Sharing limiters and child limiters between firewall rules

grdk

I understand how to create limiters and child limiters, but I have a question regarding sharing a limiter between different rules.

My scenario:
I have 3 tenants at my property, who during certain hours hammer my connection with VoIP and streaming usage. I currently have a number of pre-defined limiters set to work with, in granular increments, however the two limiters I'm using are –

Up_3_Mbps (Source address)
- qUp_3_Mbps (Source address)
Down_20_Mbps (Destination address)
- qDown_20_Mbps (Destination address)

Each limiter has a child limiter as described above.

I've made 3 firewall pass rules, with the source being an alias for each tenant's devices. The rules have their In/Out pipes defined to the child limiters described above (qUp_3_Mbs / aDown_20_Mbps).

The desired effect is to have all 3 tenants share a 20/3 connection, not to give each a separate 20/3 connection. Am I setting up the rules correctly?

Kindest regards for your advice!

grdk

I understand my question may have been answered before, but I'm unable to find a similar thread explaining this, thus the new post. If someone can off-hand recall a post that answers my question, please kindly link it here.

Thanks!

Derelict

No you would not mask on the parent limiters - just the children. masking on the parent will create a separate pipe for every source/dest IP address.

grdk

Thanks for your reply Derelict.

So if I'm understanding you correctly, I should remove the source/destination address mask from the parent limiter (e.g. Up_3_Mbps), and instead set the mask to source on the child limiter (e.g. qUp_3_Mbps). So in my case, if I use the child limiter qUp_3_Mbps on multiple firewall rules, all those rules share that pipe? If I let's say create multiple child limiters under the parent (e.g. qUp_3_Mbps_1, qUp_3_Mbps_2, qUp_3_Mbps_3, etc. etc.) then they would all share a single 3 Mbps pipe?

Derelict

That is my understanding, yes. You can put multiple interfaces into the same limiter and they will all share that bandwidth as long as they are not masked.

grdk

Thank you very much Derelict for confirming. I've now adjusted my firewall rules per your suggestion.