Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help Shape Outbound FTP traffic

    Scheduled Pinned Locked Moved Traffic Shaping
    5 Posts 2 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fsSnowboard
      last edited by

      I am trying to shape my outgoing FTP traffic by putting it in a lower priority que.  My other Floating rules are working fine, but am having issues with the FTP.  I created a Layer7 FTP rule (attachment 1).  By itself it doesn't seem to do anything.  After some research it looks like I needed to apply it to a Pass floating rule.  So I created a rule for Active FTP (Destination port 20) from Any.  Under advanced features I set the AckQueue/Queue to the qAck and qOthersLow, and the Layer7 field to my FTP rule (attachment 2).  It doesn't seem to catch anything.

      If I remove the port number, it catches things it shouldn't (like traffic to remote computers over the IPSEC VPN.)

      Anyone have any idea's on how I can identify and filter FTP traffic, both passive and active?

      Edit: I am using HFSC, but I don't think that matters for this question.
      ![FTP L7.png](/public/imported_attachments/1/FTP L7.png)
      ![FTP L7.png_thumb](/public/imported_attachments/1/FTP L7.png_thumb)
      Rule.png
      Rule.png_thumb

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        What do you mean when you say outgoing FTP?  Upload from your desktop to the Internet, or outbound from your LAN-based FTP server?  Floating rules use the MATCH action, not PASS, from what I remember.

        1 Reply Last reply Reply Quote 0
        • F
          fsSnowboard
          last edited by

          @KOM:

          What do you mean when you say outgoing FTP?  Upload from your desktop to the Internet, or outbound from your LAN-based FTP server?

          Upload from desktop to an FTP server on the internet.

          Floating rules use the MATCH action, not PASS, from what I remember.

          I tried that, but it said when I did it that Layer7 needed to be a Pass rule, which is why it is set to Pass.

          I'm still researching.  I found that maybe pfSense has an FTP helper built in and this might be breaking the queue.  Does anybody know?

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            You might have better luck elevating important traffic to a high-priority queue and relegating all other traffic, including FTP, to a low queue.

            1 Reply Last reply Reply Quote 0
            • F
              fsSnowboard
              last edited by

              I think that is what I am going to do.  I read this post and learned quite a bit more.  The rest of that thread is good too.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.