Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Best strategy for limiting in public library setting

    Traffic Shaping
    2
    2
    1076
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      librarymark last edited by

      Folks -

      What would be the best strategy limiter/rules-wise to limit the bandwidth of each public machine in the library I work at? We are using 2.0.1-RELEASE, and I am able to limit people one at a time - currently I have one alias call the "slammer" and I can put a given IP in that spot and slow down that one seat (the guy that sits there likes to open 10 youtubes at a time!), but what I would like to is limit all 78 of my public machines. Is there a way to create a blanket alias of all the machine IP's and limit each one by a certain bandwidth, but not the entire group? We have a 50Mbs pipe and I would like to give each patron no more than 1mb or so at a time. Do I have to set up a rule for each seat?

      1 Reply Last reply Reply Quote 0
      • J
        Javik last edited by

        My recent post covers the basics of this:
        Works! Limiting multiple LAN users, thru single external proxy
        http://forum.pfsense.org/index.php/topic,60861.0.html

        In general, to create different speed groups, you need to do some coordination of your network addresses, and you can't just use automatic address assignment by DHCP for the entire building LAN.

        You'll probably want to inventory all the MAC addresses of the public machines so that they can be assigned addresses within the same common block, via DHCP MAC reservations . (You can also manually assign addresses directly to each machine without DHCP reservations, though this can be a maintenance hassle if the machines are wiped and reimaged occasionally.)

        The collective address range is then restricted by the limiter. Anything outside the range would be permitted full speed.

        A more thorough option is to group all the wired public machines into a single network switch or a VLAN, and then applying a subnet and automatic DHCP to that entire group through an optional interface on your pfSense router.

        This requires lots of fiddly crawling around under tables, locating of ports on walls and who is what port number, and then moving cables around in closets to put all the wires into a common group on a single switch or to make a VLAN range of ports.

        (You can also create a freeform VLAN for scattered ports across the switch without moving cables on the switches, but this is more management hassle later if there's a problem, IMO.)

        This would allow the computers to all be limited without needing to do DHCP reservations, and also allows for an open public wifi service for patron laptops and mobile devices to join the subnet and be limited also.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post

        Products

        • Platform Overview
        • TNSR
        • pfSense Plus
        • Appliances

        Services

        • Training
        • Professional Services

        Support

        • Subscription Plans
        • Contact Support
        • Product Lifecycle
        • Documentation

        News

        • Media Coverage
        • Press
        • Events

        Resources

        • Blog
        • FAQ
        • Find a Partner
        • Resource Library
        • Security Information

        Company

        • About Us
        • Careers
        • Partners
        • Contact Us
        • Legal
        Our Mission

        We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

        Subscribe to our Newsletter

        Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

        © 2021 Rubicon Communications, LLC | Privacy Policy