Per IP traffic shaping–share bandwith evenly between IP addresses??
-
If it really helps.. then why isnt it transparently buildin already? There are lots of routers out there handling lots of clients perfectly fine without it.. including pfSense.. but if it is indeed better and fairer.. then why not enable it on all traffic by default? Cake == Codel? Sounds interesting. And yes, that checkbox 'share bandwidth evenly between all clients' is still missing ;) IF it really adds something!
Why is it not enabled by default? Partly because the definition of "better" & "fairer" are subjective.
Regarding whether it really works… This thread is popular for a reason. :)
-
If it really helps.. then why isnt it transparently buildin already? There are lots of routers out there handling lots of clients perfectly fine without it.. including pfSense.. but if it is indeed better and fairer.. then why not enable it on all traffic by default? Cake == Codel? Sounds interesting. And yes, that checkbox 'share bandwidth evenly between all clients' is still missing ;) IF it really adds something!
PFSense seems to try to balance "here's a check box that does black magic" and "I want to know exactly what the firewall is doing", especially since PFSense's primary users are enterprise users who know what they're doing. The more you "transparently" do by default or black-magic check boxes you create, the less control the user has.
-
Pfsense has equivalent functionality with limiters.
http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter
Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.
I have implemented exactly what your talking about by using two parent limiters (up and down) and creating three child queues under each (the child queues are for each of my three lan subnets. The upload child queues have a 'source address' mask set and the download queues have the 'destination address' mask set.) I set the default pass rules for said subnets to use their appropriate child queues.
I do not know if the limiters will behave in the desired fashion if you are assigning traffic directly to a parent limiter, even with the mask set. At the very least, a single child queue, used in the way I am, would work.
I have used your documentation to set up the limiters on my WAN and LAN interfaces. I am using the traffic graph to monitor activity, but how do I know that it is working? (Other than the obvious fact that all my clients can use the internet simultaneously.)
Thanks for your tutorial!
-
foxale08, can you please tell me if I am on the right path here? I have a LAN, OPT1 and OPT2. LAN has rules set up as used in foxale08's tutorial. OPT2 is my public network where I don't trust the devices and I want to limit them to like 1/5 of my bandwidth. You can see my screenshots below. The limiter seems to be working fine on the LAN, and I tried to mimic the tutorial for OPT2 to see if I could do it there as well. Am I on the right track?
Thanks guys!
-
No idea what you're trying to do with those rules. First you pass OPT1 net to !LAN net then you pass any any.
Nothing will be blocked and only traffic to LAN net will be limited because everything else will be passed by the first rule that doesn't have any queues set.
-
No idea what you're trying to do with those rules. First you pass OPT1 net to !LAN net then you pass any any.
Nothing will be blocked and only traffic to LAN net will be limited because everything else will be passed by the first rule that doesn't have any queues set.
Thank you for that Derelict. What I am trying to do is to prevent any devices on OPT1 from accessing any devices on the LAN interface (my private network). Should I set a limiter on both rules?
-
If you want to BLOCK traffic then BLOCK it.
On OPT1:
Reject IPv4 source OPT1 Net dest LAN net protocol any
Then you probably also want to:
Reject IPv4 source OPT1 Net dest This Firewall protocol any.Above those you want to pass any local assets you want OPT1 Net to access like DNS.
And, as an aside, none of this has anything to do with limiters or this thread.
-
If you want to BLOCK traffic then BLOCK it.
On OPT1:
Reject IPv4 source OPT1 Net dest LAN net protocol any
Then you probably also want to:
Reject IPv4 source OPT1 Net dest This Firewall protocol any.Above those you want to pass any local assets you want OPT1 Net to access like DNS.
And, as an aside, none of this has anything to do with limiters or this thread.
I appreciate your input. I don't know why I didn't put in a reject rule in there from OPT1 to LAN. I had tested it out anyway from OPT1 trying to access the LAN network and I could not get through, which I thought was due to that first rule.
This is only coming up because I don't know how to set up the limiters with multiple LAN networks (basically taking foxale08's original technique to another level.) If anyone has a tutorial on that kind of setup, I would be grateful for a link. I could just be incredibly blind, but I did read through this entire thread and didn't find it here.
-
Make a different queue with the characteristics you want and put the limiters on the pass rule on that interface. There's nothing magic about it.
-
Make a different queue with the characteristics you want and put the limiters on the pass rule on that interface. There's nothing magic about it.
I think I got it now. Thanks for your help Derelict.
-
Hi there, the limiters work, but they always work (also for one client). Its the same as daq wrote in aug 2014, but he did not get an answer to get it working correctly, so I hope that still is possible.
If I set the limiters to 6 Mbps then total available bandwidth (120 Mbps) goes down to 6 Mbps. When I start a second download/speedtest they both go evenly to 3 Mbps.
-
I probably misunderstood the original post, when I input the full bandwidth (120 Mbps) in the limiter it works as expected. I tested it 4 times: 1 user 120, 2 users 60 each, 3 users 40 each and 4 users 30 each. Perfectly evenly divided, great. Thanks for this post!
-
Huh?
How do you want it to work? That's the exact behavior expected.
If you want the first host to get 120Mbps then that's what you set the limiter to. Then you create a child limiter that masks on each source/dest IP address under that. Then you'd get something like:
120
60/60
40/40/40
30/30/30/30
24/24/24/24/24
20/20/20/20/20/20etc
-
Hi guys. Help me out here too.
-
Let's say I have 10Mbit/s speed Internet.
-
I want a specific IP address to have 8Mbit/s GUARANTEED SPEED for all time and full 10Mbit/s speed when there is no one using the Internet.
-
If that specific IP is not in use, the rest may hit 10Mbit/s speed but 8Mbit/s speed must always be there for the specific IP.
appreciate for any reply..
thanks -
-
HFSC - But that's not the subject of this thread.
-
HFSC - But that's not the subject of this thread.
Sorry for my ignorance. ::)
Can you at least guide me to configure HFSC to solve my problem. ;D
-
There are countless threads about it.
-
my first post on the forum :)
i wanted to say that the guide offered by foxale08 back in 2013 works great on version:
2.2.6-RELEASE (amd64)
built on Mon Dec 21 14:50:08 CST 2015
FreeBSD 10.1-RELEASE-p25https://forum.pfsense.org/index.php?topic=63531.msg364520#msg364520
i run a 1 wan 1 lan port setup. all traffic over the lan port is forced over a vpn connection.
as a practical test i maxed out my 25/5 Mb/s bandwidth with a long download. i tried a long hd youtube video and it stuttered and wouldn't play. as expected.
i then applied the guide as instructed (deviating only when i had to put in my upload and download speeds which i chose to put in Mb/s and no Kb/s).
i re-started the long download to max the bandwidth. i tried the long hd youtube video and low and behold the speed reduced on the download and the youtube video worked perfectly. to stress test it i started a similar video on 4 more clients and it had the same great effect. pushed it further and started another high speed download and it seemed to keep working. neither hd video stopped buffering and each download ran with roughly even download speed.
excellent solution. thank you.
-
Thank you everyone for this!
Just curious what would happen/is there a benefit to apply the in/out pipe that you specify for the lan firewall rule on your VPN? If yes then is it the same orientation for OpenVPN/Ipsec? (incoming pipe is going out and out pipe is incoming). -
@crisdavid:
Thank you everyone for this!
Just curious what would happen/is there a benefit to apply the in/out pipe that you specify for the lan firewall rule on your VPN? If yes then is it the same orientation for OpenVPN/Ipsec? (incoming pipe is going out and out pipe is incoming).I am wondering about this myself. My situation is that I have my pfsense box using one of the initial suggestions here on two different interfaces and they seem to work well. I would love to dedicate a set amount to any IPsec traffic because I have noticed it slowing down a lot since I put these limiters in place. I will do some testing today and get back to you.
Edit: So, I don't know why I thought it was like this, but the IPsec tunnel is not in the interfaces section so I can't assign a limiter to it. Does anyone know a way to do this?
