• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Per IP traffic shaping–share bandwith evenly between IP addresses??

Scheduled Pinned Locked Moved Traffic Shaping
172 Posts 75 Posters 140.6k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C
    cwagz
    last edited by Jul 3, 2015, 8:57 AM

    Just to clarify.

    I can use one upload and one download limiter to cover my LAN / OPT1 /OPT2 interfaces and it will share the bandwidth evenly between all clients on each subnet, right?

    Thanks.

    Netgate 6100 MAX

    1 Reply Last reply Reply Quote 0
    • N
      n3by
      last edited by Jul 19, 2015, 9:00 AM

      On 2.2.3-RELEASE (amd64) it is a bug ???

      Limiter enabled and set as in foxale08 posts… accessing from LAN a device on external IP:PORT is NOT WORKING… NAT Reflection probably broke ( NAT setting attached ).

      Limiter disabled and accessing from LAN a device on external IP:PORT is WORKING OK.

      Untitled.jpg
      Untitled.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • I
        ismaelnoble
        last edited by Jul 19, 2015, 10:14 PM

        so to clarify, when u enable limiters lan ips are unable to connect to systems located on the WAN subnet through NAT ??? ??? ??? …i have not had this issue but mabe i am interpreting this incorrectly, i have found that limiters do not function (for me) in the 2.2.3 build but it may be a misconfiguration on my part and im still experimenting with it (multi vlan + WPAD-DNS-DHCP + Squid 3 + squidguard + explicit proxy setup).

        1 Reply Last reply Reply Quote 0
        • C
          cwagz
          last edited by Jul 19, 2015, 10:19 PM

          When I had limiters on NAT Reflection stopped working.  I could no longer access internal servers via their external addresses.  Turn off limiters and they would start working again.  Limiters also break Squid Transparent proxy.  There are several bugs in Redmine about this and I believe they are marked as targeted to be fixed in 2.3.

          This was a no go for me since I rely on dyndns SRV records to route my kids internal computers to our external facing Minecraft servers.  The solution at the start of this thread works great for sharing bandwidth but it broke too many things for me to be able to continue using it.

          Chad

          Netgate 6100 MAX

          1 Reply Last reply Reply Quote 0
          • I
            ismaelnoble
            last edited by Jul 20, 2015, 2:19 AM

            understood, it is worthwhile that these things are noted. mabe it could be posted up on the limiter doc so no one else is tripped up by this..

            1 Reply Last reply Reply Quote 0
            • D
              Derelict LAYER 8 Netgate
              last edited by Jul 20, 2015, 2:42 AM

              Limiters are currently completely broken as far as I'm concerned.  Limiters breaking NAT is a known bug.  Don't feel like looking it up.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by Jul 20, 2015, 3:05 AM

                https://redmine.pfsense.org/issues/4326
                https://redmine.pfsense.org/issues/4590

                1 Reply Last reply Reply Quote 0
                • U
                  unlimited1981
                  last edited by Jul 28, 2015, 5:55 PM Jul 28, 2015, 5:19 PM

                  hello guys i dont seem to find any answear to my problem

                  i have 2 wan interfaces 1 30mbit and 1 50 mbit

                  if i set the limiters i will set the total bandwith of the 2 lines or i have to create 2 sets of limiters?

                  if i set limiters it will make my nat records not working?

                  thank you in advance

                  1 Reply Last reply Reply Quote 0
                  • A
                    Abhishek
                    last edited by Jul 31, 2015, 5:26 AM Jul 31, 2015, 5:05 AM

                    @foxale08:

                    I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

                    I setup my Limiters as shown in this post when limiters are enabled my Users (50)  telling me they are unable to access internet  i am able to Ping to Site Name and IP but webpage is not opening

                    when i disabled limiter from lan rule everything is working properly  ,last night i tested this when there were only around 4-5 users they didnt report any issue

                    Version 2.2.3-RELEASE (amd64)
                    built on Tue Jun 23 16:37:42 CDT 2015

                    Package Running - Snort - squid for http -bandwidthd-ntopng -openvpn

                    –-edit

                    « Reply #70 on: March 14, 2015, 04:32:32 pm »

                    another user also facing same issue

                    ---edit

                    @jiunnyik:

                    @cmutwiwa:

                    I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?

                    I have the same issue.

                    Disable the transparent proxy and the limiter will works

                    We are using proxy server for caching files and http website monitoring

                    Is there any way to fix it without disabling transparent proxy ? because if i disable transparent proxy i will need to manually configure proxy in all computers (can do it from Server but due to some reasons i cant do it )

                    any alternate solutions please

                    2.3-RC (amd64)
                    built on Mon Apr 04 17:09:32 CDT 2016
                    FreeBSD 10.3-RELEASE
                    Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                    darkstat 3.1.2_1
                    Lightsquid 3.0.3_1
                    mailreport 3.0_1
                    pfBlockerNG 2.0.9_1  
                    RRD_Summary 1.3.1_2
                    snort 3.2.9.1_9  
                    squid 0.4.16_1  
                    squidGuard 1.14_1
                    syslog-ng 1.1.2_2

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by Jul 31, 2015, 6:34 AM

                      @Abhishek:

                      any alternate solutions please

                      No. Get rid of the proxy.

                      1 Reply Last reply Reply Quote 0
                      • D
                        Derelict LAYER 8 Netgate
                        last edited by Jul 31, 2015, 7:00 AM

                        Is there any way to fix it without disabling transparent proxy ?

                        A second transparent proxy upstream of your limiter node?

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • A
                          Abhishek
                          last edited by Jul 31, 2015, 7:03 AM

                          @doktornotor:

                          @Abhishek:

                          any alternate solutions please

                          No. Get rid of the proxy.

                          Proxy server we need to Monitor user visiting sites and for Caching  huge files

                          So this will work rite if i configure Proxy server in non transparent mode ?

                          2.3-RC (amd64)
                          built on Mon Apr 04 17:09:32 CDT 2016
                          FreeBSD 10.3-RELEASE
                          Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                          darkstat 3.1.2_1
                          Lightsquid 3.0.3_1
                          mailreport 3.0_1
                          pfBlockerNG 2.0.9_1  
                          RRD_Summary 1.3.1_2
                          snort 3.2.9.1_9  
                          squid 0.4.16_1  
                          squidGuard 1.14_1
                          syslog-ng 1.1.2_2

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by Jul 31, 2015, 7:14 AM

                            @Abhishek:

                            for Caching  huge files

                            With 0.0000000000000000023% hitrate.  ::)

                            @Abhishek:

                            So this will work rite if i configure Proxy server in non transparent mode ?

                            That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

                            1 Reply Last reply Reply Quote 0
                            • D
                              Derelict LAYER 8 Netgate
                              last edited by Jul 31, 2015, 7:21 AM

                              This thread should be locked.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • A
                                Abhishek
                                last edited by Jul 31, 2015, 9:37 AM

                                @doktornotor:

                                @Abhishek:

                                for Caching  huge files

                                With 0.0000000000000000023% hitrate.  ::)

                                @Abhishek:

                                So this will work rite if i configure Proxy server in non transparent mode ?

                                That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

                                actually caching is very helping for me , i am not concerned about small file caching , mainly .exe download's  and it works for me

                                Also Per user Net usage summary also , both is working for me

                                2.3-RC (amd64)
                                built on Mon Apr 04 17:09:32 CDT 2016
                                FreeBSD 10.3-RELEASE
                                Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                darkstat 3.1.2_1
                                Lightsquid 3.0.3_1
                                mailreport 3.0_1
                                pfBlockerNG 2.0.9_1  
                                RRD_Summary 1.3.1_2
                                snort 3.2.9.1_9  
                                squid 0.4.16_1  
                                squidGuard 1.14_1
                                syslog-ng 1.1.2_2

                                1 Reply Last reply Reply Quote 0
                                • A
                                  Abhishek
                                  last edited by Aug 23, 2015, 2:41 PM

                                  @Ashfaq:

                                  Thanks Sideout for the tips, I tried both ways using the default LAN rule and also the tip you gave me i.e. a new rule above the default LAN rule with the limiters applied.  no change in results, however i noticed that if both clients are laptops on torrents (i.e. equal load) then it does some bandwidth balancing.

                                  attached are the screenshots of my configuration, the graphs and the limiter info.

                                  i created similar and applied

                                  Setup is Pfsene with squid in non transparent mode with wpad - i am able to see Unique quoue/pipe for each local IP's in diag  but when one user started downloading in bitorrent entire bandwidth was given to that user  ,(test was performed with 2 user i normal user downloading in Http  file  and other downloading in bitrorrent  , torrent user was getting speed (90%)

                                  2.3-RC (amd64)
                                  built on Mon Apr 04 17:09:32 CDT 2016
                                  FreeBSD 10.3-RELEASE
                                  Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                  darkstat 3.1.2_1
                                  Lightsquid 3.0.3_1
                                  mailreport 3.0_1
                                  pfBlockerNG 2.0.9_1  
                                  RRD_Summary 1.3.1_2
                                  snort 3.2.9.1_9  
                                  squid 0.4.16_1  
                                  squidGuard 1.14_1
                                  syslog-ng 1.1.2_2

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    rajakupang
                                    last edited by Nov 15, 2015, 4:28 AM

                                    use 2.1.5 works perfectly with queue

                                    1 Reply Last reply Reply Quote 0
                                    • perikoP
                                      periko
                                      last edited by Nov 23, 2015, 6:04 AM

                                      Tested on 2.2.4 and works.
                                      As I remember TC and squid don't work together.

                                      Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                                      www.bajaopensolutions.com
                                      https://www.facebook.com/BajaOpenSolutions
                                      Quieres aprender PfSense, visita mi canal de youtube:
                                      https://www.youtube.com/c/PedroMorenoBOS

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        Rinzwind
                                        last edited by Feb 23, 2016, 10:20 AM

                                        Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

                                        1 client 100%
                                        2 clients download each 50%
                                        3 clients each 33%
                                        etc…

                                        I mean the router is trying its best to handle every client right?

                                        Im going to run some tests here.

                                        Also is it really necessary to have 2 sub queues if you have 2 vlans? Can't you just specify the same up and down limiter for both?
                                        With outgoing rules you have to specify the limiter for every rule you want it to apply to. I only set it up for httphttps.

                                        1 Reply Last reply Reply Quote 0
                                        • H
                                          Harvy66
                                          last edited by Feb 23, 2016, 3:41 PM

                                          @Rinzwind:

                                          Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

                                          1 client 100%
                                          2 clients download each 50%
                                          3 clients each 33%
                                          etc…

                                          Not really. Because of the way fixed sized tail-drop FIFO queues interact with TCP, you tend to get a single or a few dominate flows. If you use a fair queue or head-drop queue like codel, you will get a much better distribution of bandwidth among all flows. More advanced traffic shapers, like Cake, can give even per device bandwidth distribution and latency isolation, while also giving per flow bandwidth distribution and isolation for any given device.

                                          The day PFSense gets Cake, that's what I'm using. It's not even ready for Linux yet, so don't hold your breath.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            [[user:consent.lead]]
                                            [[user:consent.not_received]]