                            last edited by

                            @doktornotor:

                            @Abhishek:

                            any alternate solutions please

                            No. Get rid of the proxy.

                            Proxy server we need to Monitor user visiting sites and for Caching  huge files

                            So this will work rite if i configure Proxy server in non transparent mode ?

                            2.3-RC (amd64)
                            built on Mon Apr 04 17:09:32 CDT 2016
                            FreeBSD 10.3-RELEASE
                            Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                            darkstat 3.1.2_1
                            Lightsquid 3.0.3_1
                            mailreport 3.0_1
                            pfBlockerNG 2.0.9_1  
                            RRD_Summary 1.3.1_2
                            snort 3.2.9.1_9  
                            squid 0.4.16_1  
                            squidGuard 1.14_1
                            syslog-ng 1.1.2_2

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              @Abhishek:

                              for Caching  huge files

                              With 0.0000000000000000023% hitrate.  ::)

                              @Abhishek:

                              So this will work rite if i configure Proxy server in non transparent mode ?

                              That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                This thread should be locked.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • A
                                  Abhishek
                                  last edited by

                                  @doktornotor:

                                  @Abhishek:

                                  for Caching  huge files

                                  With 0.0000000000000000023% hitrate.  ::)

                                  @Abhishek:

                                  So this will work rite if i configure Proxy server in non transparent mode ?

                                  That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

                                  actually caching is very helping for me , i am not concerned about small file caching , mainly .exe download's  and it works for me

                                  Also Per user Net usage summary also , both is working for me

                                  2.3-RC (amd64)
                                  built on Mon Apr 04 17:09:32 CDT 2016
                                  FreeBSD 10.3-RELEASE
                                  Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                  darkstat 3.1.2_1
                                  Lightsquid 3.0.3_1
                                  mailreport 3.0_1
                                  pfBlockerNG 2.0.9_1  
                                  RRD_Summary 1.3.1_2
                                  snort 3.2.9.1_9  
                                  squid 0.4.16_1  
                                  squidGuard 1.14_1
                                  syslog-ng 1.1.2_2

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    Abhishek
                                    last edited by

                                    @Ashfaq:

                                    Thanks Sideout for the tips, I tried both ways using the default LAN rule and also the tip you gave me i.e. a new rule above the default LAN rule with the limiters applied.  no change in results, however i noticed that if both clients are laptops on torrents (i.e. equal load) then it does some bandwidth balancing.

                                    attached are the screenshots of my configuration, the graphs and the limiter info.

                                    i created similar and applied

                                    Setup is Pfsene with squid in non transparent mode with wpad - i am able to see Unique quoue/pipe for each local IP's in diag  but when one user started downloading in bitorrent entire bandwidth was given to that user  ,(test was performed with 2 user i normal user downloading in Http  file  and other downloading in bitrorrent  , torrent user was getting speed (90%)

                                    2.3-RC (amd64)
                                    built on Mon Apr 04 17:09:32 CDT 2016
                                    FreeBSD 10.3-RELEASE
                                    Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                    darkstat 3.1.2_1
                                    Lightsquid 3.0.3_1
                                    mailreport 3.0_1
                                    pfBlockerNG 2.0.9_1  
                                    RRD_Summary 1.3.1_2
                                    snort 3.2.9.1_9  
                                    squid 0.4.16_1  
                                    squidGuard 1.14_1
                                    syslog-ng 1.1.2_2

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      rajakupang
                                      last edited by

                                      use 2.1.5 works perfectly with queue

                                      1 Reply Last reply Reply Quote 0
                                      • perikoP
                                        periko
                                        last edited by

                                        Tested on 2.2.4 and works.
                                        As I remember TC and squid don't work together.

                                        Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                                        www.bajaopensolutions.com
                                        https://www.facebook.com/BajaOpenSolutions
                                        Quieres aprender PfSense, visita mi canal de youtube:
                                        https://www.youtube.com/c/PedroMorenoBOS

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          Rinzwind
                                          last edited by

                                          Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

                                          1 client 100%
                                          2 clients download each 50%
                                          3 clients each 33%
                                          etc…

                                          I mean the router is trying its best to handle every client right?

                                          Im going to run some tests here.

                                          Also is it really necessary to have 2 sub queues if you have 2 vlans? Can't you just specify the same up and down limiter for both?
                                          With outgoing rules you have to specify the limiter for every rule you want it to apply to. I only set it up for httphttps.

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            Harvy66
                                            last edited by

                                            @Rinzwind:

                                            Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

                                            1 client 100%
                                            2 clients download each 50%
                                            3 clients each 33%
                                            etc…

                                            Not really. Because of the way fixed sized tail-drop FIFO queues interact with TCP, you tend to get a single or a few dominate flows. If you use a fair queue or head-drop queue like codel, you will get a much better distribution of bandwidth among all flows. More advanced traffic shapers, like Cake, can give even per device bandwidth distribution and latency isolation, while also giving per flow bandwidth distribution and isolation for any given device.

                                            The day PFSense gets Cake, that's what I'm using. It's not even ready for Linux yet, so don't hold your breath.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.