Limit PPS for UDP Traffic

Nullity

https://forums.freebsd.org/threads/udp-blocking-with-rate-limits.42933/
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=189721

cr_hyland

So it looks like the feature now exists in freeBSD, I wonder can it be used in pfSense or if it will be added as an option to the GUI!

mdes

@craggy:

So it looks like the feature now exists in freeBSD, I wonder can it be used in pfSense or if it will be added as an option to the GUI!

Is it implemented?

belt9

How about putting your upload traffic under a dummynet limiter and setting two queues, one for DNS weighted for whatever you need (maybe 10?) And the other for everything else weighted at the remainder of 100 (in this case 90).

It would allow all 140kpps out while the network is idle, but as soon as other traffic came on it will be prioritized over the DNS - never allowing it to override the rest of your traffic.

mdes

@belt9:

How about putting your upload traffic under a dummynet limiter and setting two queues, one for DNS weighted for whatever you need (maybe 10?) And the other for everything else weighted at the remainder of 100 (in this case 90).

Clients use my own DNS server running on pfSense. I want to rate-limit other UDP transmits.

What about pfSense developers would demand this feature from pf developers or (maybe better) make pf's fork and then implement UDP rate-limiting?
PF misses MAC filtering and UDP rate-limiting. This is a must these days.

belt9

@mdes:

Clients use my own DNS server running on pfSense. I want to rate-limit other UDP transmits.

I'm not seeing why you couldn't do that?

If you can write a firewall rule for the traffic then you can apply a dummynet limiter to the traffic.

mdes

@belt9:

If you can write a firewall rule for the traffic then you can apply a dummynet limiter to the traffic.

Limiters work with bits/s and I need packets/s. There may be 1000 UDP packets per second producing only 100 kB/s.

Harvy66

@mdes:

@belt9:

How about putting your upload traffic under a dummynet limiter and setting two queues, one for DNS weighted for whatever you need (maybe 10?) And the other for everything else weighted at the remainder of 100 (in this case 90).

Clients use my own DNS server running on pfSense. I want to rate-limit other UDP transmits.

What about pfSense developers would demand this feature from pf developers or (maybe better) make pf's fork and then implement UDP rate-limiting?
PF misses MAC filtering and UDP rate-limiting. This is a must these days.

UDP rate limit and MAC filtering are a must for switches, not edge firewalls. UDP rate limiting is primarily used for broadcast storm preventing and MAC filtering is used to prevent unknown devices from even gaining access to the physical network. Not that it's very effective, but it is another layer.

Technically, MAC filtering on a firewall is implemented as a layering "violation". Not to mention that MAC addresses should NEVER be trusted in the first place. Filtering on MAC addresses is just extra work for weak obscurification with virtually no additional security.

In general, many common "must haves" are just simplistic bandaids for a problem the end user does not fully understand.

That being said, UDP rate limiting does have some useful characteristics, but mostly in trying to help protect others from themselves. DNS amp attacks, which should not happen if DNS is configured correctly.

My home pfSense router is able to fairly easily NAT+route+shape 1.4Mpps of UDP. If your firewall is dying from it, you may have something wrong.

mdes

@Harvy66:

UDP rate limit and MAC filtering are a must for switches, not edge firewalls.

Linux iptables has it all.

@Harvy66:

DNS amp attacks, which should not happen if DNS is configured correctly.

Yes, but DNS is not only protocol which uses UDP.

@Harvy66:

My home pfSense router is able to fairly easily NAT+route+shape 1.4Mpps of UDP.

I have different use case, huge difference is that my router does not fit in "home" scale.

belt9

Exactly what UDP traffic problems are you having?

chrcoluk

harvy66 I know not on topic, but how are you collecting those stats in your graphs? the supplied bsnmp in its stock config doesnt supply the data, me and some others asked in another thread but noone with the knowledge wanted to help.

Although your answer could still help the OP as well as monitoring may help him manage his situation better.

mdes

@belt9:

Exactly what UDP traffic problems are you having?

Since PF and consequently pfSense lack limit pps for UDP feature, I had to do it on an upstream router.
Well I think, unless proper MAC filtering, NetFlow MAC exporting and UDP PPS limiting is implemented, I cannot use pfSense for my customers (SMB and small enterprises).
It has many great features and I really appreciate all work that developers have done.