Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== PFSense - Buffer Bloat ======

http://www.dslreports.com/speedtest

Ideally you want to see A to A+'s for bufferbloat.  

Test result showing a letter grade worse than a B, probably indicate you have bufferbloat.

That means the device at your bottleneck link (most likely your router) is letting bulk traffic (uploads/downloads) interfere with (and slow down) your time-sensitive traffic (gaming, Skype, Facetime, etc.)

If not then tune.

{{:pfsense:bufferbloat_-_results.png?800|}}

----

===== Test for Bufferbloat =====

The [[http://dslreports.com/speedtest|DSL Reports Speed Test]] makes accurate measurements of the download and upload speeds along with the latency during the test.


1. Start a ping to google.com. You’ll see a series of lines, one per ping, typically with times in the 20-100 msec range.

2. Run a speed test simultaneously. To do this, start one of the speed test services below:

  * http://fast.com - (fast.com now tests for latency under load but we’d like more folk to check their results against our quick test)
  * http://speedtest.net
  * http://testmy.net
  * http://speedof.me
   
3. Watch the ping times while the speed test is running.  If the times jump up when uploading or downloading, then your router is probably bloated.

----

===== Change the Q size =====

<WRAP important>
**IMPORTANT:**  The bandwidth settings for the limiters need to be set to the upload/download speed of your internet connection.

It is important to keep in mind that what you are doing in pfSense is setting up a rate limiter.

If you set the numbers lower than your connection will allow, you'll get a great buffer bloat score but you'll slow your network throughput to whatever value you chose.

If you set the number too high, the rate limiter wont come into play and you'll be subjected to the same performance and buffer bloat you had prior to making the changes.

The idea is to let pfSense do the rate limiting closer to home.

Letting your provider do it for you increases latency... and that's what we are really trying to avoid.

So to minimize latency, a recommendation is to first do a speed test to find out what your connection is capable of, then set the bandwidth of the limiters in pfSense to those numbers.

Adjust the queue size adds another dimension to the optimizations.

Someday your connection might receive a speed upgrade and you may forgot to adjust the limiter to make use of it!
</WRAP>

----

===== Instructions =====

==== Create Limiters ====

Navigate to **Firewall -> Traffic Shaper -> Limiters**.

=== Create "Out" limiter ===

  * Tick "Enable"
  * Name: FQ_CODEL_OUT
  * Bandwidth: 96907 Kbit/s
  * Mask: None
  * Queue Management Algorithm: Tail Drop
  * Scheduler: FQ_CODEL
    * target: 5
    * interval: 100
    * quantum: 300
    * limit: 10240
    * flows: 20480
  * Click Save/Apply Changes

----

=== Add "Out" queue ===

  * Tick "Enable"
  * Name: fq_codel_out_q
  * Mask: None
  * Queue Management Algorithm: Tail Drop
  * Click Save/Apply Changes

----

=== Create "In" limiter ===

  * Tick "Enable"
  * Name: FQ_CODEL_IN
  * Bandwidth: 83886 Kbit/s
  * Mask: None
  * Queue Management Algorithm: Tail Drop
  * Scheduler: FQ_CODEL
     * target: 5
     * interval: 100
     * quantum: 300
     * limit: 10240
     * flows: 20480
  * Click Save/Apply Changes

----

=== Add "In" queue ===

  * Tick "Enable"
  * Name: fq_codel_in_q
  * Mask: None
  * Queue Management Algorithm: Tail Drop
  * Click Save/Apply Changes

----

==== Create Floating Rules ====

=== Add quick pass floating rule to handle ICMP traceroute ===

This rule matches ICMP traceroute packets so that they are not matched by the WAN-Out limiter rule that utilizes policy routing.

Policy routing breaks traceroute.

  * Action: Pass
  * Quick: Tick Apply the action immediately on match.
  * Interface: WAN
  * Direction: out
  * Address Family: IPv4
  * Protocol: ICMP
  * ICMP subtypes: Traceroute
  * Source: any
  * Destination: any
  * Description: policy routing traceroute workaround
  * Click Save

----

=== Add quick pass floating rule to handle ICMP echo-request and echo-reply ===

This rule matches ping packets so that they are not matched by the limiter rules.

See [[https://redmine.pfsense.org/issues/9024|bug 9024]] for more info.

  * Action: Pass
  * Quick: Tick Apply the action immediately on match.
  * Interface: WAN
  * Direction: any
  * Address Family: IPv4
  * Protocol: ICMP
  * ICMP subtypes: Echo reply, Echo Request
  * Source: any
  * Destination: any
  * Description: limiter drop echo-reply under load workaround
  * Click Save

----

=== Add a match rule for incoming state flows so that they're placed into the FQ-CoDel in/out queues ===

  * Action: Match
  * Interface: WAN
  * Direction: in
  * Address Family: IPv4
  * Protocol: Any
  * Source: any
  * Destination: any
  * Description: WAN-In FQ-CoDel queue
  * Gateway: Default
  * In / Out pipe: fq_codel_in_q / fq_codel_out_q
  * Click Save

----

=== Add a match rule for outgoing state flows so that they're placed into the FQ-CoDel out/in queues ===

  * Action: Match
  * Interface: WAN
  * Direction: out
  * Address Family: IPv4
  * Protocol: Any
  * Source: any
  * Destination: any
  * Description: WAN-Out FQ-CoDel queue
  * Gateway: WAN_DHCP
  * In / Out pipe: fq_codel_out_q / fq_codel_in_q
  * Click Save/Apply Changes

----

===== Troubleshooting =====

https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4/896

https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4/815

https://www.dslreports.com/forum/r32261369-Internet-Optimizing-speeds-on-pfSense-with-limiters



----

===== References =====

https://www.youtube.com/watch?v=o8nL81DzTlU&t=380

http://www.dslreports.com/speedtest

https://community.flexradio.com/flexradio/topics/pfsense-router-tuning-v2-4-4

https://www.bufferbloat.net/projects/bloat/wiki/Tests_for_Bufferbloat/

https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4/815

https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4/856

https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4