Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Floating Rules order for pfSenseBlockerNG and Traffic Shaper by Limiter

    pfBlockerNG
    pfblockerng traffic shaper rules firewall rules limiters
    2
    2
    935
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ayanpal
      last edited by

      Hello,

      I am using pfSense as my firewall and I have setup pfBlockerNG as well.
      I also have the traffic shaper enabled with limiters for bufferbloat fix (FQ_CoDel Queues)

      The thing is that under the IP section of pfBlockerNG -> IP Interface/Rules Configuration -> Firewall ‘Auto’ Rule Order, the order is set to the default -> | pfB_Block/Reject | All other Rules | (original format)

      with this being set, every time the cron runs the IP rules are ordered to the top of the list and my bufferbloat rule is re-ordered just below the set of pfBlockerNG rules.

      Previously i manually set the bufferbloat rule to be at the top, but now everytime this gets reordered

      I have run tests using the http://www.dslreports.com/ and the order of the rules does effect my bufferbloat rating, as when the rule is on top i get an A+ but when the cron resets the rules and i retest, the ratings drop to an A or lower

      is it possible to make a custom order like bufferbloat_fix | pfB_Block/Reject | All other Rules | (original format) ?

      OR

      permanently fix a set of rules to be at the top of the floating rules list?

      i can change the order to something like pfSense pass/match | pfB_Block/Reject | All other Rules | (original format)
      but this would mean that the non pfBlocker rules will take precedence. Which i do not want for all rules
      i just want the bufferbloat rule to have precedence over all other rules

      1 Reply Last reply Reply Quote 0
      • S
        SteveITS Galactic Empire
        last edited by

        If you set pfBlocker to "native alias" instead of block, that will just create an alias and you can create your own block/allow rules however you want them.

        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
        Upvote 👍 helpful posts!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.