Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Per IP traffic shaping–share bandwith evenly between IP addresses??

    Scheduled Pinned Locked Moved Traffic Shaping
    172 Posts 75 Posters 140.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • cwagzC
      cwagz
      last edited by

      When I had limiters on NAT Reflection stopped working.  I could no longer access internal servers via their external addresses.  Turn off limiters and they would start working again.  Limiters also break Squid Transparent proxy.  There are several bugs in Redmine about this and I believe they are marked as targeted to be fixed in 2.3.

      This was a no go for me since I rely on dyndns SRV records to route my kids internal computers to our external facing Minecraft servers.  The solution at the start of this thread works great for sharing bandwidth but it broke too many things for me to be able to continue using it.

      Chad

      Netgate 6100 MAX

      1 Reply Last reply Reply Quote 0
      • I
        ismaelnoble
        last edited by

        understood, it is worthwhile that these things are noted. mabe it could be posted up on the limiter doc so no one else is tripped up by this..

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Limiters are currently completely broken as far as I'm concerned.  Limiters breaking NAT is a known bug.  Don't feel like looking it up.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            https://redmine.pfsense.org/issues/4326
            https://redmine.pfsense.org/issues/4590

            1 Reply Last reply Reply Quote 0
            • U
              unlimited1981
              last edited by

              hello guys i dont seem to find any answear to my problem

              i have 2 wan interfaces 1 30mbit and 1 50 mbit

              if i set the limiters i will set the total bandwith of the 2 lines or i have to create 2 sets of limiters?

              if i set limiters it will make my nat records not working?

              thank you in advance

              1 Reply Last reply Reply Quote 0
              • A
                Abhishek
                last edited by

                @foxale08:

                I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

                I setup my Limiters as shown in this post when limiters are enabled my Users (50)  telling me they are unable to access internet  i am able to Ping to Site Name and IP but webpage is not opening

                when i disabled limiter from lan rule everything is working properly  ,last night i tested this when there were only around 4-5 users they didnt report any issue

                Version 2.2.3-RELEASE (amd64)
                built on Tue Jun 23 16:37:42 CDT 2015

                Package Running - Snort - squid for http -bandwidthd-ntopng -openvpn

                –-edit

                « Reply #70 on: March 14, 2015, 04:32:32 pm »

                another user also facing same issue

                ---edit

                @jiunnyik:

                @cmutwiwa:

                I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?

                I have the same issue.

                Disable the transparent proxy and the limiter will works

                We are using proxy server for caching files and http website monitoring

                Is there any way to fix it without disabling transparent proxy ? because if i disable transparent proxy i will need to manually configure proxy in all computers (can do it from Server but due to some reasons i cant do it )

                any alternate solutions please

                2.3-RC (amd64)
                built on Mon Apr 04 17:09:32 CDT 2016
                FreeBSD 10.3-RELEASE
                Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                darkstat 3.1.2_1
                Lightsquid 3.0.3_1
                mailreport 3.0_1
                pfBlockerNG 2.0.9_1  
                RRD_Summary 1.3.1_2
                snort 3.2.9.1_9  
                squid 0.4.16_1  
                squidGuard 1.14_1
                syslog-ng 1.1.2_2

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  @Abhishek:

                  any alternate solutions please

                  No. Get rid of the proxy.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Is there any way to fix it without disabling transparent proxy ?

                    A second transparent proxy upstream of your limiter node?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • A
                      Abhishek
                      last edited by

                      @doktornotor:

                      @Abhishek:

                      any alternate solutions please

                      No. Get rid of the proxy.

                      Proxy server we need to Monitor user visiting sites and for Caching  huge files

                      So this will work rite if i configure Proxy server in non transparent mode ?

                      2.3-RC (amd64)
                      built on Mon Apr 04 17:09:32 CDT 2016
                      FreeBSD 10.3-RELEASE
                      Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                      darkstat 3.1.2_1
                      Lightsquid 3.0.3_1
                      mailreport 3.0_1
                      pfBlockerNG 2.0.9_1  
                      RRD_Summary 1.3.1_2
                      snort 3.2.9.1_9  
                      squid 0.4.16_1  
                      squidGuard 1.14_1
                      syslog-ng 1.1.2_2

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        @Abhishek:

                        for Caching  huge files

                        With 0.0000000000000000023% hitrate.  ::)

                        @Abhishek:

                        So this will work rite if i configure Proxy server in non transparent mode ?

                        That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          This thread should be locked.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • A
                            Abhishek
                            last edited by

                            @doktornotor:

                            @Abhishek:

                            for Caching  huge files

                            With 0.0000000000000000023% hitrate.  ::)

                            @Abhishek:

                            So this will work rite if i configure Proxy server in non transparent mode ?

                            That or move the stupid thing to another box. Squid-induced breakage is totally OT on this thread.

                            actually caching is very helping for me , i am not concerned about small file caching , mainly .exe download's  and it works for me

                            Also Per user Net usage summary also , both is working for me

                            2.3-RC (amd64)
                            built on Mon Apr 04 17:09:32 CDT 2016
                            FreeBSD 10.3-RELEASE
                            Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                            darkstat 3.1.2_1
                            Lightsquid 3.0.3_1
                            mailreport 3.0_1
                            pfBlockerNG 2.0.9_1  
                            RRD_Summary 1.3.1_2
                            snort 3.2.9.1_9  
                            squid 0.4.16_1  
                            squidGuard 1.14_1
                            syslog-ng 1.1.2_2

                            1 Reply Last reply Reply Quote 0
                            • A
                              Abhishek
                              last edited by

                              @Ashfaq:

                              Thanks Sideout for the tips, I tried both ways using the default LAN rule and also the tip you gave me i.e. a new rule above the default LAN rule with the limiters applied.  no change in results, however i noticed that if both clients are laptops on torrents (i.e. equal load) then it does some bandwidth balancing.

                              attached are the screenshots of my configuration, the graphs and the limiter info.

                              i created similar and applied

                              Setup is Pfsene with squid in non transparent mode with wpad - i am able to see Unique quoue/pipe for each local IP's in diag  but when one user started downloading in bitorrent entire bandwidth was given to that user  ,(test was performed with 2 user i normal user downloading in Http  file  and other downloading in bitrorrent  , torrent user was getting speed (90%)

                              2.3-RC (amd64)
                              built on Mon Apr 04 17:09:32 CDT 2016
                              FreeBSD 10.3-RELEASE
                              Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                              darkstat 3.1.2_1
                              Lightsquid 3.0.3_1
                              mailreport 3.0_1
                              pfBlockerNG 2.0.9_1  
                              RRD_Summary 1.3.1_2
                              snort 3.2.9.1_9  
                              squid 0.4.16_1  
                              squidGuard 1.14_1
                              syslog-ng 1.1.2_2

                              1 Reply Last reply Reply Quote 0
                              • R
                                rajakupang
                                last edited by

                                use 2.1.5 works perfectly with queue

                                1 Reply Last reply Reply Quote 0
                                • perikoP
                                  periko
                                  last edited by

                                  Tested on 2.2.4 and works.
                                  As I remember TC and squid don't work together.

                                  Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                                  www.bajaopensolutions.com
                                  https://www.facebook.com/BajaOpenSolutions
                                  Quieres aprender PfSense, visita mi canal de youtube:
                                  https://www.youtube.com/c/PedroMorenoBOS

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    Rinzwind
                                    last edited by

                                    Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

                                    1 client 100%
                                    2 clients download each 50%
                                    3 clients each 33%
                                    etc…

                                    I mean the router is trying its best to handle every client right?

                                    Im going to run some tests here.

                                    Also is it really necessary to have 2 sub queues if you have 2 vlans? Can't you just specify the same up and down limiter for both?
                                    With outgoing rules you have to specify the limiter for every rule you want it to apply to. I only set it up for httphttps.

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      Harvy66
                                      last edited by

                                      @Rinzwind:

                                      Isn't it the case that bandwidth is always evenly shared, even if you do nothing with limiters etc. Thats also the case with wifi as far as I experienced.

                                      1 client 100%
                                      2 clients download each 50%
                                      3 clients each 33%
                                      etc…

                                      Not really. Because of the way fixed sized tail-drop FIFO queues interact with TCP, you tend to get a single or a few dominate flows. If you use a fair queue or head-drop queue like codel, you will get a much better distribution of bandwidth among all flows. More advanced traffic shapers, like Cake, can give even per device bandwidth distribution and latency isolation, while also giving per flow bandwidth distribution and isolation for any given device.

                                      The day PFSense gets Cake, that's what I'm using. It's not even ready for Linux yet, so don't hold your breath.

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        Rinzwind
                                        last edited by

                                        If it really helps.. then why isnt it transparently buildin already? There are lots of routers out there handling lots of clients perfectly fine without it.. including pfSense.. but if it is indeed better and fairer.. then why not enable it on all traffic by default? Cake == Codel? Sounds interesting. And yes, that checkbox 'share bandwidth evenly between all clients' is still missing ;) IF it really adds something!

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          Nullity
                                          last edited by

                                          @Rinzwind:

                                          If it really helps.. then why isnt it transparently buildin already? There are lots of routers out there handling lots of clients perfectly fine without it.. including pfSense.. but if it is indeed better and fairer.. then why not enable it on all traffic by default? Cake == Codel? Sounds interesting. And yes, that checkbox 'share bandwidth evenly between all clients' is still missing ;) IF it really adds something!

                                          Why is it not enabled by default? Partly because the definition of "better" & "fairer" are subjective.

                                          Regarding whether it really works… This thread is popular for a reason. :)

                                          Please correct any obvious misinformation in my posts.
                                          -Not a professional; an arrogant ignoramous.

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            Harvy66
                                            last edited by

                                            @Rinzwind:

                                            If it really helps.. then why isnt it transparently buildin already? There are lots of routers out there handling lots of clients perfectly fine without it.. including pfSense.. but if it is indeed better and fairer.. then why not enable it on all traffic by default? Cake == Codel? Sounds interesting. And yes, that checkbox 'share bandwidth evenly between all clients' is still missing ;) IF it really adds something!

                                            PFSense seems to try to balance "here's a check box that does black magic" and "I want to know exactly what the firewall is doing", especially since PFSense's primary users are enterprise users who know what they're doing. The more you "transparently" do by default or black-magic check boxes you create, the less control the user has.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.