Bandwidth Limiter does not work when Specific Gateway defined under DHCP



  • Hello,
    I am trying to Limit the bandwidth for users on OPT1 interface.

    I have attached screenshots of the settings.

    1. Created limits under Firewall / Traffic Shaper / Limiters
    2. Created Rule for OPT1 under Firewall / Rules / OPT1 and Selected Limiter under In / Out Pipe.
    3. I have Enabled DHCP for OPT1, and have defined specific Gateway IP available on the network for the clients, so traffic goes from that router.

    Issue is: If I remove Specific gateway from DHCP then Bandwidth limiter works well. But as soon as I ask DHCP to use another non-PFsense gateway, then it limiter does not work.

    Let me know where I am going wrong.

    Thanks

    Limiter.jpg Rule.jpg DHCP.jpg Ban


  • Netgate Administrator

    So what is 10.5.20.2?

    If that isn't pfSense how does traffic from OPT1 clients ever hit that firewall rule?

    The other router forwards it to pfSense? That would be asymmetric unless it's NATing.

    If it just goes out to the internet via some other router then it never goes through pfSense. It cannot be limited in pfSense.

    Steve



  • I thought since DHCP Client gets IP from PFSense and so does gateway to PFSense (10.5.20.1 is PFSense IP on OPT1). So I thought Client goes to 10.5.20.1 PFSense and then PFSense transfer to 10.5.20.2 (Another router on network).

    I thought PFSense forwards traffic to other router on OPT2 LAN subnet.
    So I guess, I am wrong there.


  • Netgate Administrator

    Indeed that's not what happens. pfSense passes that gateway to the client via DHCP and then that client uses it directly. Traffic does not pass through pfSense unless that other router is sending it.

    What is that other router? Why are you sending traffic to it?

    You may be able to change how that is connected do traffic can be limited. By connecting that router on a separate pfSense interface for example.

    Steve



  • That other router is UTM and we do not have much access/control to it.
    Since I cannot set anything for bandwidth control on that UTM Router, i thought lets transfer traffic thru PFSense.

    If I set client gateway to PFSense, is it possible PFSense can forward those internet access traffic to UTM router?
    Is it possible thru Rules?


  • Netgate Administrator

    Yes, but it would be better to have it in a separate subnet.

    Does pfSense have a separate internet connection that is not through the UTM device?



  • Yes, PFSense has separate external IP, and UTM has separate External IP.
    Means, If UTM is down, PFSense does not have any issue. It has it's own Internet IP.

    i.e
    PFSense External IP: 202.xxx.xxx.180
    UTM External IP: 202.xxx.xxx.181


  • Netgate Administrator

    Ok, so what do you actually need to happen here? Traffic must go via the UTM? Unless it goes down?

    Do you really have no access to the UTM?



  • No, I don't have full access to UTM, and even if I had it does not facilitate bandwidth control and some other features which only PFSense has.
    So I prefer PFSense but for Internet for OPT1 subnet clients should go via UTM

    What I want:

    PFSense OPT1: Clients shall get internet access from UTM on same internal subnet (10.5.20.x)
    PFSense LAN1: Clients shall get internet from PFSense it self (working well) (192.168.2.x)


  • LAYER 8 Global Moderator

    Well the only way to route your traffic through pfsense and use utm for internet.. Would be to connect that UTM via a transit network on pfsense.

    Then route it through, then you could do bandwidth limits..



  • Can you pls guide me how to set transit network in PFSense ?
    I have never done it.

    Pls guide.


  • LAYER 8 Global Moderator

    Its just another network that connects to the UTM that there are no hosts on.. It not different than any other network..

    transit.png

    I take it you can not edit that 10.5.20 network on the UTM, or add another network on the UTM for your transit.. So use it as the transit

    And move your devices currently on your opt1 interface to another network.

    And that utm is prob not going to nat some other network? So just do natting to this network via pfsense. So utm sees all traffic as coming from pfsense IP in the 10.5.20 network.



  • Is there any tutorial for Creating Transit Network on PFSense, I have never done it.
    Conceptually I i understood your method but do not know how to program it in PFSense.

    I am beginner when it comes to rules and transit network.


  • LAYER 8 Global Moderator

    Did you create the network on opt1? Its no different..

    Do you have another interface to use on pfsense, will you be using vlans via a switch?



  • @johnpoz said in Bandwidth Limiter does not work when Specific Gateway defined under DHCP:

    Do you have another interface to use on pfsense, will you be using vlans via a switch?

    I don't have extra interface. I guess I have to create VLAN interface in that case, correct?

    Lets say OPT2 with (192.168.0) and then create rule same as OPT1? Pass any source any destination any protocol?

    So, IP of 3 interface would be
    LAN1: 192.168.1.1/24
    OPT1: 10.5.20.1/24
    OPT2: 192.168.0.1/24

    setup OPT2 DHCP and clients get IP with 192.168.0.1 gateway.

    Then any rule or NAT to transfer OPT2 traffic to OPT1 UTM?



  • @johnpoz
    Can you pls guide for above?
    Thanks


  • Netgate Administrator

    Yes. You will need to policy route that traffic to the UTM gateway though as well.

    You could also use a failover gateway group so it client still have access if the UTM fails if needed:
    https://docs.netgate.com/pfsense/en/latest/book/multiwan/policy-routing-configuration.html

    Steve


  • LAYER 8 Global Moderator

    @sanketgroup said in Bandwidth Limiter does not work when Specific Gateway defined under DHCP:

    Then any rule or NAT to transfer OPT2 traffic to OPT1 UTM?

    Policy route would be needed to send them out the utm, whoever you want to go there be it lan or opt1 network.

    As to outbound natting the traffic - would depend if utm is going to nat them out to the internet, do you have access to utm to setup the return route. If not then yeah you would have to nat.


  • Netgate Administrator

    Yup it would be much nicer to NAT in the UTM so that it can see the internal client IPs and filter/log accordingly. But to do that you would need to add a static route to the UTM and if you have no access that's not an option.

    Steve



  • I tried to create rule as shown in screenshot below.
    But still DHCP clients on OPT1 are getting internet from PFSense instead of UTM.

    DHCP Clients and UTM are on subnet.

    PFSense DHCP Clients: 10.5.20.50-100
    UTM: 10.5.20.2 (And it does NAT)

    i.e if I manual type in gateway as 10.5.20.2 (UTM IP) clients get Internet from UTM.
    But PFSense DHCP clients get internet from PFSense even after rules shown in Scerenshot.

    I might be wrong with rules. Pls guide.

    Thanks
    2020-09-08_20-09-33.jpg


  • LAYER 8 Global Moderator

    That is not a policy route.. So no that wouldn't work!

    And you have opt network on the same network as UTM? Already went over that would be asymmetrical.

    Change your clients to a different network than this 10.5.20 network.. Use that 10.5.20 as your transit and policy route with a outbound nat.

    Even if your UTM some other network, how would it know how to route back via pfsense to get to this other network.



  • Thanks for bearing with me and guiding me without any displeasure

    Correct, my mistake for not setting up separate interface for DHCP.
    Cannot create VLAN as PFSense is on VMWare workstation and On-board LAN card does not support Intel Teaming (Virtual adapter)
    So I will have to arrange extra LAN port.

    If i am able to manage setting up return route on UTM then setup would be like this:

    OPT1: 192.168.0.1 (DHCP: 192.168.0.50-100)
    OPT2: 10.5.20.1

    Create Rule on OPT1:
    Action = Pass /// Interface = OPT1 /// Source = OPT1 net /// ℹ question: Destination = shall it be Single Host (UTM 10.5.20.2) or OPT2 net

    =============
    If I am not able to create return path on UTM then create NAT in PFSense as follow:

    Make OPT2 as WAN2 Port and create NAT between OPT1 and WAN2/OPT2


  • LAYER 8 Global Moderator

    @sanketgroup said in Bandwidth Limiter does not work when Specific Gateway defined under DHCP:

    Action = Pass /// Interface = OPT1 /// Source = OPT1 net /// question: Destination = shall it be Single Host (UTM 10.5.20.2) or OPT2 net

    That is not a policy route.. You have to select gateway in the rule if you want to route. 10.5.20.2 would be setup as a gateway in pfsense. Did you read the link provided?

    You would then be able to create an outbound nat for it.. Hybrid is all that is needed.

    As to your whatever your workstation does for cards and teaming - that has zero to do with vm passing tags or not passing tags for a vlan.. But sure if you want to create another vm nic and do it that way that works too.. How you do vlans and do your connections have little to do with the logistics of the network. Pfsense doesn't care if its a vlan or a native interface.. How you tie that to the physical world is up to you.


Log in to reply