Limit in/out bandwidth of a single machine in a NAT’ed LAN

I am in need to limit the bandwidth which my son’s computer consumes when he plays Apex Legends while talking to his friends/team by the way of Discord. Occasionally every network speed goes down to a crawl. For the time being, I do not want to simply prohibit him gaming. Because of the pandemic there are not so much other choices for him to meeting with and talking to friends. The solution is to limit the bandwidth and increase the delay of responses (the ping:-) on the gateway which is operated by FreeBSD 12.2-RELEASE-p2 by employing dummynet(4) together with ipfw(8).

The gateway got already a working stateful NAT’ed ipfw firewall. Although, dummynet and traffic shaping was new to me, it turned out that setting this up was not too complicated. I did the following:

  1. To the configuration file /boot/loader.conf I added dummynet_load="YES".
  2. In the ipfw configuration file I configured 2 pipes:
    # Configure 2 pipes for traffic shaping
    /sbin/ipfw -q pipe 1 config delay 0 bw 1Mbit/s
    /sbin/ipfw -q pipe 2 config delay 0 bw 5Mbit/s
  3. For the outgoing traffic, I added the rule for pipe 1 right before the incoming NAT rule:
    # Pipe 1 before NAT for shaping outgoing traffic of the gaming machine
    /sbin/ipfw -q add 99 pipe 1 ip4 from to any
    # NAT rule for incoming packets.
    /sbin/ipfw -q add 100 nat 1 ip4 from any to any in recv $WAN
  4. For incoming traffic, I added the rule for pipe 2 right after the outgoing NAT rule:
    # NAT rule for outgoing packets.
    /sbin/ipfw -q add 10000 nat 1 ip4 from any to any out xmit $WAN
    # Pipe 2 after NAT for shaping incoming traffic
    /sbin/ipfw -q add 10001 pipe 2 ip4 from any to

The gaming computer got the fixed IP address, and this was used for the pipe rules. It would be possible to list more IP addresses separated by commas to said rules.

In the beginning I set the delay to 30 ms and the bandwidth to 1 Mbit/s, but then the son was complaining that his ping had gone down badly, so I adjusted the pipe settings to 10 ms and 2 Mbit/s and now it seems that this matches his comfort zone, while most importantly, the other computers in the LAN can access the internet again as usual.

Copyright © Dr. Rolf Jansen - 2020-12-16 12:04:49

Discussion on Twitter: 1339235580106903556