Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to mark traffic on WAN interface?

    Scheduled Pinned Locked Moved Routing and Multi WAN
    5 Posts 2 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      slavikss
      last edited by

      1 x LAN and 2 x WAN

      I want to tag all the traffic on WAN1 and WAN2, use floating matching rule on LAN interface to apply queue based on tag.

      Is this possible?

      Thanks!

      1 Reply Last reply Reply Quote 0
      • G
        georgeman
        last edited by

        Something like this?

        If it ain't broke, you haven't tampered enough with it

        1 Reply Last reply Reply Quote 0
        • S
          slavikss
          last edited by

          WAN1 = 8 Mbits
          WAN2 = 100 Mbits

          / < LAN1 <
          Users <                        FAILOVER WAN1 / WAN2
                        \ < LAN2 <

          I want to limit download speed on LAN interface (limit downloads of users). The main problem is that I want to use FAILOVER.
          I cannot create rules on LAN interfaces which know from which WAN interface packets are coming!
          After lot of tests I see that tagging applies only to new incoming packets(SYN), but not to established connections!

          Help me please.

          Sorry for my english.

          1 Reply Last reply Reply Quote 0
          • G
            georgeman
            last edited by

            How many LANs do you have?? Let's assume you have only 1 LAN.

            The easiest solution for this is to queue traffic with floating rules, action queue, direction out, on each of the WANs. Be careful because you are queueing out of the interface, so at this point NAT has already occurred, the packet being queued has its source IP changed already (simply put, don't specify a source IP on the floating rule). Also, make sure that the allow rules on the LAN interface are not applying any queue because these will override the ones you selected on the floating tab.

            Now, if you have 2 or more LANs… There is no simple solution. The reason is that you cannot have a download queue that applies to more than 1 interface at a time.
            Possible solutions would be:

            • Another pfSense box, bridged, which does the shaping
            • Bridge the LAN interfaces and apply the shaper to the bridge
            • Use VLANs on the same physical interfaces, apply the shaper to it

            If it ain't broke, you haven't tampered enough with it

            1 Reply Last reply Reply Quote 0
            • S
              slavikss
              last edited by

              Ok. Thank you for help!

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.