Per IP traffic shaping–share bandwith evenly between IP addresses??

cwagz · Jul 3, 2015, 8:57 AM

Just to clarify.

I can use one upload and one download limiter to cover my LAN / OPT1 /OPT2 interfaces and it will share the bandwidth evenly between all clients on each subnet, right?

Thanks.

n3by · Jul 19, 2015, 9:00 AM

On 2.2.3-RELEASE (amd64) it is a bug ???

Limiter enabled and set as in foxale08 posts… accessing from LAN a device on external IP:PORT is NOT WORKING… NAT Reflection probably broke ( NAT setting attached ).

Limiter disabled and accessing from LAN a device on external IP:PORT is WORKING OK.

ismaelnoble · Jul 19, 2015, 10:14 PM

so to clarify, when u enable limiters lan ips are unable to connect to systems located on the WAN subnet through NAT ??? ??? ??? …i have not had this issue but mabe i am interpreting this incorrectly, i have found that limiters do not function (for me) in the 2.2.3 build but it may be a misconfiguration on my part and im still experimenting with it (multi vlan + WPAD-DNS-DHCP + Squid 3 + squidguard + explicit proxy setup).

cwagz · Jul 19, 2015, 10:19 PM

When I had limiters on NAT Reflection stopped working. I could no longer access internal servers via their external addresses. Turn off limiters and they would start working again. Limiters also break Squid Transparent proxy. There are several bugs in Redmine about this and I believe they are marked as targeted to be fixed in 2.3.

This was a no go for me since I rely on dyndns SRV records to route my kids internal computers to our external facing Minecraft servers. The solution at the start of this thread works great for sharing bandwidth but it broke too many things for me to be able to continue using it.

Chad

ismaelnoble · Jul 20, 2015, 2:19 AM

understood, it is worthwhile that these things are noted. mabe it could be posted up on the limiter doc so no one else is tripped up by this..

Derelict · Jul 20, 2015, 2:42 AM

Limiters are currently completely broken as far as I'm concerned. Limiters breaking NAT is a known bug. Don't feel like looking it up.

doktornotor · Jul 20, 2015, 3:05 AM

https://redmine.pfsense.org/issues/4326
https://redmine.pfsense.org/issues/4590

unlimited1981 · Jul 28, 2015, 5:55 PM

hello guys i dont seem to find any answear to my problem

i have 2 wan interfaces 1 30mbit and 1 50 mbit

if i set the limiters i will set the total bandwith of the 2 lines or i have to create 2 sets of limiters?

if i set limiters it will make my nat records not working?

thank you in advance

Abhishek · Jul 31, 2015, 5:26 AM

@foxale08:

I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

I setup my Limiters as shown in this post when limiters are enabled my Users (50) telling me they are unable to access internet i am able to Ping to Site Name and IP but webpage is not opening

when i disabled limiter from lan rule everything is working properly ,last night i tested this when there were only around 4-5 users they didnt report any issue

Version 2.2.3-RELEASE (amd64)
built on Tue Jun 23 16:37:42 CDT 2015

Package Running - Snort - squid for http -bandwidthd-ntopng -openvpn

–-edit

« Reply #70 on: March 14, 2015, 04:32:32 pm »

another user also facing same issue

---edit

@jiunnyik:

@cmutwiwa:

I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?

I have the same issue.

Disable the transparent proxy and the limiter will works

We are using proxy server for caching files and http website monitoring

Is there any way to fix it without disabling transparent proxy ? because if i disable transparent proxy i will need to manually configure proxy in all computers (can do it from Server but due to some reasons i cant do it )

any alternate solutions please

doktornotor · Jul 31, 2015, 6:34 AM

@Abhishek:

any alternate solutions please

No. Get rid of the proxy.

Derelict · Jul 31, 2015, 7:00 AM

Is there any way to fix it without disabling transparent proxy ?

A second transparent proxy upstream of your limiter node?

Abhishek · Jul 31, 2015, 7:03 AM

@doktornotor:

@Abhishek:

any alternate solutions please

No. Get rid of the proxy.

Proxy server we need to Monitor user visiting sites and for Caching huge files

So this will work rite if i configure Proxy server in non transparent mode ?

doktornotor · Jul 31, 2015, 7:14 AM

@Abhishek:

for Caching huge files

With 0.0000000000000000023% hitrate. ::)

@Abhishek:

So this will work rite if i configure Proxy server in non transparent mode ?

That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

Derelict · Jul 31, 2015, 7:21 AM

This thread should be locked.

Abhishek · Jul 31, 2015, 9:37 AM

@doktornotor:

@Abhishek:

for Caching huge files

With 0.0000000000000000023% hitrate. ::)

@Abhishek:

So this will work rite if i configure Proxy server in non transparent mode ?

That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

actually caching is very helping for me , i am not concerned about small file caching , mainly .exe download's and it works for me

Also Per user Net usage summary also , both is working for me

Abhishek · Aug 23, 2015, 2:41 PM

@Ashfaq:

Thanks Sideout for the tips, I tried both ways using the default LAN rule and also the tip you gave me i.e. a new rule above the default LAN rule with the limiters applied. no change in results, however i noticed that if both clients are laptops on torrents (i.e. equal load) then it does some bandwidth balancing.

attached are the screenshots of my configuration, the graphs and the limiter info.

i created similar and applied

Setup is Pfsene with squid in non transparent mode with wpad - i am able to see Unique quoue/pipe for each local IP's in diag but when one user started downloading in bitorrent entire bandwidth was given to that user ,(test was performed with 2 user i normal user downloading in Http file and other downloading in bitrorrent , torrent user was getting speed (90%)

rajakupang · Nov 15, 2015, 4:28 AM

use 2.1.5 works perfectly with queue

periko · Nov 23, 2015, 6:04 AM

Tested on 2.2.4 and works.
As I remember TC and squid don't work together.

Rinzwind · Feb 23, 2016, 10:20 AM

Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

1 client 100%
2 clients download each 50%
3 clients each 33%
etc…

I mean the router is trying its best to handle every client right?

Im going to run some tests here.

Also is it really necessary to have 2 sub queues if you have 2 vlans? Can't you just specify the same up and down limiter for both?
With outgoing rules you have to specify the limiter for every rule you want it to apply to. I only set it up for httphttps.

Harvy66 · Feb 23, 2016, 3:41 PM

@Rinzwind:

Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

1 client 100%
2 clients download each 50%
3 clients each 33%
etc…

Not really. Because of the way fixed sized tail-drop FIFO queues interact with TCP, you tend to get a single or a few dominate flows. If you use a fair queue or head-drop queue like codel, you will get a much better distribution of bandwidth among all flows. More advanced traffic shapers, like Cake, can give even per device bandwidth distribution and latency isolation, while also giving per flow bandwidth distribution and isolation for any given device.

The day PFSense gets Cake, that's what I'm using. It's not even ready for Linux yet, so don't hold your breath.