Traffic shaping not working in Beta 4 for outbound queues?



  • I've been running PF Sense since Beta 1 and have had traffic shaping enabled since then.  Things worked pretty well through Beta 3, but with the upgrade to Beta 4 I noticed that none of my outbound queues have any traffic through them with the exception of the default queue.  Inbound queues work as described.  I've tried rebuilding the rules using the traffic shaping wizard with Beta 4 but the same result happens.  My main question is if there are known issues with outbound queing not working properly in Beta 4?

    thanks,

    Ryan Wilkins



  • have you tried reseting the states?



  • Nope, in fact we solved more bugs since beta3.  It really should be working.

    Try clearing your states after running the wizard.



  • I am having the same issue based with voip queue … inbound is working ... but nothing on the outbound ... reran the wizard .. reset the states ... tested ... rebooted ... tested ... same issue ... although just before I reset the states the webgui became unresponsive for about 20mins. I forgot to check the logs before I reboot. I will see if I can reproduce the issue.



  • i have this problem too

    • queue status not displayed along time (only page header). reafresh not helped
      If i press stop in IE window - page form displayed in clean state

    • if i see queue graph - worked only def lines qlanaks

    –-----------------------------------------
    new
    queue state page i can see after 10-15 min wites (after refresh). This is may be processor usage? May be queue state procedure take more processor time then pfS 3 ? (in 3 ver queue state worked beautiful in my hardvare config)
    I have P166/128Mb


    new2



  • @dvserg:

    i have this problem too

    • queue status not displayed along time (only page header). reafresh not helped
      If i press stop in IE window - page form displayed in clean state

    Below you state you have a p166 - it'll be slow.  That's slower than the Soekris 4801 I use as a test platform.

    @dvserg:

    • if i see queue graph - worked only def lines qlanaks

    Nothing has changed in the wizard since before Beta3.  There was one or two small rule generation bug fixes in the backend since beta3, but those changes have had two sets of eyes review them.

    @dvserg:

    –-----------------------------------------
    new
    queue state page i can see after 10-15 min wites (after refresh). This is may be processor usage? May be queue state procedure take more processor time then pfS 3 ? (in 3 ver queue state worked beautiful in my hardvare config)
    I have P166/128Mb

    Hard to believe.  I can look to see what changed on the status page, but I don't remember any recent commits to it.

    –Bill



  • @psychosematic:

    I am having the same issue based with voip queue … inbound is working ... but nothing on the outbound ... reran the wizard .. reset the states ... tested ... rebooted ... tested ... same issue ... although just before I reset the states the webgui became unresponsive for about 20mins. I forgot to check the logs before I reboot. I will see if I can reproduce the issue.

    Could you post the /tmp/rules.debug and the shaper config xml so we could take a look?



  • I'm tested shapping - all traffic shaped on default rules.
    I have ADSL (assymetric traffic speed). May be this have special options for rules?



  • @dvserg:

    I'm tested shapping - all traffic shaped on default rules.
    I have ADSL (assymetric traffic speed). May be this have special options for rules?

    No.  It asks for upload and download speeds during the wizard.



  • hm..
    this my base config

     <shaper><schedulertype>hfsc</schedulertype>
    	 <queue><schedulertype><bandwidth>2</bandwidth>
    		<bandwidthtype>Mb</bandwidthtype>
    		<priority>0</priority>
    		<name>qwanRoot</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime><realtime3><realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue>on</parentqueue>
    		 <attachtoqueue><associatedrule><rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></attachtoqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></realtime3></realtime></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><schedulertype><bandwidth>256</bandwidth>
    		<bandwidthtype>Kb</bandwidthtype>
    		<priority>0</priority>
    		<name>qlanRoot</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime><realtime3><realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue>on</parentqueue>
    		 <attachtoqueue><associatedrule><rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></attachtoqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></realtime3></realtime></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><name>qwandef</name>
    		<attachtoqueue>qwanRoot</attachtoqueue>
    		<associatedrule>0</associatedrule>
    		<defaultqueue>true</defaultqueue>
    		<priority>3</priority>
    		<realtime>on</realtime>
    		<realtime3>1%</realtime3>
    		<bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<qlimit>500</qlimit></queue> 
    	 <queue><name>qlandef</name>
    		<priority>3</priority>
    		<attachtoqueue>qlanRoot</attachtoqueue>
    		<associatedrule>0</associatedrule>
    		<defaultqueue>true</defaultqueue>
    		<realtime>on</realtime>
    		<realtime3>1%</realtime3>
    		<bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<qlimit>500</qlimit></queue> 
    	 <queue><schedulertype><bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<priority>7</priority>
    		<name>qwanacks</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
    		<realtime3>1%</realtime3>
    		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qwanRoot</attachtoqueue>
    		 <associatedrule><ack>on</ack>
    		 <rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><schedulertype><bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<priority>7</priority>
    		<name>qlanacks</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
    		<realtime3>1%</realtime3>
    		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qlanRoot</attachtoqueue>
    		 <associatedrule><ack>on</ack>
    		 <rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><schedulertype><bandwidth>3</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<priority>6</priority>
    		<name>qRdpUp</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
    		<realtime3>3%</realtime3>
    		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qwanRoot</attachtoqueue>
    		 <associatedrule><rio><red>on</red>
    		<ecn>on</ecn>
    		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><schedulertype><bandwidth>3</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<priority>6</priority>
    		<name>qRdpDown</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
    		<realtime3>3%</realtime3>
    		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qlanRoot</attachtoqueue>
    		 <associatedrule><rio><red>on</red>
    		<ecn>on</ecn>
    		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><name>qOthersUpH</name>
    		<attachtoqueue>qwanRoot</attachtoqueue>
    		<associatedrule>0</associatedrule>
    		<priority>6</priority>
    		<red>on</red>
    		<ecn>on</ecn>
    		<realtime>on</realtime>
    		<realtime3>1Kb</realtime3>
    		<bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype></queue> 
    	 <queue><name>qOthersDownH</name>
    		<attachtoqueue>qlanRoot</attachtoqueue>
    		<associatedrule>0</associatedrule>
    		<priority>6</priority>
    		<red>on</red>
    		<ecn>on</ecn>
    		<realtime>on</realtime>
    		<realtime3>1Kb</realtime3>
    		<bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype></queue> 
    	 <queue><name>qOthersUpL</name>
    		<attachtoqueue>qwanRoot</attachtoqueue>
    		<associatedrule>0</associatedrule>
    		<priority>2</priority>
    		<red>on</red>
    		<ecn>on</ecn>
    		<realtime>on</realtime>
    		<realtime3>1Kb</realtime3>
    		<bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<qlimit>500</qlimit></queue> 
    	 <queue><name>qOthersDownL</name>
    		<attachtoqueue>qlanRoot</attachtoqueue>
    		<associatedrule>0</associatedrule>
    		<priority>2</priority>
    		<red>on</red>
    		<ecn>on</ecn>
    		<realtime>on</realtime>
    		<realtime3>1Kb</realtime3>
    		<bandwidth>1</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<qlimit>500</qlimit></queue> 
    	 <queue><schedulertype><bandwidth>3</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<priority>2</priority>
    		<name>qwebUp</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
    		<realtime3>2Kb</realtime3>
    		 <realtime2><realtime1><upperlimit>on</upperlimit>
    		<upperlimit3>5%</upperlimit3>
    		 <upperlimit2><upperlimit1><parentqueue><attachtoqueue>qwanRoot</attachtoqueue>
    		 <associatedrule><rio><red>on</red>
    		<ecn>on</ecn>
    		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <queue><schedulertype><bandwidth>3</bandwidth>
    		<bandwidthtype>%</bandwidthtype>
    		<priority>2</priority>
    		<name>qwebDown</name>
    		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
    		<realtime3>2Kb</realtime3>
    		 <realtime2><realtime1><upperlimit>on</upperlimit>
    		<upperlimit3>5%</upperlimit3>
    		 <upperlimit2><upperlimit1><parentqueue><attachtoqueue>qlanRoot</attachtoqueue>
    		 <associatedrule><rio><red>on</red>
    		<ecn>on</ecn>
    		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
    	 <rule><in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>22</port></destination> 
    		 <direction><iptos><tcpflags><descr>m_OtherH SSH inbound</descr>
    		<inqueue>qOthersUpH</inqueue>
    		<outqueue>qOthersDownH</outqueue></tcpflags></iptos></direction></any></rule> 
    	 <rule><in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>22</port></any></destination> 
    		 <direction><iptos><tcpflags><descr>m_OtherH SSH outbound</descr>
    		<inqueue>qOthersDownH</inqueue>
    		<outqueue>qOthersUpH</outqueue></tcpflags></iptos></direction></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network></destination> 
    		<descr>m_Other ICMP inbound</descr>
    		<protocol>icmp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any></any></destination> 
    		<descr>m_Other ICMP outbound</descr>
    		<protocol>icmp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>53-53</port></destination> 
    		<descr>m_Other DNS1 inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>53-53</port></any></destination> 
    		<descr>m_Other DNS1 outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>53-53</port></destination> 
    		<descr>m_Other DNS2 inbound</descr>
    		<protocol>udp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>53-53</port></any></destination> 
    		<descr>m_Other DNS2 outbound</descr>
    		<protocol>udp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>161-161</port></destination> 
    		<descr>m_Other SNMP2 inbound</descr>
    		<protocol>udp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>161-161</port></any></destination> 
    		<descr>m_Other SNMP2 outbound</descr>
    		<protocol>udp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>161-161</port></destination> 
    		<descr>m_Other SNMP inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>161-161</port></any></destination> 
    		<descr>m_Other SNMP outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>119-119</port></destination> 
    		<descr>m_Other NNTP1 inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>119-119</port></any></destination> 
    		<descr>m_Other NNTP1 outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>119-119</port></destination> 
    		<descr>m_Other NNTP2 inbound</descr>
    		<protocol>udp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>119-119</port></any></destination> 
    		<descr>m_Other NNTP2 outbound</descr>
    		<protocol>udp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network></destination> 
    		<descr>m_Other IPSEC inbound</descr>
    		<protocol>esp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any></any></destination> 
    		<descr>m_Other IPSEC outbound</descr>
    		<protocol>esp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>500-500</port></destination> 
    		<descr>m_Other IPSEC inbound</descr>
    		<protocol>udp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>500-500</port></any></destination> 
    		<descr>m_Other IPSEC outbound</descr>
    		<protocol>udp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network></destination> 
    		<descr>m_Other IPSEC inbound</descr>
    		<protocol>ah</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any></any></destination> 
    		<descr>m_Other IPSEC outbound</descr>
    		<protocol>ah</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>1723-1723</port></destination> 
    		<descr>m_Other PPTP inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>1723-1723</port></any></destination> 
    		<descr>m_Other PPTP outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>445-445</port></destination> 
    		<descr>m_Other SMB1 inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>445-445</port></any></destination> 
    		<descr>m_Other SMB1 outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>137-139</port></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other SMB2 inbound</descr>
    		<inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue></tcpflags></iptos></direction></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>137-139-137-139</port></any></destination> 
    		<descr>m_Other SMB2 outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>3389</port></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other MSRDP inbound</descr>
    		<inqueue>qRdpUp</inqueue>
    		<outqueue>qRdpDown</outqueue></tcpflags></iptos></direction></any></rule> 
    	 <rule><in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>3389</port></any></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other MSRDP outbound</descr>
    		<inqueue>qRdpDown</inqueue>
    		<outqueue>qRdpUp</outqueue></tcpflags></iptos></direction></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>6667-6670</port></destination> 
    		<descr>m_Other IRC inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>6667-6670</port></any></destination> 
    		<descr>m_Other IRC outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>80</port></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other HTTP inbound</descr>
    		<inqueue>qwebUp</inqueue>
    		<outqueue>qwebDown</outqueue></tcpflags></iptos></direction></any></rule> 
    	 <rule><in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>80</port></any></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other HTTP outbound</descr>
    		<inqueue>qwebDown</inqueue>
    		<outqueue>qwebUp</outqueue></tcpflags></iptos></direction></rule> 
    	 <rule><in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>443</port></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other HTTPS inbound</descr>
    		<inqueue>qwebUp</inqueue>
    		<outqueue>qwebDown</outqueue></tcpflags></iptos></direction></any></rule> 
    	 <rule><in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>443</port></any></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other HTTPS outbound</descr>
    		<inqueue>qwebDown</inqueue>
    		<outqueue>qwebUp</outqueue></tcpflags></iptos></direction></rule> 
    	 <rule><in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>3125-3129</port></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other Proxy inbound</descr>
    		<inqueue>qwebUp</inqueue>
    		<outqueue>qwebDown</outqueue></tcpflags></iptos></direction></any></rule> 
    	 <rule><in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<protocol>tcp</protocol>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>3125-3129</port></any></destination> 
    		 <direction><iptos><tcpflags><descr>m_Other Proxy outbound</descr>
    		<inqueue>qwebDown</inqueue>
    		<outqueue>qwebUp</outqueue></tcpflags></iptos></direction></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>143-143</port></destination> 
    		<descr>m_Other IMAP inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>143-143</port></any></destination> 
    		<descr>m_Other IMAP outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>110-110</port></destination> 
    		<descr>m_Other POP3 inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>110-110</port></any></destination> 
    		<descr>m_Other POP3 outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <rule><inqueue>qwandef</inqueue>
    		<outqueue>qlandef</outqueue>
    		<in-interface>wan</in-interface>
    		<out-interface>lan</out-interface>
    		<source>
    			 <any><destination><network>lan</network>
    			<port>25-25</port></destination> 
    		<descr>m_Other SMTP inbound</descr>
    		<protocol>tcp</protocol></any></rule> 
    	 <rule><inqueue>qlandef</inqueue>
    		<outqueue>qwandef</outqueue>
    		<in-interface>lan</in-interface>
    		<out-interface>wan</out-interface>
    		<source>
    			<network>lan</network>
    
    		 <destination><any><port>25-25</port></any></destination> 
    		<descr>m_Other SMTP outbound</descr>
    		<protocol>tcp</protocol></rule> 
    	 <enable></enable></shaper> 
    
    


  • You forgot to show /tmp/rules.debug ….



  • # System Aliases 
    loopback = "{ lo0 }"
    lan = "{ xl0  carp0 bridge0 }"
    wan = "{ rl0  carp0 bridge0 ng0 }"
    # User Aliases 
    AdminLine = "{ 10.62.0.25 }"
    
    set loginterface rl0
    set loginterface xl0
    set optimization normal
    
    scrub on rl0 all random-id 
    altq on rl0 hfsc bandwidth 2Mb queue { qwanRoot }
    altq on xl0 hfsc bandwidth 256Kb queue { qlanRoot }
    
    queue qwanRoot bandwidth 2Mb priority 0 hfsc { qwandef, qwanacks, qRdpUp, qOthersUpH, qOthersUpL, qwebUp }
    queue qlanRoot bandwidth 256Kb priority 0 hfsc { qlandef, qlanacks, qRdpDown, qOthersDownH, qOthersDownL, qwebDown }
    queue qwandef bandwidth 1% priority 3 qlimit 500 hfsc (  default realtime 1% )
    queue qlandef bandwidth 1% priority 3 qlimit 500 hfsc (  default realtime 1% )
    queue qwanacks bandwidth 1% priority 7 hfsc (  realtime 1% )
    queue qlanacks bandwidth 1% priority 7 hfsc (  realtime 1% )
    queue qRdpUp bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
    queue qRdpDown bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
    queue qOthersUpH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
    queue qOthersDownH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
    queue qOthersUpL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
    queue qOthersDownL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
    queue qwebUp bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )
    queue qwebDown bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )
    
    # UPnPd rdr anchor
    rdr-anchor "upnpd/*"
    nat-anchor "pftpx/*"
    nat-anchor "natearly/*"
    nat-anchor "natrules/*"
    # FTP proxy
    rdr-anchor "pftpx/*"
    nat on $wan from 10.62.0.0/24 port 500 to any port 500 -> (rl0) port 500
    nat on $wan from 10.62.0.0/24 to any -> (rl0)
    #SSH Lockout Table
    table <sshlockout>persist
    
    # spam table 
    table <whitelist>persist
    table <blacklist>persist
    table <spamd>persist
    table <spamd-white>persist file "/var/db/whitelist.txt"
    rdr pass on rl0 proto tcp from <blacklist>to port smtp -> 127.0.0.1 port spamd
    rdr pass on rl0 proto tcp from <spamd>to port smtp -> 127.0.0.1 port spamd
    rdr pass on rl0 proto tcp from ! <spamd-white>to port smtp -> 127.0.0.1 port spamd
    
    # Load balancing anchor - slbd updates
    rdr-anchor "slb"
    
    # FTP Proxy/helper
    
    block in all tag unshaped label "SHAPER: first match rule"
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 22  keep state tagged unshaped tag qOthersUpH 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 22 keep state tagged qOthersUpH tag qOthersDownH
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 22  keep state tagged unshaped tag qOthersDownH 
    pass out on $wan proto tcp from any to any port 22 keep state tagged qOthersDownH tag qOthersUpH
    pass in on  $wan proto icmp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
    pass out on $lan proto icmp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
    pass in on  $lan proto icmp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
    pass out on $wan proto icmp from any to any keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 53 keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 53 keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 161 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 161 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 119 keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 119 keep state tagged qlandef tag qwandef
    pass in on  $wan proto esp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
    pass out on $lan proto esp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
    pass in on  $lan proto esp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
    pass out on $wan proto esp from any to any keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 500  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 500 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 500  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 500 keep state tagged qlandef tag qwandef
    pass in on  $wan proto ah from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
    pass out on $lan proto ah from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
    pass in on  $lan proto ah from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
    pass out on $wan proto ah from any to any keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 1723  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 1723 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 1723  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 1723 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 445  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 445 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 445  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 445 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 137:139  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 137:139 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 137:139  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 137:139 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3389  keep state tagged unshaped tag qRdpUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 3389 keep state tagged qRdpUp tag qRdpDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3389  keep state tagged unshaped tag qRdpDown 
    pass out on $wan proto tcp from any to any port 3389 keep state tagged qRdpDown tag qRdpUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 6667:6670  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 6667:6670 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 6667:6670  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 6667:6670 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 80  keep state tagged unshaped tag qwebUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 80 keep state tagged qwebUp tag qwebDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 80  keep state tagged unshaped tag qwebDown 
    pass out on $wan proto tcp from any to any port 80 keep state tagged qwebDown tag qwebUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 443  keep state tagged unshaped tag qwebUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 443 keep state tagged qwebUp tag qwebDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 443  keep state tagged unshaped tag qwebDown 
    pass out on $wan proto tcp from any to any port 443 keep state tagged qwebDown tag qwebUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3125:3129  keep state tagged unshaped tag qwebUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 3125:3129 keep state tagged qwebUp tag qwebDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3125:3129  keep state tagged unshaped tag qwebDown 
    pass out on $wan proto tcp from any to any port 3125:3129 keep state tagged qwebDown tag qwebUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 143  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 143 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 143  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 143 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 110  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 110 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 110  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 110 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 25  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 25 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 25  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 25 keep state tagged qlandef tag qwandef
    
    anchor "ftpsesame/*" 
    anchor "firewallrules"
    
    # loopback
    anchor "loopback"
    pass in quick on $loopback all label "pass loopback"
    pass out quick on $loopback all label "pass loopback"
    
    # package manager early specific hook
    anchor "packageearly"
    
    # carp
    anchor "carp"
    # enable ftp-proxy
    
    anchor "ftpproxy"
    anchor "pftpx/*"
    pass in quick on xl0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost"
    pass in quick on xl0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost"
    pass in quick on rl0 inet proto tcp from port 20 to (rl0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection"
    
    # allow access to DHCP server on LAN
    anchor "dhcpserverlan"
    pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
    pass in quick on $lan proto udp from any port = 68 to 10.62.0.3 port = 67 label "allow access to DHCP server on LAN"
    pass out quick on $lan proto udp from 10.62.0.3 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
    
    pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan"
    
    # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
    antispoof for xl0
    # Support for allow limiting of TCP connections by establishment rate
    anchor "limitingesr"
    table <virusprot>block in quick from <virusprot>to any label "virusprot overload table"
    
    # let out anything from the firewall host itself and decrypted IPsec traffic
    pass out quick on rl0 all keep state label "let out anything from firewall host itself"
    # pass traffic from firewall -> out
    anchor "firewallout"
    pass out quick on rl0 all keep state tagged qwandef queue (qwandef, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state tagged qRdpUp queue (qRdpUp, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state tagged qOthersUpH queue (qOthersUpH, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state tagged qwebUp queue (qwebUp, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qlandef queue (qlandef, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qRdpDown queue (qRdpDown, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qOthersDownH queue (qOthersDownH, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qwebDown queue (qwebDown, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state queue (qlandef, qlanacks) label "let out anything from firewall host itself"
    pass out quick on bridge0 all keep state label "let out anything from firewall host itself"
    
    # make sure the user cannot lock himself out of the webGUI or SSH
    anchor "anti-lockout"
    pass in quick from 10.62.0.0/24 to 10.62.0.3 keep state label "anti-lockout web rule"
    
    # SSH lockout
    block in log proto tcp from <sshlockout>to any port 22 label "sshlockout"
    
    # User-defined rules follow
    # Anchors for rules that might be matched by queues
    anchor qwanRoot tagged qwanRoot
    anchor qlanRoot tagged qlanRoot
    anchor qwandef tagged qwandef
    anchor qlandef tagged qlandef
    anchor qwanacks tagged qwanacks
    anchor qlanacks tagged qlanacks
    anchor qRdpUp tagged qRdpUp
    anchor qRdpDown tagged qRdpDown
    anchor qOthersUpH tagged qOthersUpH
    anchor qOthersDownH tagged qOthersDownH
    anchor qOthersUpL tagged qOthersUpL
    anchor qOthersDownL tagged qOthersDownL
    anchor qwebUp tagged qwebUp
    anchor qwebDown tagged qwebDown
    pass in log quick on $wan from any to any keep state  queue (qwandef, qwanacks)  label "USER_RULE: Default Wan -> any" 
    pass in log quick on $lan from any to any keep state  queue (qlandef, qlanacks)  label "USER_RULE: Default LAN -> any" 
    pass quick proto carp keep state
    pass quick proto pfsync
    # VPN Rules
    
    #---------------------------------------------------------------------------
    # default rules (just to be sure)
    #---------------------------------------------------------------------------
    block in log quick all label "Default block all just to be sure."
    block out log quick all label "Default block all just to be sure."</sshlockout></virusprot></virusprot></spamd-white></spamd></blacklist></spamd-white></spamd></blacklist></whitelist></sshlockout> 
    


  • queue qwebUp bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )
    queue qwebDown bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )

    5% of 256K is really really slow (12Kbit aka 1KByte) - that's the limit you transmit web traffic OUT of your network.
    5% of 2Mbit is 102Kbit, also rather slow.

    –Bill



  • I see the problem.

    let out anything from the firewall host itself and decrypted IPsec traffic

    pass out quick on rl0 all keep state label "let out anything from firewall host itself"

    is by passing the queues. and shouldn't be there if the shaper is active. Hrm I'll poke at the code a little later.



  • @Leoandru:

    I see the problem.

    let out anything from the firewall host itself and decrypted IPsec traffic

    pass out quick on rl0 all keep state label "let out anything from firewall host itself"

    is by passing the queues. and shouldn't be there if the shaper is active. Hrm I'll poke at the code a little later.

    That would be my fault.  We need this to allow pptp on wan client to work.  Any easy workarounds?



  • oh, ok.. It should be safe to remove that rule if the shaper is active since the shaper rules always creates a default pass out for each interface.

    in his case

    pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"



  • Okay, I have changed it to only install this rule if the traffic shaper is disabled.

    If this is a full installation, please run from option 8 on the pfSense console:

    cvs_sync.sh releng_1



  • @sullrich:

    Okay, I have changed it to only install this rule if the traffic shaper is disabled.

    If this is a full installation, please run from option 8 on the pfSense console:

    cvs_sync.sh releng_1

    How configure cvs_sync for update with existing firewall? (or http)



  • There is nothing to configure. Just make sure your pfSense is connected to the internet and can access/resolve pfsense.org as it will pull down the files from there. Then run the command from the shell. It will take some time. Don't use the webgui while it's updating.



  • @hoba:

    There is nothing to configure. Just make sure your pfSense is connected to the internet and can access/resolve pfsense.org as it will pull down the files from there. Then run the command from the shell. It will take some time. Don't use the webgui while it's updating.

    ~~what different between internet access of webgui package_install and shell pkg_add?

    In webgui packaged adding good without any trouble, but in shell

    pkg_add cvsup-without-gui

    can't connect to ftp…~~

    cvs_sync.sh need to connect to cvs.pfsense.com only 5999 port or any?



  • Make it easier on yourself and allow any.  It needs to connect to pfSense.com for packages as well.

    Plus traffic from the firewall itself does not apply to the filter rules.



  • No. I can't see any effect after update  :(
    Bandwidth not worked - only default and ACK



  • Look at the rules.. is the offending rule still there? the one I pointed out.



  • @dvserg:

    No. I can't see any effect after update  :(
    Bandwidth not worked - only default and ACK

    Did you reboot after running the command?



  • Not. I nothing to find
    really worked in queue status : qwandef  qlandef  qlanacks
    other queues not have packets (0/pps)

    # System Aliases 
    loopback = "{ lo0 }"
    lan = "{ xl0  carp0 bridge0 }"
    wan = "{ rl0  carp0 bridge0 ng0 }"
    # User Aliases 
    AdminLine = "{ 10.62.0.25 }"
    
    set loginterface rl0
    set loginterface xl0
    set optimization normal
    
    scrub on rl0 all random-id 
    altq on rl0 hfsc bandwidth 2Mb queue { qwanRoot }
    altq on xl0 hfsc bandwidth 256Kb queue { qlanRoot }
    
    queue qwanRoot bandwidth 2Mb priority 0 hfsc { qwandef, qwanacks, qRdpUp, qOthersUpH, qOthersUpL, qwebUp }
    queue qlanRoot bandwidth 256Kb priority 0 hfsc { qlandef, qlanacks, qRdpDown, qOthersDownH, qOthersDownL, qwebDown }
    queue qwandef bandwidth 5% priority 3 hfsc (  default realtime 1% )
    queue qlandef bandwidth 5% priority 3 hfsc (  default realtime 1% )
    queue qwanacks bandwidth 5% priority 7 hfsc (  realtime 1% )
    queue qlanacks bandwidth 5% priority 7 hfsc (  realtime 1% )
    queue qRdpUp bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
    queue qRdpDown bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
    queue qOthersUpH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
    queue qOthersDownH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
    queue qOthersUpL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
    queue qOthersDownL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
    queue qwebUp bandwidth 10% priority 2 hfsc (  red ecn realtime 5Kb )
    queue qwebDown bandwidth 40Kb priority 2 hfsc (  red ecn realtime 5Kb )
    
    # UPnPd rdr anchor
    rdr-anchor "upnpd/*"
    nat-anchor "pftpx/*"
    nat-anchor "natearly/*"
    nat-anchor "natrules/*"
    # FTP proxy
    rdr-anchor "pftpx/*"
    nat on $wan from 10.62.0.0/24 port 500 to any port 500 -> (rl0) port 500
    nat on $wan from 10.62.0.0/24 to any -> (rl0)
    #SSH Lockout Table
    table <sshlockout>persist
    
    # spam table 
    table <whitelist>persist
    table <blacklist>persist
    table <spamd>persist
    table <spamd-white>persist file "/var/db/whitelist.txt"
    rdr pass on rl0 proto tcp from <blacklist>to port smtp -> 127.0.0.1 port spamd
    rdr pass on rl0 proto tcp from <spamd>to port smtp -> 127.0.0.1 port spamd
    rdr pass on rl0 proto tcp from ! <spamd-white>to port smtp -> 127.0.0.1 port spamd
    
    # Load balancing anchor - slbd updates
    rdr-anchor "slb"
    
    # FTP Proxy/helper
    
    block in all tag unshaped label "SHAPER: first match rule"
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 22  keep state tagged unshaped tag qOthersUpH 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 22 keep state tagged qOthersUpH tag qOthersDownH
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 22  keep state tagged unshaped tag qOthersDownH 
    pass out on $wan proto tcp from any to any port 22 keep state tagged qOthersDownH tag qOthersUpH
    pass in on  $wan proto icmp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
    pass out on $lan proto icmp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
    pass in on  $lan proto icmp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
    pass out on $wan proto icmp from any to any keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 53 keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 53 keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 161 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 161 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 119 keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 119 keep state tagged qlandef tag qwandef
    pass in on  $wan proto esp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
    pass out on $lan proto esp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
    pass in on  $lan proto esp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
    pass out on $wan proto esp from any to any keep state tagged qlandef tag qwandef
    pass in on  $wan proto udp from any to 10.62.0.0/24 port 500  keep state tagged unshaped tag qwandef 
    pass out on $lan proto udp from any to 10.62.0.0/24 port 500 keep state tagged qwandef tag qlandef
    pass in on  $lan proto udp from 10.62.0.0/24 to any port 500  keep state tagged unshaped tag qlandef 
    pass out on $wan proto udp from any to any port 500 keep state tagged qlandef tag qwandef
    pass in on  $wan proto ah from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
    pass out on $lan proto ah from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
    pass in on  $lan proto ah from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
    pass out on $wan proto ah from any to any keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 1723  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 1723 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 1723  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 1723 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 445  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 445 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 445  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 445 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 137:139  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 137:139 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 137:139  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 137:139 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3389  keep state tagged unshaped tag qRdpUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 3389 keep state tagged qRdpUp tag qRdpDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3389  keep state tagged unshaped tag qRdpDown 
    pass out on $wan proto tcp from any to any port 3389 keep state tagged qRdpDown tag qRdpUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 6667:6670  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 6667:6670 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 6667:6670  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 6667:6670 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 80  keep state tagged unshaped tag qwebUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 80 keep state tagged qwebUp tag qwebDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 80  keep state tagged unshaped tag qwebDown 
    pass out on $wan proto tcp from any to any port 80 keep state tagged qwebDown tag qwebUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 443  keep state tagged unshaped tag qwebUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 443 keep state tagged qwebUp tag qwebDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 443  keep state tagged unshaped tag qwebDown 
    pass out on $wan proto tcp from any to any port 443 keep state tagged qwebDown tag qwebUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3125:3129  keep state tagged unshaped tag qwebUp 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 3125:3129 keep state tagged qwebUp tag qwebDown
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3125:3129  keep state tagged unshaped tag qwebDown 
    pass out on $wan proto tcp from any to any port 3125:3129 keep state tagged qwebDown tag qwebUp
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 143  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 143 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 143  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 143 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 110  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 110 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 110  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 110 keep state tagged qlandef tag qwandef
    pass in on  $wan proto tcp from any to 10.62.0.0/24 port 25  keep state tagged unshaped tag qwandef 
    pass out on $lan proto tcp from any to 10.62.0.0/24 port 25 keep state tagged qwandef tag qlandef
    pass in on  $lan proto tcp from 10.62.0.0/24 to any port 25  keep state tagged unshaped tag qlandef 
    pass out on $wan proto tcp from any to any port 25 keep state tagged qlandef tag qwandef
    
    anchor "ftpsesame/*" 
    anchor "firewallrules"
    
    # loopback
    anchor "loopback"
    pass in quick on $loopback all label "pass loopback"
    pass out quick on $loopback all label "pass loopback"
    
    # package manager early specific hook
    anchor "packageearly"
    
    # carp
    anchor "carp"
    # enable ftp-proxy
    
    anchor "ftpproxy"
    anchor "pftpx/*"
    pass in quick on xl0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost"
    pass in quick on xl0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost"
    pass in quick on rl0 inet proto tcp from port 20 to (rl0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection"
    
    # allow access to DHCP server on LAN
    anchor "dhcpserverlan"
    pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
    pass in quick on $lan proto udp from any port = 68 to 10.62.0.3 port = 67 label "allow access to DHCP server on LAN"
    pass out quick on $lan proto udp from 10.62.0.3 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
    
    pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan"
    
    # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
    antispoof for xl0
    # Support for allow limiting of TCP connections by establishment rate
    anchor "limitingesr"
    table <virusprot>block in quick from <virusprot>to any label "virusprot overload table"
    # pass traffic from firewall -> out
    anchor "firewallout"
    pass out quick on rl0 all keep state tagged qwandef queue (qwandef, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state tagged qRdpUp queue (qRdpUp, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state tagged qOthersUpH queue (qOthersUpH, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state tagged qwebUp queue (qwebUp, qwanacks) label "let out anything from firewall host itself"
    pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qlandef queue (qlandef, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qRdpDown queue (qRdpDown, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qOthersDownH queue (qOthersDownH, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state tagged qwebDown queue (qwebDown, qlanacks) label "let out anything from firewall host itself"
    pass out quick on xl0 all keep state queue (qlandef, qlanacks) label "let out anything from firewall host itself"
    pass out quick on bridge0 all keep state label "let out anything from firewall host itself"
    
    # make sure the user cannot lock himself out of the webGUI or SSH
    anchor "anti-lockout"
    pass in quick from 10.62.0.0/24 to 10.62.0.3 keep state label "anti-lockout web rule"
    
    # SSH lockout
    block in log proto tcp from <sshlockout>to any port 22 label "sshlockout"
    
    # User-defined rules follow
    # Anchors for rules that might be matched by queues
    anchor qwanRoot tagged qwanRoot
    anchor qlanRoot tagged qlanRoot
    anchor qwandef tagged qwandef
    anchor qlandef tagged qlandef
    anchor qwanacks tagged qwanacks
    anchor qlanacks tagged qlanacks
    anchor qRdpUp tagged qRdpUp
    anchor qRdpDown tagged qRdpDown
    anchor qOthersUpH tagged qOthersUpH
    anchor qOthersDownH tagged qOthersDownH
    anchor qOthersUpL tagged qOthersUpL
    anchor qOthersDownL tagged qOthersDownL
    anchor qwebUp tagged qwebUp
    anchor qwebDown tagged qwebDown
    pass in log quick on $wan from any to any keep state  queue (qwandef, qwanacks)  label "USER_RULE: Default Wan -> any" 
    pass in log quick on $lan from any to any keep state  queue (qlandef, qlanacks)  label "USER_RULE: Default LAN -> any" 
    pass quick proto carp keep state
    pass quick proto pfsync
    # VPN Rules
    
    #---------------------------------------------------------------------------
    # default rules (just to be sure)
    #---------------------------------------------------------------------------
    block in log quick all label "Default block all just to be sure."
    block out log quick all label "Default block all just to be sure."</sshlockout></virusprot></virusprot></spamd-white></spamd></blacklist></spamd-white></spamd></blacklist></whitelist></sshlockout> 
    


  • hey-

    same issue here. I want to see if a cvs_sync fixes it, but I'm on a soekris and / is mounted read-only… and of course i can't edit /etc/fstab because, well, / is mounted read-only. what's the trick for cvs_sync'ing on a WRAP box?

    thanks,
    darren



  • @darrendavid:

    hey-

    same issue here. I want to see if a cvs_sync fixes it, but I'm on a soekris and / is mounted read-only… and of course i can't edit /etc/fstab because, well, / is mounted read-only. what's the trick for cvs_sync'ing on a WRAP box?

    thanks,
    darren

    There is no trick.  This does not work with Embedded platforms.



  • i /knew/ you were going to say that.  ;)

    can you point me to the docs for building my own from cvs, if there are any?

    thanks for all the work on this. it's looking grand.

    cheers,
    darren



  • in other forums say thet ALTQ must be configured to 2 interface (because them work only with out traffic).
    allike problem when one with interfaces not correctly set
    in my rules this correct?

    ps pls don't kill me - i only newbe (2 mth with nix system)  ;)

    ps2 after update from cvs queue status graph work very stable (1.5 hr wisout stops)



  • hrm, I don't get it.. this really should be working. There were no major changes to the shaper since Beta3 and the rules look fine from here. even after looking at them many time over. I'll wait to see if the fix works for anyone else..

    ??? 'scratch head'



  • Tomorrow reupdate Beta 3 and test this config again  :-
    May be broken update to Beta 4 ? But any errors not view.
    Goodnight  ;D

    –-----------------------------------
    Good day.
    I do it whith Beta 3, but nothing news. Them i update Beta 4 and rebuild my bridge config new. If a take update from cvs - them continuing testing with Beta4.


    Good day 2
    Yesss !!! BRIDGE!!!
    If i setup in LAN any dummy address - not WAN - my shaping get circus (bear's show)
    I set LAN IP = WAN IP and mask LAN IP = 32 (what recomended Hoba in Firewall topic)
    And my queue blinking all!!
    I must begin full testing.
    Write any result after this.
    Bye



  • Trafficshaper won't work in a bridge configuration. This is a limitation.



  • This is interested post about ALTQ & bridge (only this about openBSD).
    http://www.csl.sony.co.jp/~kjc/altq-ml-2002/msg00551.html

    Theme "ALTQ and bridge" - dont have wide information in Inet. I looking very mach questions, but little answers  :'(
    Can this url help for you project?



  • Hoba,

    So If my router has a WAN/LAN and WLAN, and the WLAN is bridged to LAN, the traficc shaping dosn't work anymore, correct ?

    Is there anything the pfsense team can do to make Trafic Shaping work on multiple NIC that are bridged with LAN?



  • That's something to do for 1.1 though there is no fixed featureset for 1.1 yet. If it's doable it will be implemented sooner or later.

    However if you are shaping WAN/LAN and your OPT1 is bridged to LAN there are chances that the shaping actually works. I think I heared someone report this scenario is working earlier, but not too sure about it. Try and let us know.



  • Can i have comment from professional to my questions?
    :)
    Bridge0 - logical interface .. but them can use for all rules in PF, yes?
    Can bridge0 use in ALTQ rules?
    May be this take effect for shaping (of cose if this possible)



  • I suspect that the queue is working,
    The problem is the rules.

    In rules, you define "In Interface" and "Out Inferface", and what we miss here is the term for ANY
    This is tipical picture of configuration, if we only could choose
    In Interface = WAN
    Out Interface = ANY

    Then I think the problem would be solved.





  • Thx.
    I today testing bridge queue rule with
    source * destination* - define only protocol and port.
    in simple model i give worked result. If time give possible - tomorrow be testing more big model.



  • @nima.m:

    I suspect that the queue is working,
    The problem is the rules.

    In rules, you define "In Interface" and "Out Inferface", and what we miss here is the term for ANY
    This is tipical picture of configuration, if we only could choose
    In Interface = WAN
    Out Interface = ANY

    Then I think the problem would be solved.

    Sorta…too bad it's not quite that simple ;)

    --Bill



  • Billm,

    Dose pfsense and m0n0wall use the same Traffic Shaping Engine ?


Log in to reply