Traffic Shaper¶
t1n1wall includes a traffic shaper that allows bandwidth allocation and traffic prioritisation. It is built on dummynet, a FreeBSD kernel feature that provides pipe-based bandwidth control.
Web UI location¶
Firewall > Traffic Shaper
Concepts¶
Pipes¶
A pipe is a bandwidth container. Traffic assigned to a pipe is constrained to the pipe's configured bandwidth ceiling.
| Parameter | Notes |
|---|---|
| Bandwidth | Maximum throughput in Kbit/s |
| Delay | Optional artificial latency in milliseconds (useful for WAN simulation) |
| PLR | Packet Loss Ratio — fraction of packets dropped (e.g., 0.01 = 1%) |
| Queue size | Number of packets the pipe buffers before dropping |
| Mask | Traffic classification mask; controls whether one pipe instance handles all matched traffic or creates per-flow instances |
Queues¶
A queue attaches to a pipe and subdivides its bandwidth using weighted fair queuing. Multiple queues on the same pipe share bandwidth proportionally according to their weights.
| Parameter | Notes |
|---|---|
| Target pipe | Which pipe this queue belongs to |
| Weight | Relative share of the parent pipe's bandwidth (1–100+) |
| Mask | Per-flow classification mask |
If all queues on a pipe have weight 10 and one has weight 20, the heavier queue receives twice the bandwidth when contested.
Rules¶
Rules classify traffic and direct it to a pipe or queue. The first matching rule is applied; subsequent rules are not evaluated for that packet.
Rule matching fields:
| Field | Notes |
|---|---|
| Interface | LAN, WAN, PPTP, optional interfaces |
| Protocol | TCP, UDP, ICMP, ESP, AH, GRE, IPv6, IGMP, any |
| Direction | Incoming, outgoing, or any |
| Source / Destination | Address, CIDR network, interface subnet, or alias |
| Port range | Source and/or destination ports (TCP/UDP only) |
| IP ToS | Match specific Type of Service values |
| IP packet length | Single value or range |
| TCP flags | Match specific flag combinations |
| Target | Pipe number or queue number |
Order of operations¶
- Create pipes first (bandwidth containers)
- Optionally create queues attached to those pipes
- Create rules that classify traffic into pipes or queues
Rules cannot reference pipes or queues that do not exist. At least one pipe must exist before any rules can be created.
Enable/disable¶
There is a global enable toggle on the traffic shaper page. Disabling the shaper removes all active dummynet pipes from the running system without deleting the configured rules.
Individual rules can also be disabled without deletion by checking the Disabled checkbox in the rule editor.
First-match semantics¶
Rules are evaluated in order from top to bottom. The first rule that matches a packet determines its pipe or queue. Rule order matters and can be adjusted in the rule list.
Per-user bandwidth in captive portal¶
When captive portal is configured with per-user bandwidth limits, it uses the traffic shaper internally. The traffic shaper must be globally enabled for per-user captive portal bandwidth to work.
Diagnostics¶
Active dummynet pipe and queue state is not directly visible in the web UI. On the console or via SSH, ipfw pipe list and ipfw queue list show live dummynet state.