Network management skills: use free soft route pfSense to manage bandwidth

If you are in charge of a small network, whether it is your home network or a small enterprise network, or sooner or later you will face this problem: A small number of users occupy most of your bandwidth resources. The culprit is usually the person who uses the thunder download tool or btsoftware. Gaming players and video users are usually the most affected.

Most home broadband routes lack powerful bandwidth management functions

You may think that this is an opportunity for vro manufacturers to earn money. They can provide bandwidth control functions to make their products sell better. However, in reality, the bandwidth control function is ignored by most vro manufacturers.

Only a small number of companies provide bandwidth control functions in their products. D-Link is one of them, and it uses Ubicom's StreamEngine Automatic QoS (Service Quality) technology. However, StreamEngine is mainly an upstream bandwidth optimizer, which focuses on making real-time communication take precedence over other types of network communication. Real-time communication includes games, VOIP, and other applications that rely on the Implementation of transmitted data packets.

All you need to do is select "TrafficShaping", and then the router completes the remaining work. Most users also choose the "AutomaticUplinkSpeed" option, which allows the router to automatically detect the actual connection speed every time it restarts. I disabled this option and set the uplink speed in ManualUplinkSpeed because I don't want it to perform the probe every time it restarts.

In addition, you can use the ADDGameFuelRules option to manually set the uplink communication priority. To use this function, you need to know the port number used by the application. Through the ActiveSessions interface, you can easily see which ports require high priority. However, most P2P applications now have the function of changing ports, so it is usually difficult for you to filter them out.

Not long ago, Linksys added a manual uplink QoS setting function in its own vro. However, this control needs to be set manually, and it can only be used for uplink communication. However, Linksys provides two very good functions that allow you to control the bandwidth priority based on the client (MAC address) and set the physical switch port. However, these controls are also only valid for the uplink, so you cannot really control the use of all download bandwidth for a client.

The TrafficShaping function of m0n0wall has been used by many friends as a bandwidth control tool. However, to be honest, I think its rules, queues, and pipelines are too complicated, therefore, I hope to find a ready-made product for easy-to-use bandwidth control.

However, after reading an article from a friend recently, I decided to try pfSense. PfSense is an operating system derived from m0n0wall. It can run on a single computer rather than just an embedded microcontroller.

I downloaded pfSense for version 1.2 and made a simple trial on my DellInspiron4100 notebook (with a memory of 1 GB and 512 GB, although my machine configuration is relatively low, it seems a little slow to use, but through some simple experiments I found it can be very beautiful to achieve bandwidth control.

Of course, because I use my laptop as a router, I must first have a second Ethernet port. PfSense detects 3Comcompatible3c905C as the internal Nic, but it cannot detect LinksysPCM20010/100carw.ethernet Nic. After checking the pfSense hardware compatibility list, I purchased a D-LinkDFE-690TXD Nic and everything went fine.

After pfSense was installed, I used Jperf for a fast throughput check and found that LAN> WAN and WAN-LAN both have more than 90 Mbps of bandwidth. I cannot try all the features of pfSense here, but it does have some impressive features. Even if you cannot load it into a vro like DD-WRT and Tomato, you can understand why m0n0wall has such a wide user base from its functions.

PfSense even has different skins, but I only use its default skin (4 ). If you prefer the style of the menu bar on the left of m0n0wall, you can switch to the "pfSense" skin.

The TrafficShaper function is provided in the Firewall menu. When you use it for the first time, a wizard is provided to help you set it. You can use this wizard to automatically configure rules, queues, and pipelines for common applications and perform classified management. You can easily set bandwidth control and modify or copy them to create new settings.

The first screen requires you to enter the actual uplink and downlink network speeds of the Internet. In this case, we recommend that you enter 80% of the actual bandwidth you have measured. For example, if my ADSL connection bandwidth is "3 Mbps/640 Kbps", then I can enter 2500 and 350 (Kbps ). Then you can click the VOIP screen. There are only two control options, Provider and the Bandwidth you want to ensure that the VOIP application can use ).

The next screen is PenaltyBox, which is the first powerful function to control bandwidth. As shown in figure 5, you can implement simple control by IP address (you can enter multiple IP addresses) and set upstream or downstream bandwidth control.

Although the PenaltyBox function is very simple, it only limits the bandwidth of all communications between inbound and outbound IP addresses. However, it also allows users who prefer to modify ports to avoid bandwidth control to avoid being constrained.

Next is the PeertoPeer wizard. This control is also very simple; by setting upstream and downstream bandwidth to limit a large number of p2p applications. Note that the P2PCatchAll option here should be used with caution.

Once you select this function, unless you have another rule with a higher priority to set the bandwidth of other applications to be unrestricted, all communications will be subject to the bandwidth limit, in other words, this option treats all communications as p2p.

The next wizard screen is NetworkGames, which can be used to increase the priority of different games. On this screen, you do not need to set a bandwidth; you only need to select the game you want to give priority.

The last Wizard "RaiseorLowerOtherApplications (to increase or lower the priority of other applications)" screen has a detailed function description. You can increase or lower the priority of different applications.

After the Wizard is completed, rules and queues are automatically created. If you feel something is not set, just run the wizard again. You will find that it will remember your previous selections.

Test and modify pfSense rules

To check whether pfSense can actually limit the bandwidth used by BitTorrent, I installed bittor6.1 6.1 on a computer, and then selected a file to start downloading. You can see the bandwidth comparison after I enable this rule from figure 9.

After I reset the status, the BitTorrent client took some time to recreate the download link. It can be seen that, after a short period of time, the download bandwidth has been restored to the new kbps downstream bandwidth limit I set.

Modify pfSense rules

Once you create basic rules through the wizard, you can edit or copy them to meet your needs. You only need to navigate to Firewall: Shaper: Rules to view the screen shown in Figure 6 again, select the rule you want to edit or copy, and then click the corresponding icon. When you move your mouse over an icon, a prompt window will pop up to show you the purpose of the icon. The editing page of the third rule is shown. Although there is a lot of content on this screen, in most cases, you only need to modify the destination port range (DestinationPortRange ). Because this is a rule for BitTorrent, I set it to 6881 to 6999. If you want to modify this port, just enter the new port number and click Save.

Each rule has a Target field to set the queue to which packets matching the rule are sent. To create a new rule for different applications, you only need to find a rule that uses a queue with the bandwidth you want to set, copy it, and modify the destination port range (DestinationPortRange) the port used by the new application. After saving, reset States, and you have created and applied the new rule.

Note: The execution sequence of the Rules in pfSense is related to the position, which is from top to bottom in the list. Therefore, you should put more restrictive rules before the loose rules. Otherwise, more restrictive rules will not be executed. This is why I chose P2PCatchAll in Figure 6 and put the BitTorrent rule at the top of the list.

You can also adjust existing queues and create a new rule. However, you must be cautious when setting this rule.

Find the port of the application to be restricted

What if you do not know the port used by the application you want to restrict? In other words, if you modify the application port number or use a proxy, limiting the standard port is no longer useful. In addition to putting them in PenaltyBox, you can also use PFtop to view the communication status.

PFtop is a small network management tool that can display the real-time status and rule statistics of the OpenBSD packet filter pf in real time. It is also used on the pfSense platform. You can use the Diagnostics: ExecuteShellCommand function (11) In pfSense to quickly check the real-time communication connection status. This mode only allows you to view the default attempt and category, so its function is very limited. Even so, you can still see the most active connections and the information of the connections with the most downloads.

Conclusion

In this article, I just briefly introduced the Traffic Shaping function of pfSense. In fact, it also has many functions that can help you manage local networks.

If you have an idle computer and a little patience, I believe you will find that pfSense is a very powerful network management tool.