Per IP traffic shaping–share bandwith evenly between IP addresses??

Ashfaq

So its all good that total bandwidth is divided b/w the active users equally. now what if i want to go a step further and want to have a MINIMUM bandwidth for a specific IP or for a group-of-IPs-together and then divided the rest of the remaining bandwidth b/w the other active users: e.g:

total download is 4Mbps
total connected users 6
2 users are idle and the remaining 4 are downloading at full capacity so 4Mbps/4 users, each one gets 1Mbps
now the 2 idle also starts to download at full capacity so now 4Mbps/6 users, each one gets 682Kbps
now if i want 1 of the users to have minimum 1Mbps and the rest of the 5 gets equal share in remaining 3Mbps, so each of the 5 gets 614Kbps

is it possible ???

as far as i know limiters are used to upper bound, while queues are used for lower bound (min guaranteed), can we somehow use queues in combination with limiters to achieve that.

Update:
found this link https://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Using_Limiters_for_Bandwidth_Guarantees
but i dont think this serves the purpose and this will probably not allow to use the entire bandwidth that is available to the guaranteed device. i think the guaranteed limit will be the upper limit for the devices.

Thanks
Ashfaq

sideout

I just tested Foxale's setup and it worked for me.

I made a rule on the LAN side before the any any allow all rule that said:

IF Protocol = TCP , Source = LAN , Destination = NOT LAN then Upload_LAN for out and Download_LAN for in.

I had 2 steam clients downloading and both would be balancing out. The first one always seemed to get a bit more bandwidth but it would keep them decently even.

Going to test this out this weekend at a 125person LAN party.

orangetek

I have taken this a bit further and implemented QOS using just limiters while retaining the equal bandwidth sharing. Not 100% sure it works properly but seems to be. I have ACK, DNS, ICMP, HTTP/S, and OTHER in 3 priority groups, High,Mid,Low with weights set on each child limiter. I tested it by setting upload and download speeds on the parent limiters to 1/4 of my upload/download speed. I then proceeded to max both of them out while pinging an address on the internet. The pings remained steady like i wasn't even using any bandwidth. :)

jly2680

@orangetek:

I have taken this a bit further and implemented QOS using just limiters while retaining the equal bandwidth sharing. Not 100% sure it works properly but seems to be. I have ACK, DNS, ICMP, HTTP/S, and OTHER in 3 priority groups, High,Mid,Low with weights set on each child limiter. I tested it by setting upload and download speeds on the parent limiters to 1/4 of my upload/download speed. I then proceeded to max both of them out while pinging an address on the internet. The pings remained steady like i wasn't even using any bandwidth. :)

i want to try this on my pf box..would you mine if you can share your setting wiht us?TIA

sideout

So I used Fox's limiter config this weekend at my LAN party and it worked out great. I could see on the traffic graph where Pfsense was balancing out each connection bandwidth wise. It did seem that the first 3 or 4 would always get a little more but it worked out fine.

We had 125 people on 2 50MB cable modems. I set the limiter at 35Mbit for the first 4 hours of the event then dropped it down to 20Mbit during the main gaming hours then bumped up to 35Mbit again during the nite and back down to 20Mbit the next day.

We passed a little over 327GB of data this weekend , had no real issues and even kept the League of Legends players happy with sub 120MS ping times.

NexusLANRRD1.jpg_thumb

waldopulanco

Thanks! hope it will work to pfsense 2.1.2, I try it later. how about in squid proxy no limit for bandwidth?

Ashfaq

Hi,
On my test the limiter and queue method did not make any difference.
i configured one queue for each LAN and assigned the default rule in LAN with the limiter queues.
i had two devies 1 laptop on torrent download and 1 android phone on download, both on the same LAN.
the laptop got almost all the data, all the time !.
i could see both devices/IPs on the limiter info screen in the same configured queue. I am running pfSense ver 2.0.2.

what could i be doing wrong?

Regards
Ashfaq

sideout

One thing I did was create a new rule above the ANY / ANY rule on the LAN rule page for assigning this limiter. Basically this rule says:

Protocol - IPv4 / TCP
Source - LANLIMIT - I use an alias here that defines my DHCP pool that I assign out.
Ports - I set to any on both source and destination
Destination - NOT LAN Subnet - anything but other LAN clients
Gateway - FWGATEWAY - I have 2 WAN's that round robin load balance so I use that , you can leave at default.
IN/OUT - Upload_LAN / Download_LAN - these are the queues with destination address set under the traffic shaper.

Put this rule above the any / any rule.
I have a floating rule that sends HTTP / HTTPS traffic to my qACK / qHTTPSTEAM queue that I have defined in my shaper. I used quick match on this rule and all my shaper rules.

Here is how I have the limter set as well . See the pics below.

I did not test with a bittorrent client , I tested using Steam to download. I know it was working for me as during the LAN I could see IP's getting allocated bandwidth on the Traffic Graph for the LAN side and I went around to some of those PC's and was able to see them downloading on Steam and that it as matching what I was seeing on PFSense.

FWRULESLAN.jpg_thumb

FWRULELAN1.jpg_thumb

FWDLLIMIT.jpg_thumb
FWDLLIMIT2.jpg_thumb

Ashfaq

Thanks Sideout for the tips, I tried both ways using the default LAN rule and also the tip you gave me i.e. a new rule above the default LAN rule with the limiters applied. no change in results, however i noticed that if both clients are laptops on torrents (i.e. equal load) then it does some bandwidth balancing.

attached are the screenshots of my configuration, the graphs and the limiter info.

limiter.jpg_thumb

limiterqueue.jpg_thumb

limitersetup.jpg_thumb

rule.jpg_thumb

rulelist.jpg_thumb

trafficgraph.jpg_thumb

trafficgraph2.jpg_thumb

sideout

Did you try setting it to IPv4 and TCP for the protocol? Do you have any floating rules for http as well? Like I said I did not test with torrents so they might be doing something the limiter is not catching. Perhaps running a packet trace with wireshark on your PC while running it will help you out?

Ashfaq

Hi,
initially i did not but even after applying TCP in the rule the results are same.
to do a clean restart i removed all limiters and rules and then recreated a simple 1Mbps download limiter for a particular IP, make the rule, and run torrent, to my surprise the IP was getting the entire 4Mbps bandwidth and in limiter info screen i could see that the IP was correctly assigned to the 1Mbps limiter queue.

why possibly could pfSense is not applying the limits to that IP ??

sideout

Like I stated earlier , it could be the way the torrent software is downloading it. You might have to look at a layer7 or some other way to restrict it. You can check the forums here and see that people have posts inregards to restricting torrents.

All I can tell you is that fox' setup worked for me in my application of strictly TCP stream downloads and with my other traffic shaping that I had setup. YMMV.

Ashfaq

Thanks sideout for all the help,
its working now, i upgraded to the latest pfsense version and exactly the same limiters and rules are working as expected with the 2.1.3 version. previously i had 2.0.2 version.

Thanks again
Regards
Ashfaq

sideout

Awesome!!

Ashfaq

This is just to update on my last message:

After another try with a clean 2.0.2 install the same rules & limits started working.
i even tried limiters with captive portal (which creates its own limiter per IP) and it works properly as expected, i.e. it applies both limiters at the same time and user is capped with the least one.

waldopulanco

Hi! I try this share bandwith, But I have a Problem, when I start to download on pc1 and during download, I try to browse the web on pc2 but the pc2 was very slow to load the page, I think it is effective only on the client were they download at the same time,. how to setup a share bandwith even if browsing and downloading at the same time but they are equal bandwidth?

or anyone have an idea how to setup a total bandwidth limit @ port 80 and limit bandwidth per ip? example i have 5 PCs the bandwidth per pc is 256kbps each and the total bandwidth is 1024kbps, and when the 5 PCs browse the web or download, the 5 PCs are not exceed the total bandwidth I assign?

total bandwidth: 1024kbps @ port 80 –----> 256kbps per PCs @ port 80.

thanks in advance!!

pubmsu

Hi,

This will work for LAN-side rules where there's a single gateway being specified (or default gateway). But how to apply this technique for multi-WAN setup where the bandwidths of each of the WANs are not necessarily same?

There are two cases: a. when gateways are in load-balanced group, b. when gateways are in failover group

Case A: Load-balanced Gateways:
What should be the value of the limiter bandwidths? The total bandwidth of all of the WANs in the load-balanced group?

Case B: Failover Gateways:
In this case, depending on which gateway is up/down, any of the gateways could be sending the traffic. So, which gateway's bandwidth should be set in the limiter?

The main issue is that the limiters are specific to each WAN bandwidth but in loadbalanced or failover groups, no specific gateway is set in the rule - so which limiter to set?

tebeve

So, between the walk-thru from foxale08 and some of the other tips listed by sideout I've managed to get my limiters set up in a way that shares bandwidth evenly amongst clients in my different groups (Thank you guys, BTW!)… but I'm having a little trouble with what I would like to do next.

Background:
-We have our main location and two satellite locations.
-We have site2site OpenVPN connections to each satellite. (Site A is VPN Server, sites B & C are clients)
-We have a phone system that uses the vpn connection for VOIP communications between locations.
-Sites A & B have decent connections to the internet (both are about 50Mb down / 15Mb up)
-Site C has a craptasticly old T1 that does 1 down / 1 up on a good day

What I'd like to do is use limiters within this current set of limiter groups to now allocate a guaranteed portion of the bandwidth to the phone system that the other limiters never get to touch. But I don't seem to be able to pull this off correctly. Would they even be within these groups or new groups themselves… I'm kinda dumb and lost.

Couple of questions would be:
1- With the current setup, is this even necessary?
1a- if so, how?
2- Would this be more a job for queues?
2a- if so, what's the best way to go about that... I have yet to have much luck with VOIP queues because of the VPN.

Any help, pointers, or insight is greatly appreciated!

pubmsu

To use WAN-specific limiters (limiters that have bandwidths set as per the available bandwidth of the specific WAN) on WAN interface rules, the following questions arise:

1. What should be the mask for the upload limiter? Source address or destination address?
2. What should be the mask for the download limiter? Source address or destination address?
3. Should the upload limiter be placed as In or Out? Likewise, will the download limiter be placed as In or Out?

Thanks!
Msu

daq

I'm not sure what I'm missing, but foxale08's suggestions seem to only restrict total available bandwidth. We have 100mbps up and down. If I run two speed tests side by side on separate machines, one gets around 85/85 while the other gets the rest.

If I set the limiters to 50mbps then total available bandwidth does go down to 50, but it is still not shared evenly so limiters appear to work, just not the way I expect them to.