Solving Bufferbloat in pfSense with ALTQ Traffic Shaping

The Problem: The 'Lag Spike' During Large Uploads

You have a high-speed connection, but the moment someone starts a cloud backup or a large file upload, your Zoom call freezes and your gaming latency spikes. This is often caused by bufferbloat—a phenomenon where network equipment buffers too many packets, creating excessive queuing delay. When your WAN interface is saturated, critical small packets (like VoIP or ACK packets) get stuck behind massive data chunks.

The solution is not necessarily more bandwidth, but Active Queue Management. pfSense uses ALTQ (Alternate Queueing) to ensure that time-sensitive traffic bypasses the bulk data queue, maintaining low latency even under heavy load.

Choosing the Right Queueing Discipline

ALTQ provides several ways to handle packets. Choosing the wrong one can either lead to configuration exhaustion or ineffective shaping:

• HFSC (Hierarchical Fair Service Curve): The gold standard for modern networks. It decouples bandwidth allocation from delay guarantees. Use this if you need to guarantee that VoIP traffic has a specific latency regardless of how much bandwidth other users are consuming.
• CBQ (Class-Based Queuing): A traditional hierarchical approach. It is effective for dividing a pipe into percentages (e.g., 20% for Guests, 80% for Staff) but is less precise for millisecond-level latency control.
• PRIO (Priority Queuing): The simplest method. It services the highest priority queue completely before moving to the next. Risk: High-priority traffic can completely "starve" lower-priority queues if not carefully capped.

Example: Prioritizing VoIP and Capping Bulk Traffic

In this scenario, we assume a WAN connection of 100 Mbps. We want to ensure VoIP traffic is never delayed and that P2P/Bulk traffic cannot consume more than 10 Mbps during periods of congestion.

1. Initialize the Shaper

Navigate to Firewall > Traffic Shaper. Create a new queue tree using HFSC on the WAN interface. This acts as the root container for all your rules.

2. Configure the VoIP Priority Queue

Add a rule to the HFSC tree with the following parameters:

• Queue Name: voip_priority
• Protocol: UDP
• Destination Ports: 5060, 5061, 10000-20000 (Standard SIP and RTP ranges)
• Realtime/Link Service: Enabled (This tells HFSC to prioritize the timing of these packets over the total volume).
• Priority: 7 (Highest)

3. Configure the Bulk/P2P Cap

Add a second rule to the same tree:

• Queue Name: bulk_limit
• Protocol: TCP
• Destination Ports: 6881-6889 (Common P2P ports)
• Link Quota: 10 Mbit/s
• Priority: 1 (Lowest)

4. Rule Order and Application

ALTQ rules are processed top-down. Ensure your specific VoIP rules are positioned above any general traffic rules. Click Apply Changes to commit the configuration to the kernel.

Testing and Verification

To verify that the shaper is actually dropping or delaying packets as intended, you must saturate the link.

Step A: Generate Load
Run iperf3 from a client machine to a remote server to fill the pipe:

# Run on a client behind pfSense to push 15Mbps of TCP traffic
iperf3 -c <remote_server_ip> -b 15M -t 60

Step B: Monitor the Queues
While the test is running, go to Diagnostics > Queues in pfSense. Look for the bulk_limit queue. You should see the Queue Length increasing and Dropped Packets accumulating, indicating the shaper is actively capping the traffic at 10 Mbps.

Hardware Limitations and Trade-offs

ALTQ is a software-based queuing mechanism. Because it requires the CPU to inspect and categorize every packet, it can become a bottleneck on very high-speed connections (Gigabit+).

Critical Warning: Hardware offloading (such as Hardware Checksum Offloading) can sometimes bypass the ALTQ engine entirely, making your shaper rules appear to be ignored. If you find that traffic is not being shaped, check System > Advanced > Networking and ensure hardware offloading is disabled for the relevant interface.

Actionable Summary

To stop network congestion from ruining real-time communication: use HFSC for its latency guarantees, place your most sensitive traffic at the top of the rule list, and disable NIC hardware offloading to ensure the pfSense kernel maintains full control over the packet queue.