Quick question about limiters

  • Hi all!

    I use todays snapshot of pfsense.
    I have set up limiters on WAN iface which is PPPoE.
    When I do that all traffic stops. All outbound from LAN to internet is stopped.

    If I apply same floating rule to LAN, everything works. But I need to apply limiter on WAN directly.

    If I use limiter on LAN there is a traffic difference, see attached image.
    On LAN traffic is properly limited to 80 Mbits but on WAN traffic goes up till 89 or 91 Mbits which is not OK.

    Any ideas why this is happening?


  • Created a redmine ticket for this.
    I believe it`s a regression: https://redmine.pfsense.org/issues/9643

  • Yes, limiters are semi-broken on 2.5.0 when on Hyper-v at least. Didn`t test on real hardware.

    Also traffic shaper errors are back on 2.5.0, hn0 does not support ALTQ.
    So this one is back and needs to be corrected again: https://redmine.pfsense.org/issues/8954#change-41006

    I also think that those 2 problems are related.

    But I still wish to know, why if I limit to 80Mbit/s traffic on wan slowly rises to 90Mbit/s but on LAN it stays on 80Mbit/s. Overhead? This happens only with torrents, HTTP download does not cause WAN to slowly rise....

    Thanks all!

  • https://forum.netgate.com/post/832477
    See if setting it up that way helps at all.

  • I want to have it set on WAN only... Now I have it on LANs and limiters are working OK. But I rather see limiter on WAN.

    The other thing that is bothering me is, why on LAN there is 80Mbit/s and on WAN after 3-5 minutes is 87 Mbit/s... It slowly rises from limited 80 to 90 Mbit/s.

    @jimp any idea why is that? pppoe maybe?

  • Can someone test if it behaves the same for you?

  • Steps to reproduce?

  • For limiters to sto traffic just set them up and apply floating rule on wan.

    For traffic difference start torrent client and wait up to 5 minutes and observe if wan goes above defined limit.

  • @maverick_slo
    Please provide more details for floating rule, applying on WAN, maybe screenshot is better?

  • OK, so like this:

    Action: match
    Quick: DO NOT tick
    Direction: OUT
    Protocol: ANY
    Then in advanced:
    Gateway: select your gateway
    In / Out pipe: WAN_UP_Q / WAN_DOWN_Q (those are queues in limiters)

    And thats about it.
    If traffic stops you have the same probelm as I do if not you`re on 2.4.4 :)

  • @maverick_slo
    Yes I can confirm. Traffic stops immediately. (2.5.0-DEVELOPMENT (amd64)
    built on Mon Jul 29 17:15:22 EDT 2019 )
    For the second one, I can tell that I have problems with limiters since 2.4.4 released, it's working but not as expected by me. I did not reported it, because I think my ISP changed something in the same time, I do not have bufferbloat anymore without limiters and I got it when enabled it once again.
    Anyway I can test speed difference later this week.

  • Ok cool, thanks. I did report it and when I use them on lan, direction in they work ok, but there is traffic difference. Maybe its expected but it only happens with torrents so far.

  • Ok, I used floating rule for LAN, direction in. What I see immediatelly is that internet slows down and I have C rating on dslreports.com for bufferbloat.
    Tested with 5 porn torrents, after 20 minutes it's went over 150mbit. The limiter is set to 100.

  • Yeah thats bad :(
    But at least porn torrents will be DL-ed faster :)

  • This is really annoying.

    Why WAN differs so much comparing to LAN?
    This is after 2 minutes of torrenting. Limited to 75 Mbit/s.


    And this one after 6 minutes.

    LAN stays at 75Mbit/s and WAN goes up to 85 Mbit/s.


  • I have physical interface ix0 where I have ISP LAN ("ISP_LAN") DHCP 172.x.x.x assigned and also PPPoE ( "WAN" external IP) over it. When I look at Status / Interfaces or Statistics on dashboard all looks recent, PPPoE (named WAN) have huge amount of traffic and ISP_LAN have none or a couple of kbytes. When I look at Status / Traffic Graph then both WAN and ISP_LAN are virtually same, but WAN shows IP addresses and ISP_LAN not.
    I don't know is it "by design" or there is something broken.

Log in to reply