pfSense and IPSEC lan to lan: a big doubt about the correct implementation

stephenw10

Just a hard limit to allow other traffic outside the tunnel?

mauro.tridici

Mmmh, just a way to limit the traffic through the tunnel.
Now, the IPSEC tunnel has a very good throughput and I already know that users will saturate this channel with their data transfer sessions from LAN at site A to LAN at site B.

stephenw10

Then I would use a Limiter outbound on the IPSec interface at either end.

https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html

You could also apply that inbound on the source interface if that's known at both ends. Either way it's better to limit at the sending end than receiving.

Steve