Traffic shaper changes [90% completed, please send money to complete bounty]

[bogus]

Yes, quick is not selected.

My rules.debug should have arrived.

[bogus]

Just an update for all those interested before I get into the next issue.

Finally, we  managed to get the queues correctly utilized.
It looked like the all rules were correctly created but in /tmp/rules.debug Ermal found that no queues were assigned to the rules.

So I started (try and error) to get the queues assigned.
First I disabled all rules using the toggle button in front of each rule and applied the changed.
Then I started enabling the first rule using the toggle button and applied the changes..checking the rules.debug..same before.
But when I opened the same rule and changed the queue to some other…press save and apply... checking the rules.debug..jepp, queue assigned.
Ok, changing back to the correct queue and now the correct queue was assigned in rules.debug, gooood!
The rest of the rules I just opened and removed the disabled flag and applied one by one.

Now the traffic shaper is working with single WAN, lets get to the next level - load balancing.

I do not remember if it was mentioned in this thread before but I'm not sure how to get my traffic balanced over my three connection.
Yes, I have it working with 1.01, 1.2 betas and RCs but it seems to be different with the new shaper.
As soon I create the LB rule on the LAN tab I'm out (yes, anti lockout-rule disabled).

Well, after enabling the anti lockout-rules I'm back in and it seems to work.
Two parallel http downloads were using two different connections.
For me it looks like that with my current setup the anti lockout-rule is not an issue.
May be later when I try to catch all p2p which is the major reason for me do traffic shaping?

But why I got locked out?

This is how the new rule looks like in rules.debug:

pass  in  quick on $lan  route-to { ( vlan1 192.168.20.254 ) , ( vlan2 192.168.30.254 ) , ( vlan2 192.168.30.254 ) } round-robin  from 192.168.100.0/24 to  any keep state  label "USER_RULE"

Pass in quick! That was the first Ermal asked. But on the LAN tab it does not appear in the rule properties.
So I cannot enable/disable it.

Any idea?

Cheers

Btw.
Where are all the success stories?
I believe it would help a lot if more people could post a brief description how they did and what pitfalls they run into! And even more important, how to get around or avoid!
Not only that others would benefit but also free-up Ermals back.

[eri--]

So now it is working?!

Anyway you get locked out since the route-to rule catchs up your request and gets sent out of the firewall and not to the server running on the pfSense machine. So it seem that you need to keep that anti-lockout rule.

[bogus]

Yes, it is working now.
Thank you very much for your support.

Now I have to re-read about what you said about load-balancing, squid and traffic shaper.

Cheers

[falcon]

I have a simple question how does this differ to the normal traffic shapper ?

which one would suite me better.

we host websites on port 80 and 443 , i want to set the http/mail/ssh to be priority traffic in and out, mostly out for one netwrok and low proiroty traffic for another network no matter what it is

[lambert]

Just out of curiosity, how much was the total bounty, and how much of the bounty is still outstanding?

I'm just looking for a dollar amount, not a list of shame.

[k3rmit]

Ciao everybody,

had a chance to install the latest iso (the firmware update wasn't updating at all) and everything is working nicer now, with floating rules created automatically by the wizard according to definitions.

Still, i'd like to report a couple of bugs:

1. multi lan single wan wizard at the last passage is like


and then


2. the rules creation after the wizard reports the following errors:

php: : There were error(s) loading the rules: pfctl: should have one default queue on em0 pfctl: should have one default queue on bfe0 pfctl: should have one default queue on rl0 pfctl: errors in altq config - The line in question reads [ should have one default queue on em0 pfctl]:
php: : New alert found: There were error(s) loading the rules: pfctl: should have one default queue on em0 pfctl: should have one default queue on bfe0 pfctl: should have one default queue on rl0 pfctl: errors in altq config The line in question reads [ should have one default queue on em0 pfctl]:

didn't have the chance to test rules effectiveness, will let you know as soon as i have the occasion (=continuous non interrupted time :-)

cheers

albe


[k3rmit]

Hi again,

i'm testing the shaper now and must say that besides minor glitches it is working quite fine.

First, the above reported bug is one in the wizard, because i didn't fill the p2p shaping percentage text filed, it didn't check that while clicking Next, went on and BAM, error in the end: i specified that now, so it is creating queues and floating rules correctly.

I'd like to ask something though:

1. I can't reproduce the exact procedure to get there, but somehow, while creating additional queues and assigning them to additional floating rules, it lost all floating rules.
2. The order of rules application on traffic seems to be interface rules and then floating rules: in a case such as mine, one has lots of rules created for each interface, considering floating rules didn't exists for pfsense in the past and it was the only way to regulate traffic, therefore those rules will all use the qDefault queue and will override all those nice floating rules created by the wizard, making them useless, unless you assign to each and every interface rule the corresponding queue. Can the rules application order be reversed?
3. i assigned 4130Kb to the WAN interface, 1Mb to the VOIP queue, and the results of the wizard queue creation are:
        qAck: 19.846% band, ls m1 0b, ls d 500, ls m2 19.846%
        qDefault: 9.923% band
        qVoIP: 32Kb, rt m1 0b, rt d 10, rt m2 1Mb
        qOthersHigh: 9.923% band, ls m1 0b, ls d 200, ls m2 9.923%
        qOthersLow: 4.9615% band, ls 4.9615%, ls d 200, ls m2 4.9615%

same thing for all siblings on other interfaces. Question is: the total amount of bandwidth from these rules doesn't match the one assigned to the WAN interface, why?

On the side note, i'd like to point out that the queue definition interface works well, but limits for values should be checked at entry or submission time, not at changes application, or you will get strange errors which are not always easy to debug. (i.e. bandwidth overallocation for subqueues).

Hope i explained myself well enough..

Thanks

albe

[k3rmit]

Correction at point 1: the f*#@ing pfsync was configured and the conf was overwritten from the first machine. sorry for that.

Correction at point 3: i did assign 1 Mb to VOIP in the wizard.

Finally: i'm struggling to make the catch all queue from LAN to DMZ and viceversa woro, to no avail. communications are always crawling… like 200bps... what's wrong? I double checked everything, i'm monitoring via pftop that the traffic is falling in the right queues, but nothing... even with 80Mb set in the queue and 100Mbit in the interface, the traffic is always crawling. Specifically i'm trying to copy a file from DMZ to LAN: all rules interestd in this have been assigned the right queues. I even created a dedicated ACK queue for such traffic, but it didn't change anything...

any clue?

thanks.

[eri--]

Can you please send me your rules.debug to ermal at pfsense.org just to check the order of the evaluation or it might be that the rules produced by the wizard are without the quick keyword and you can edit the floating rules to be terminating but that will mostly break the policy.
I am sorry there is no easy fix to such a thing since there is no easy way to update the existing policy to conform to the new shaper :(.

For the DMZ - LAN problem i would suggest trying living the queue policy in effect only for the internet connections ie on the Traffic shaper config delete the queue policy for LAN and DMZ and see if it suits you with shaping only on outbound. Usually it would suffice since the other part is throtled by the ISP and packets will be driven by the outgoing policy.

If you need a more specific answer please give me some more detailed specification even in private if you wish.

[dps]

Guys,

How can i have access to the image with the multi nic shapper?

Thank You!

Duarte Santos

[Perry]

If you donate xxx$ to it you'll get access.

Please read every reply in this topic before asking any additional questions.

[medien]

multi lan in 1 WAN is very interesting.i hope you can develop per ip bandwidth limiting.thats what everybodys newbie waiting i think.

[eri--]

Well expect surprises fro 1.3 or give it a thought/contribution for 1.2 :P.

[ccfiel]

Good Day to all!

Our small company needs a firewall with the following features. Does pfSense support the following requirements? We are willing to donate if it can fulfill the needs stated below.

1. Support Dual WAN
2. Traffic Shaper for Dual WAN ( distribute bandwidth equally for every workstation that uses the internet ) <–- i think this is the bounty?
3. Web Proxy
4. Samba

Hope somebody can give me some info. Thanks and more power!

Chris

[eri--]

The current implementation that is ported to 1.2 that the bounty covered offers this through CBQ and with intimate knowledge with HFSC.

Actually 1.3 would be the release which will really be my recommendation for this.

AFAIK you can sponsor it somemore to get the 1.3 improvements to 1.2.

Ermal

[tomdchi]

I just sent $100 to paypal@chrisbuechler.com.  I just started using pfsense last week and 1.3 would be a great help!

My paypal address used was billing@alumnipropertygroup.com

Thanks!
Tom

[tomdchi]

Just upgraded and WOW, this new shaper is AWESOME!!  Just what I needed!!

[sullrich]

@tomdchi:

Just upgraded and WOW, this new shaper is AWESOME!!  Just what I needed!!

Nice!!!

[ccfiel]

Hello I have donated $25 to paypal@chrisbuechler.com. Hope this little donation can bring more innovations! :) How can test this features? Thanks in advance and more power!

Chris