Skip to content

Configure Traffic Shaping

This guide walks through setting up bandwidth limiting using the traffic shaper. The example limits a specific LAN subnet to 10 Mbit/s download and creates a higher-priority queue for VoIP traffic.

For reference information on shaper concepts, see Traffic Shaper.

Step 1: Enable the traffic shaper

Go to Firewall > Traffic Shaper and check Enable traffic shaper. Save.

Step 2: Create a pipe

A pipe defines a bandwidth ceiling.

Go to Firewall > Traffic Shaper > Pipes and click Add.

Field Value Notes
Bandwidth 10000 10 Mbit/s in Kbit/s
Delay — Leave blank (no artificial latency)
PLR — Leave blank (no simulated packet loss)
Queue size — Leave blank (use default)
Description LAN-10Mbit Descriptive name

Save. Note the pipe number assigned (e.g., Pipe 1).

Step 3: (Optional) Create queues for prioritisation

Queues subdivide a pipe's bandwidth. This example adds two queues: one for VoIP (higher priority) and one for general traffic (lower priority).

Go to Firewall > Traffic Shaper > Queues and click Add.

VoIP queue:

Field Value
Target pipe Pipe 1 (LAN-10Mbit)
Weight 80
Description VoIP

General queue:

Field Value
Target pipe Pipe 1 (LAN-10Mbit)
Weight 20
Description General

When both queues have traffic, VoIP receives 80% of the 10 Mbit/s pipe. When only one queue is active, it uses all available bandwidth.

Step 4: Create shaper rules

Rules classify traffic and assign it to a pipe or queue.

Go to Firewall > Traffic Shaper and click Add (in the rules section).

Rule 1 — VoIP traffic (SIP and RTP) to VoIP queue:

Field Value
Interface LAN
Protocol UDP
Source LAN subnet
Destination any
Destination port range 5060 to 5061 (SIP signalling)
Direction Outgoing
Target Queue: VoIP
Description VoIP SIP to VoIP queue

Add a second rule for RTP media (typically UDP 10000–20000) pointing to the same VoIP queue.

Rule 2 — All other LAN traffic to general queue:

Field Value
Interface LAN
Protocol any
Source LAN subnet
Destination any
Direction Outgoing
Target Queue: General
Description General LAN to general queue

Place the VoIP rule above the general rule. Rules are evaluated top-to-bottom; the first match wins.

Step 5: Apply

Click Apply to push the shaper configuration into the running system.

Limiting a single host

To limit a single host rather than a whole subnet:

  • In the rule Source field, choose Single host and enter the IP address
  • Point the rule to a pipe (or queue) with the desired bandwidth

Limiting by port (e.g., BitTorrent)

To limit peer-to-peer traffic:

  1. Create a low-priority pipe (e.g., 2000 Kbit/s)
  2. Create a shaper rule matching TCP/UDP source/destination port ranges used by the application
  3. Set target to the low-priority pipe
  4. Place this rule above any general-traffic rule

Validation

  • Generate traffic on the LAN and observe that throughput for matched traffic does not exceed the pipe bandwidth
  • Use Status > Traffic Graph in the web UI to visualise interface utilisation
  • On the console, ipfw pipe list and ipfw queue list show live dummynet state