Prioritizing Critical Traffic on pfSense with the Built‑In Traffic Shaper

The Problem: Latency‑Sensitive Traffic on a Shared LAN

In many offices and homes, a single broadband link serves web browsing, file downloads, VoIP, remote gaming, and other services. When a large file download starts, it can consume most of the available bandwidth, causing jitter and packet loss for time‑critical traffic. Administrators often ask: How can I keep my voice calls smooth without cutting off everyone else’s internet?

Why Use the pfSense Traffic Shaper?

pfSense’s Traffic Shaper is a queue‑based scheduler that lets you assign bandwidth limits and priority levels to traffic classes. It is fully supported in every official release, lives in /conf/config.xml, and can be managed through the WebGUI or by editing the XML directly. The shaper supports two scheduling modes:

• Priority – pre‑emptive, best‑effort for high‑priority traffic.
• Fair Queue – shares bandwidth evenly but can be tuned to favor specific classes.

Choosing the right mode and class configuration is key to balancing performance and fairness.

Setting Up a Shaper Queue

1. Navigate to Firewall > Traffic Shaper.
   • Click Add to create a new queue.
   • Give it a descriptive name, e.g., VoiceAndGaming.
   • Set the Bandwidth to the maximum you want to reserve for this queue (e.g., 10 Mbps).
   • Choose Priority as the scheduler if you need strict pre‑emptive handling.
2. Apply the queue to the interface that carries the traffic (typically WAN or a specific VLAN). Use the Apply Queues to Interface checkbox.
3. Save and apply changes.

Defining High‑ and Low‑Priority Classes

1. Within the newly created queue, click Add Class.
   • Class Name: HighPriority
   • Match Criteria: Source/Destination IP (e.g., 192.168.1.0/24), Destination Port (e.g., 5060 for SIP), or Protocol.
   • Bandwidth: 5 Mbps (half of the queue).
   • Priority Level: 1 (highest).
2. Add another class for low‑priority traffic.
   • Class Name: LowPriority
   • Match Criteria: All other traffic (use a catch‑all rule).
   • Bandwidth: 5 Mbps.
   • Priority Level: 5.
3. Save and apply the configuration.

Testing with iperf3

To verify that the shaper is working, run iperf3 from two client machines on the LAN. The server should be listening on the WAN IP or on a dedicated test interface.

On the Server (any machine with iperf3 installed)

sudo iperf3 -s

Run this as root or with sudo on the machine that will act as the server. No special permissions beyond sudo are required.

On the High‑Priority Client

iperf3 -c 192.168.1.10 -t 30 --set-priority 1

Replace 192.168.1.10 with the server’s IP. The --set-priority 1 flag tags the stream as high priority for pfSense to recognize.

On the Low‑Priority Client

iperf3 -c 192.168.1.10 -t 30

Run this on a second machine without the priority flag.

Observing Results

• In the server’s terminal, you should see two separate results: the high‑priority stream achieving closer to 5 Mbps, and the low‑priority stream limited to the remaining bandwidth.
• In pfSense, navigate to Status > Traffic Shaper and view the real‑time statistics for the VoiceAndGaming queue. The high‑priority class should show higher throughput and lower queue depth.
• After a reboot, verify that the queue and classes persist by checking /conf/config.xml for the shaper entries.

Trade‑offs and Limitations

• CPU Load: On low‑end routers, enabling many classes can raise CPU usage. Monitor with htop or pfSense’s Status > System Logs > System > Traffic Shaper. If CPU > 80 % during heavy traffic, consider simplifying the class hierarchy.
• Over‑Granularity: Too many narrow classes can cause unpredictable packet scheduling and may even degrade overall throughput.
• Fair Queue vs. Priority: The default Fair Queue mode may not honor strict priority unless explicitly configured. Use the Priority scheduler for latency‑sensitive applications.
• Mis‑tuned Limits: Setting a bandwidth limit that is too low for a critical service can unintentionally throttle it. Perform baseline tests before deployment.

Actionable Checklist

1. Confirm pfSense version: System > About.
2. Create a queue named VoiceAndGaming with a total bandwidth of 10 Mbps.
3. Define two classes: HighPriority (5 Mbps, priority 1) and LowPriority (5 Mbps, priority 5).
4. Apply the queue to the relevant interface.
5. Run iperf3 tests from two clients as described.
6. Check queue statistics in Status > Traffic Shaper to confirm expected throughput.
7. Verify persistence by inspecting /conf/config.xml after a reboot.
8. Monitor CPU usage; if high, reduce the number of classes or increase hardware resources.

By following this sequence, you can confidently prioritize VoIP, gaming, or any latency‑sensitive traffic on pfSense while maintaining overall network health.