Scheduled Throttling with pfSense

Apple has launched a new Photos App for OS X, along with the ability to upload your entire library to iCloud. And with prices that are so cheap, there’s almost no reason not to. $3.99 a month is cheap insurance to know that every photo I’ve ever taken of my family won’t be wiped out in a tornado.

But with this comes a problem - namely, how do you upload a 150 gigabytes of photos over a 5 megabit network connection? Well, you wait a really long time for it to upload. Which is fine, really, because I’m not in any particular hurry to finish. But, once I started the upload, I noticed that surfing the web became pretty much impossible because the upload to iCloud was saturating my upstream bandwidth.

What I needed was a way to throttle the iCloud upload. I really don’t care if that adds a couple more hours or days to the upload. I just need to be able to surf from other devices without problems. But at the same time, I’m not using my connection in the middle of the night. There’s no reason it could’t go full bore overnight.

And this is where pfSense comes in.

Start by creating a schedule:

  1. Go to Firewall -> Schedules. Add a new schedule.
  2. Give it a name. I called mine “Nighttime.”
  3. Click the headers of each day of the month in the calendar. This will apply it to every day.
  4. Set the start time to 8:00 and the end time to 23:59. This means I want the schedule to be active between 8am and about midnight, which mirrors my usage patterns. You can adjust this as needed.
  5. Click “Add Time”.
  6. Click “Save”.

Next, create a limiter:

  1. Go to Firewall -> Traffic Shaper. Click the Limiter tab. Click “Create a new limiter”.
  2. Click “Create a new limiter”.
  3. Check “Enable limiter and its children”.
  4. Give it a name. I called my first one “3mb-source” (limit outbound to 3 megabit).
  5. Under bandwidth, set it to whatever you want the limit to be (in my case, 3 and Mbit/s) and select the schedule you just created from the dropdown.
  6. Under mask, set “Source addresses”.
  7. Click “Save.”

Now, apply the rule.

  1. Go to Firewall -> Rules. Select the LAN tab. Create a new rule. Configure it as follows:
    • Interface: LAN
    • Source: Single host or alias, and the IP address of your uploading machine.
  2. Under “Advanced”, click “In/Out”. In the first dropdown, select the limiter you made above.
  3. Click “Save.”
  4. Now, you need to order the rules so that this rule is applied first. Check the box next to the rule you just created, then click the little left-pointing arrow next to the top rule, right underneath the anti-lockout rule.
  5. At the top, click “Apply Changes”.

That’s it! Your upstream bandwidth from the uploading machine is now limited to whatever you set it to, but only during the hours specified by your schedule.

Now, if you want extra credit, you could try to identify the upstream server’s IP address and craft a rule that only applies the limit to outbound packets to iCloud. Another approach would be to use QoS and de-prioritize packets from the machine. But that was overkill for me. This solution was “good enough” for a temporary measure to keep my network working while the uploading occurs.

Did something I wrote help you out?

That's great! I don't earn any money from this site - I run no ads, sell no products and participate in no affiliate programs. I do this solely because it's fun; I enjoy writing and sharing what I learn.

COVID-19 has taken the world by storm and left a lot of brokenness in its wake. A lot of people are suffering. If you feel so inclined, please make a donation to your local food bank or medical charity. Order take-out from your local Chinese restaurant. Help buy groceries for an unemployed friend. Help people make it through to the other side.

But if you found this article helpful and you really feel like donating to me specifically, you can do so below.

Read More

Installing the Ubiquiti UniFi Controller Software on pfSense 2.2

Note: I am leaving this here for the reference and posterity, but for a variety of reasons, I no longer recommend doing this. It is a neat hack, but tends to be a bit of a pain to live with as you end up having to troubleshoot or reinstall it every time you update pfSense or Unifi. When you can install it on a Raspberry Pi for less than $50, there’s really no need to do this. I personally have switched to running this on a stock Ubuntu system that runs a few other network services in my house. This is a short tutorial on how to install the Ubiquiti Networks’ UniFi Enterprise Wifi controller software on pfSense 2.2. These directions are derived from these directions for 2.1-RC, but have been updated to work on 2.2. Note that this is a somewhat advanced tutorial. If you are not comfortable working in a Unix command line or editing system files, this is probably not the best thing you could do. But I’m putting it out here in case it will help others.

More collectd and pfSense Fun!

Extending my post from last year, here’s some additional data I’m grabbing from pfSense and stuffing into collectd via a script. I’m now grabbing: DHCP Leases CPU Temperature Thermal Zone Temperature SSD Drive Temperature UPS information (via NUT) Here’s the exec script: