Per IP traffic shaping–share bandwith evenly between IP addresses??

cmutwiwa

I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?

paulsgrigg

Been struggling getting this to work all day but got it working now :)

Just in case anyone has problems, what fixed it for me is to set the bandwidth a few megabits below what is actually available. We get around 17 mbit over ADSL but the limiter wouldn't work until I set it at 15 (or lower).

I've also had the weird side effect that port reflection seems to have stopped working when accessing from our LAN, NAT rules which forward to our DMZ. Not a big deal at the moment but does anyone know why? The port reflection still seems to work for rules that point to our LAN.

Paul

hatcherista

Hi there guys.. i did foxale08's post and it worked very well. our gaming ping is very low for online games such as lol, hon and dota2, however, whenever the lan rule is enabled, all clients seem to have a very hard time browsing the internet, any idea how to solve this issue?

our broadband is 10mbps (yes its quite low) for download and around 600 kbps for upload so i set the limiter at 6mbps download and 512 kbps upload

velzyboard

Thank you foxale08 for your documentation on this solution. I have run this for over week a week now on our private network. My colleagues are coming up and saying … "did something happen to the internet? It is running faster and more reliable." I removed all the traffic shaping and your limiter setup is perfect for us.

I'd like to do the same for our public network. However, I have one last question. Are there resources that I need to make sure we have enough before doing that like handles, file limits etc?

My box is a Pentium R 3.4 Ghz with 2 CPU x 2 Cores and 4G of memory and 64G hard drive.
2 WANs (50mbps/5mbps; 24mbps/5mbps)
1 for private interface and 1 for public.
Private only has 15 users. Public can have 0-peak 120 general users (mail & browsing)

Thanks!
Rob

jiunnyik

@cmutwiwa:

I applied foxale08 method for the limiter and it kills internet connection (but I can ping websites), if I disable the limiters internet works fine. I'm also using squid proxy in transparent mode, I haven't tried to uninstall squid but could it be the issue?

I have the same issue.

Disable the transparent proxy and the limiter will works

jiunnyik

I tested foxale08's method on 2.2.2

I found that sometimes it not really share bandwidth evenly.

Anyone same issue ?

xanaro

I am using 2.2.2-RELEASE (i386). We have about 6 people for a total of around 20 devices on a 25/3 Mbit residential connection, and when everyone fires up netflix/youtube/huluu/vudu/etc I can clearly see watching the traffic graph on the lan side that this is working!

I just wanted to post to say THANK YOU foxale08! This is working like a dream.

Guides like these are great! took our pfsense to a whole new level, we have been using pfsense for like 5 years now, and it has been great, but this makes it even better!

Now the next thing I need to figure out how to do is set a limit on the number of connections per IP, I would prefer that no single IP use more than 20-30 connections, because too many connections also causes issues for other users on the network that are not abusing it.

If anyone has any tips regarding limiting connections please let me know and thanks again foxale08!

Derelict

If anyone has any tips regarding limiting connections please let me know and thanks again foxale08!

Maximum state entries per host on the main LAN pass rule (the same one that sets the limiters) is probably what you want.

Get ready for frowning faces. You'll probably break all sorts of things if you set this low enough that people actually hit it.

ETA: This should probably be another thread.

![Screen Shot 2015-05-28 at 6.55.47 PM.png](/public/imported_attachments/1/Screen Shot 2015-05-28 at 6.55.47 PM.png)
![Screen Shot 2015-05-28 at 6.55.47 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-28 at 6.55.47 PM.png_thumb)

marcocamza

@Sifter:

Since the default LAN rule is used to apply this speed limit, what happens if I want full speed to a transfer on my NAS between two computers on my LAN? Is the speed limit also imposed on that transfer? In that scenario, Id want full gigabit speed of the switch, not the imposed 20000 kbits.

That's exactly what I'm experiancing. With limiters set and I ping my NAS while doing a speed test the latency is 200+.

Derelict

Communications between two computers on the same network don't hit the firewall (or the limiter) at all. Look elsewhere for your throughput issues.

If you are talking about traffic between two interfaces on pfSense, just add a pass rule on the source interface with a destination of the other interface's INTF net, above the rule that sets the limiter, but with no limiter. ezpz.

marcocamza

Thanks it worked.

Now how do I dedicate a 2mb portion of 10mb for IAX2 Voip on Wan?

Derelict

HFSC Shaping.

marcocamza

Thanks maybe you could shed some light on this?

We currently have an interim wifi link of 10mb but at the end of the month we should have 100mb fibre.

My setup is 1 wan 7 vlans

LAN - 10.0.1.0/24 (not used)
Vlan5 - 10.0.0.0/24 (Devices i.e printers AP switches etc)
Vlan4 - 172.0.0.0/24 (Ipphones)
Vlan10 - 10.0.10.0/24 (1st Floor of our company)
Vlan20 - 10.0.20.0/24 (2nd Floor of our company)
Vlan30 - 10.0.30.0/24 (Wifi Clients)
Vlan40 - 10.0.40.0/24 (1st Floor of Another Company)

Currently limiting per ip on vlan10,20,30 to 2mb up & down.
Vlan40 is not currently being used.

So when the 100mb fibre is installed my idea is to limit vlan40 to 10mb for all user within that lan for http etc, and the remaining 90mb bandwidth is for our company.
From that 90mb I need to allocated 2mb for Voip IAX2 trunk (UDP port 4569) for communication for my internal pbx to service provider.

help would be greatly appreciated

Derelict

Should probably start another thread.

albert02

@foxale08:

I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

at the post image i would like to ask advice about shaping

1. Bandwidth - what will i put here the ISP gave me or the actual download speed I get when I downloading a file?

ISP Package says up to 5.5mbps
Im getting 650kbps DL/300kbps UL during off-peak and 500kbps during peak hours (@no limit downloading)

2. Between (None, Destination, Source) what will be the good to choose if u distribute bandwidth evenly.

mcwtim

Put the bandwidth values you actually can achieve. That being said, complain to your ISP, that is a far cry from 5 Mb. You are not getting what you are paying for.

Re; 2. follow all the screenshots, each limiter entry has their own settings for that.

ericnyamu

@foxale08:

@blablablablabla:

@foxale08:

Pfsense has equivalent functionality with limiters.

http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

I have implemented exactly what your talking about by using two parent limiters (up and down) and creating three child queues under each (the child queues are for each of my three lan subnets. The upload child queues have a 'source address' mask set and the download queues have the 'destination address' mask set.) I set the default pass rules for said subnets to use their appropriate child queues.

I do not know if the limiters will behave in the desired fashion if you are assigning traffic directly to a parent limiter, even with the mask set. At the very least, a single child queue, used in the way I am, would work.

i donot want to see dumb but where is the set-up script everybody is talking account?

Knight

@ericnyamu:

i donot want to see dumb but where is the set-up script everybody is talking account?

I think they mean the wizards under Firewall: Traffic Shaper: Wizards…

If you want to put in place what foxale08 described you have to do it manually though...

Good luck!

Nick

boomam

I'm having nothing but issues with this, in any configuration going, either via interface queues or limiter queues. Just doesn't want to work.
Unfortunately like most open source projects theres plenty of info on the how and the theory, but little to none on actual implementation. ???

Anyway, per-IP (or set of IP's set as Alias) on a transparent bridge:

Should there be queues on the inside NIC, outside NIC, bridge, or for all three? (in the traffic shaper GUI)
ACK Queue - where? (linked to above question)
At firewall rules, where should the queues be applied? On each interface, on the bridge, floating?
Are we setting the "ackqueue/queue" as a per queue thing without a ack queue specified, or specified?
If specified, which ACK? A global ACK queue, or one specific to each interface? Or one specific to each queue
Source/destination in firewall rules, where do we set the IP alias list? similar to above, on a specific interface or floating?

That'd be a good start for me i think…

Thanks in advance.

gollo

@boomam:

I'm having nothing but issues with this, in any configuration going, either via interface queues or limiter queues. Just doesn't want to work.
Unfortunately like most open source projects theres plenty of info on the how and the theory, but little to none on actual implementation. ???

Fortunately for you Pfsense offers commercial support so you can purchase that and then contact them and they can answer your questions AND help you get it implemented.