I'm trying to do traffic shaping with FreeBSD, here are my rules

su-3.2# ipfw show | grep pipe
08380 1514852  125523804 pipe 1 tcp from any to any dst-port 80
su-3.2# ipfw pipe 1 show
00001:   2.000 Mbit/s    0 ms   50 sl. 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 tcp    6520267 1204533020  0    0 1216

first of all why when I run ipfw pipe 1 show i get same source and destination ip, that doesnt seem like ever change yet total packets/bytes increasing

and most important question, after donig all that I'm looking at my MRTG stats and I see i'm very well over 2Mbit/s limit.

what am I doing wrong?

here is config file

pipe flush
pipe 1 config bw 2Mbit/s
add 100 allow ip from any to any via lo0
add 200 deny ip from any to
add 300 deny ip from to any
add 8380 pipe 1 tcp from any to any src-port www uid daemon
add 8380 pipe 1 tcp from any to any dst-port www uid daemon
add 65000 pass all from any to any
  • post config please. Oct 7, 2009 at 18:24
  • What are you want to do ?
    – adopilot
    Feb 3, 2010 at 6:26
  • 1
    traffic doesn't get shaped, i get peaks way over 2Mbit/s
    – alexus
    Feb 3, 2010 at 15:38
  • traffic that matches rule 8380? or overall traffic on interface?
    – gelraen
    Jan 21, 2011 at 13:17

2 Answers 2


You restrict http traffic to 2Mb/s, but you let all other traffic pass through. So you can still have 50Mb/s of FTP traffic for example which won't be limited

I used to set policy this way:

# flush all rules
ipfw -f flush

ipfw pipe 1 config bw 256Kbits/s
ipfw pipe 2 config bw 512Kbits/s
ipfw pipe 10 config bw 1Mbits/s
ipfw pipe 50 config bw 20Mbits/s
ipfw pipe 60 config bw 20Mbits/s
ipfw pipe 100 config bw 100Mbits/s

ipfw add 1 pipe 50 ip from X.X.X.X/21 to any out
ipfw add 2 pipe 60 ip from any to X.X.X.X/21 in

So you have 20Mb/s to inside and 20Mb/s to outside. If you only use one pipe, then it's 20Mb/s shared, so 10Mb/s.

Your shapping must include all traffic at the end, so there is no flow without traffic shapping

  • I'm okay to share same pipe, that's not the problem at all! the problem is it doesn't get limited at all it goes beyond that point! instead of 2mbps, i see peaks that are way higher then that!
    – alexus
    Feb 9, 2010 at 16:03

If you're tied to ipfw have a look at this site - They talk about OS X traffic shaping, but ipfw is ipfw and it should get you going. (Basically it looks like you're missing the queues on your pipe, which if I remember right makes the traffic shaping break down).

If you aren't married to ipfw you can do this (and lots of other QOS & Queueing stuff) more easily with pf and ALTQ (One reference, there are tons more available including the pf queueing docs)

General Note: Queueing/Shaping tends to work best when applied to outbound traffic (so if you want to limit the inbound traffic on your ISP interface you may have better luck throttling the outbound traffic on your inside interface)

  • while this all very good references, this isn't an answer for my question.
    – alexus
    Feb 3, 2010 at 15:41
  • Your first question (as I understood it) is "what am I doing wrong?" - The answer is in parentheses in my first paragraph above.
    – voretaq7
    Feb 3, 2010 at 16:35
  • 1
    Your second ("most important") question is why is your bandwidth utilization still high - Two part answer: your queueing code is broken (seen first paragraph), and if you're trying to limit incoming stuff it's "too late" -- it already came down the pipe & had to be received for your box to queue it (pf docs & "General Note" paragraph in the above)
    – voretaq7
    Feb 3, 2010 at 16:37
  • 1
    dummynet pipes provides 'hard' limit for traffic flow, while queues provides fair priority-based sharing between flows. So pipe is enough to limit bandwidth usage. Note about shaping only outgoing traffic does not apply to dummynet, it was designed to emulate links with given parameters and perfectly simulates shaping of incoming traffic as shaping on outgoing interface of virtual just-before-us router.
    – gelraen
    Jan 21, 2011 at 13:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .