2

I'll first describe my situation.

I have a network made by a central x86 server/firewall, 5 access points and 2 unmanaged routers in between.

20 Mbits download and 1 Mbit upload ADSL.
Upload is particularly problematic as a single user uploading an email attachment can slow down the whole network to a crawl.

What I need is some way to divide the upload speed evenly between the connected devices. It would be nice if it adjusted itself automatically, so that

  • 5 connected users -> each get 1/5 of the upload bandwidth
  • 10 connected users -> each get 1/10 of the upload bandwidth

What I'd like:

  • an x86 server distro capable of splitting available bandwidth evenly between connected users
  • a GUI tool would be would be perfect

What I'd like to avoid:

  • traffic priority based on ports (it's not what I'm aiming for)
  • programs to install on each device (I cannot do that)

Remember traffic is coming in from access points, I don't know if they need some special software too in order for this to work. I'd like to just act on the server, if possible.

1

I'd recommend pfSense. From the home page:

pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution.

Also have a look at the features page.

  • Looks nice. Any idea about the packages I need to do what I want, and possibily a way to do that using a GUI? – user39436 May 18 '13 at 11:42
  • It's done with pf - so should be doable in the base system. – Cian May 18 '13 at 13:03
  • Ok, any tutorial for my particular needs? I found a video that shows how to configure fixed up/down limits per IP. youtube.com/watch?v=Usi195rK35I I need a dynamic way of sharing bandwidth, though, not a fixed cap. – user39436 May 18 '13 at 13:58
1

I would strongly encourage you to use OpenBSD. The task you are inquiring about is done by ALTQ (ALTernate Queueing framework) which was originally ported from FreeBSD and integrated into PF. The good news is that OpenBSD is about to get its own Queueing framework (it is in testing phase). I would discourage you from using pfSense. pfSense a FreeBSD based distro which uses OpenBSD package filter (PF for short) for filtering. Unlike OpenSSH for example PF is not portable its functionality depends from the network stack. The version of PF shipped with pfSense and FreeBSD for that matter is obsolete by 3 years and not fully functional due to the lack of functionality in FreeBSD kernel and network stack. The funny thing is that ALTQ was not even loaded into FreeBSD kernel by default. If you are using FreeBSD use IPFW which is FreeBSD default firewall. FreeBSD supports also IPfilter. IPFW was used as a base for IPTables in Linux and until about a year ago was default firewall on OS X when OS X switch to very recent version of PF. If you do not like OpenBSD use NetBSD which got its own NPF optimizes for multi-core machines. I do not know how queuing is done in NPF.

I would also encourage you to learn about queuing before you start doing things. You might be surprised to find out that queueing is only useful for packets in the outbound direction. Once a packet arrives on an interface in the inbound direction it's already too late to queue it -- it's already consumed network bandwidth to get to the interface that just received it. The only solution is to enable queueing on the adjacent router or, if the host that received the packet is acting as a router, to enable queueing on the internal interface where packets exit the router. So in your case OpenBSD box has to act as a router for you to be able to manage users.

As of GUI, if you need GUI to configure your firewall you probably has no business configuring one. As of your request for queuing not using ports I would direct you back to ALTQ documentation so that you learn about various queueing methods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.