Per IP traffic shaping–share bandwith evenly between IP addresses??

teladero

No idea what you're trying to do with those rules. First you pass OPT1 net to !LAN net then you pass any any.

Nothing will be blocked and only traffic to LAN net will be limited because everything else will be passed by the first rule that doesn't have any queues set.

Thank you for that Derelict. What I am trying to do is to prevent any devices on OPT1 from accessing any devices on the LAN interface (my private network). Should I set a limiter on both rules?

Derelict

If you want to BLOCK traffic then BLOCK it.

On OPT1:

Reject IPv4 source OPT1 Net dest LAN net protocol any
Then you probably also want to:
Reject IPv4 source OPT1 Net dest This Firewall protocol any.

Above those you want to pass any local assets you want OPT1 Net to access like DNS.

And, as an aside, none of this has anything to do with limiters or this thread.

teladero

@Derelict:

If you want to BLOCK traffic then BLOCK it.

On OPT1:

Reject IPv4 source OPT1 Net dest LAN net protocol any
Then you probably also want to:
Reject IPv4 source OPT1 Net dest This Firewall protocol any.

Above those you want to pass any local assets you want OPT1 Net to access like DNS.

And, as an aside, none of this has anything to do with limiters or this thread.

I appreciate your input. I don't know why I didn't put in a reject rule in there from OPT1 to LAN. I had tested it out anyway from OPT1 trying to access the LAN network and I could not get through, which I thought was due to that first rule.

This is only coming up because I don't know how to set up the limiters with multiple LAN networks (basically taking foxale08's original technique to another level.) If anyone has a tutorial on that kind of setup, I would be grateful for a link. I could just be incredibly blind, but I did read through this entire thread and didn't find it here.

Derelict

Make a different queue with the characteristics you want and put the limiters on the pass rule on that interface. There's nothing magic about it.

teladero

@Derelict:

Make a different queue with the characteristics you want and put the limiters on the pass rule on that interface. There's nothing magic about it.

I think I got it now. Thanks for your help Derelict.

jhavers

Hi there, the limiters work, but they always work (also for one client). Its the same as daq wrote in aug 2014, but he did not get an answer to get it working correctly, so I hope that still is possible.

If I set the limiters to 6 Mbps then total available bandwidth (120 Mbps) goes down to 6 Mbps. When I start a second download/speedtest they both go evenly to 3 Mbps.

jhavers

I probably misunderstood the original post, when I input the full bandwidth (120 Mbps) in the limiter it works as expected. I tested it 4 times: 1 user 120, 2 users 60 each, 3 users 40 each and 4 users 30 each. Perfectly evenly divided, great. Thanks for this post!

Derelict

Huh?

How do you want it to work? That's the exact behavior expected.

If you want the first host to get 120Mbps then that's what you set the limiter to. Then you create a child limiter that masks on each source/dest IP address under that. Then you'd get something like:

120
60/60
40/40/40
30/30/30/30
24/24/24/24/24
20/20/20/20/20/20

etc

a_thiha

Hi guys. Help me out here too.

Let's say I have 10Mbit/s speed Internet.
I want a specific IP address to have 8Mbit/s GUARANTEED SPEED for all time and full 10Mbit/s speed when there is no one using the Internet.
If that specific IP is not in use, the rest may hit 10Mbit/s speed but 8Mbit/s speed must always be there for the specific IP.

appreciate for any reply..
thanks

Derelict

HFSC - But that's not the subject of this thread.

a_thiha

@Derelict:

HFSC - But that's not the subject of this thread.

Sorry for my ignorance. ::)

Can you at least guide me to configure HFSC to solve my problem. ;D

Derelict

There are countless threads about it.

danioj

my first post on the forum :)

i wanted to say that the guide offered by foxale08 back in 2013 works great on version:

2.2.6-RELEASE (amd64)
built on Mon Dec 21 14:50:08 CST 2015
FreeBSD 10.1-RELEASE-p25

https://forum.pfsense.org/index.php?topic=63531.msg364520#msg364520

i run a 1 wan 1 lan port setup. all traffic over the lan port is forced over a vpn connection.

as a practical test i maxed out my 25/5 Mb/s bandwidth with a long download. i tried a long hd youtube video and it stuttered and wouldn't play. as expected.

i then applied the guide as instructed (deviating only when i had to put in my upload and download speeds which i chose to put in Mb/s and no Kb/s).

i re-started the long download to max the bandwidth. i tried the long hd youtube video and low and behold the speed reduced on the download and the youtube video worked perfectly. to stress test it i started a similar video on 4 more clients and it had the same great effect. pushed it further and started another high speed download and it seemed to keep working. neither hd video stopped buffering and each download ran with roughly even download speed.

excellent solution. thank you.

Thank you everyone for this!
Just curious what would happen/is there a benefit to apply the in/out pipe that you specify for the lan firewall rule on your VPN? If yes then is it the same orientation for OpenVPN/Ipsec? (incoming pipe is going out and out pipe is incoming).

teladero

@crisdavid:

Thank you everyone for this!
Just curious what would happen/is there a benefit to apply the in/out pipe that you specify for the lan firewall rule on your VPN? If yes then is it the same orientation for OpenVPN/Ipsec? (incoming pipe is going out and out pipe is incoming).

I am wondering about this myself. My situation is that I have my pfsense box using one of the initial suggestions here on two different interfaces and they seem to work well. I would love to dedicate a set amount to any IPsec traffic because I have noticed it slowing down a lot since I put these limiters in place. I will do some testing today and get back to you.

Edit: So, I don't know why I thought it was like this, but the IPsec tunnel is not in the interfaces section so I can't assign a limiter to it. Does anyone know a way to do this?

teladero

Now I am wondering if I messed up somewhere along the line. As you can see, I have the HFSC traffic shaper set up and I also have limiters. From what I am reading now, you should only have one or the other.

On one hand, I like the limiter because it lets me limit a specific interface very easily. My OPT2 interface has guest devices which are greatly reduced on the usage they are allowed. My LAN interface also has a limited on it so that the combined speeds don't exceed my WAN connection. The LAN interface has a lot of bandwidth hogs as well as VOIP traffic, so I am trying to be very careful on how I manage the shaping here.

If anyone has any suggestions or can explain why they would go with HFSC vs a limiter, I would greatly appreciate it. Or if I should create a whole new thread, feel free to slap me around!

![shaper 1.PNG](/public/imported_attachments/1/shaper 1.PNG)
![shaper 1.PNG_thumb](/public/imported_attachments/1/shaper 1.PNG_thumb)
![shaper 2.PNG](/public/imported_attachments/1/shaper 2.PNG)
![shaper 2.PNG_thumb](/public/imported_attachments/1/shaper 2.PNG_thumb)

@teladero:

@crisdavid:

Thank you everyone for this!
Just curious what would happen/is there a benefit to apply the in/out pipe that you specify for the lan firewall rule on your VPN? If yes then is it the same orientation for OpenVPN/Ipsec? (incoming pipe is going out and out pipe is incoming).

I am wondering about this myself. My situation is that I have my pfsense box using one of the initial suggestions here on two different interfaces and they seem to work well. I would love to dedicate a set amount to any IPsec traffic because I have noticed it slowing down a lot since I put these limiters in place. I will do some testing today and get back to you.

Edit: So, I don't know why I thought it was like this, but the IPsec tunnel is not in the interfaces section so I can't assign a limiter to it. Does anyone know a way to do this?

In my case I followed this thread and I'm using CODELQ on my pfSense Box that I use for my home personal network. Just got my Ipsec up and been having OpenVPN for awhile but realised that in the firewall rules you can specify the in/out pipe for the VPNs. I tried specifying the in/out just as I did following this thread but to my OpenVPN. I don't get a lot of traffic all the time so I can't see how it performs :/ with this setup.

pererikk

Hi

I tried to input these settings in 2.3.2-RELEASE (amd64) and it worked for a while, but all of a sudden some webpages could no be accessed…..
I rebooted the router but i did not help, i removed the limiter setting and all started to work again...

Has someone else tried these settings in the newest release ?
Or is it a fact that it only works in the older versions ?

Kind regards

PES

@pererikk:

Hi

I tried to input these settings in 2.3.2-RELEASE (amd64) and it worked for a while, but all of a sudden some webpages could no be accessed…..
I rebooted the router but i did not help, i removed the limiter setting and all started to work again...

Has someone else tried these settings in the newest release ?
Or is it a fact that it only works in the older versions ?

Kind regards

PES

I've personally haven't run into this. Do you have any extensions installed on your browser?, and do you have any packages or configurations running on your pfSense box like?

pererikk

@crisdavid:

I've personally haven't run into this. Do you have any extensions installed on your browser?, and do you have any packages or configurations running on your pfSense box like?

I only have squid running, and the problem happened on several different computers,ipads and different brrowser (chrome, safari and firefox), so i don't think its a browser thingie..

Everything worked great before limiters and after i removed the limiters, so the only conclusion i came to that it doesn't work in 2.3.2,
can squid have an impact ?