Smoothwall bandwidth module setup

[mrstrong]

Hi,

 

I'm trying to get this working, initially to control the bandwidth on our guest network:

a 192... / 24 network set up as a vlan on the smoothwall (basic interface)

 

Followed this video

https://help.smoothwall.net/FilterFirewall/Content/Video/BandwidthClasses.htm

 

e.g. did:

shaping policy: add new policy: Guest

add new slice streaming and tick streaming

weighting 1 , cap at 2Mbps up and down

classes: add new class: Guest with network 192 /24 and new guest shaping policy

 

Also did last bit from video (not sure if needed) :

interfaces: add new interface limit on our External (95% of total)

 

Then I test via connecting to guests and start downloading, streaming etc

 

I'm pretty sure its not working as when I look in "Bandwidth diagnostics monitoring"

I can see no traffic going through my new Guest class, i.e. it's all going through the original All traffic class

 

Any ideas where I've gone wrong ?

[ibpalle]

If you are trying to shape client traffic on the external interface using the clients internal addresses, you won't get a match as the traffic will be NATted externally. Further, a lot of this traffic would be wen traffic so it may be easier to impose a bandwidth limit in the web proxy section instead.

 

If you are using the Smoothwall as both firewall proxy you can enable spoofing on the web proxies, which will preserver the client IP after it leaves the proxy. Then the bandwidth module will apply based on client IP - after the bandwidth shaping comes the final NAT rule in the firewall so client IP is natted correctly for internet based traffic.

[mrstrong]

Thanks for that info,

 

so just to clarify as we have a guest vlan on port 2 basic interface 192.168.0.1 (i.e. network is 192.168.0.0/24)

port 6 is external into a cisco router (port 6 has our external real IP with the gateway set as the cisco router IP)

we use the smoothwall as a firewall and web proxy and filter(guardian) and it does dhcp for guest vlan also.

we also use https inspection and sync to active directory and google.

 

Looking in web proxy, authentication, manage policies I can see vlan interface under transparent authentication policies:

https on, spoofing off.

 

So are you saying I just need to turn spoofing on ? could you explain a bit more about "spoofing" e.g. are there any downsides / gotchas / caveats

I should be aware of first ?

 

Thanks again

[ibpalle]

Spoofing preserves the client IP for web traffic leaving the proxy. Normally source IP for proxied traffic would be the proxy IP itself.

 

If you were only using the filter, not the firewall, you would have to be sure to make all return traffic route back into your network via the Smoothwall, otherwise spoofing breaks things. When you use both firewall and filter on the same device, spoofing can be used as return traffic is always routed back via the Smoothwall. Bandwidth shaping can then be done based on client IP as that process takes place before the final NAT.

 

The reason for using spoofing here is so we can apply bandwidth limits on web traffic based on client IP.

[mrstrong]

cheers for that, so it looks like i can turn spoofing on. I'll try it on guest network first and then if ok maybe staff one also

 

Also had a look at web proxy band width limiting like you said. Looks good e.g. I see I can limit via a category like YouTube,

how would I go about throttling (i.e. capping) downloads as thats not a "category" ?

 

Also are there any performance implications with either method, e.g. is one more resource intensive than the other

(bandwidth module vs bandwidth proxy limiting) ?

 

Our load average has been a bit high recently, might open that as a separate post

as I'm not sure what it really means and what is acceptable, e.g. this morning it was

10 and a few weeks ago it got up to 30!

[ibpalle]

Load average is generally a lot of disk activity. Logging, creating blockpages, indexing logs etc.

 

The proxy limiter actually limits uploads to the clients, not downloads from the internet - arguably a better way of working and I'd recommend turning a generic one on for all users as that will allow the proxy to do fair distribution of bandwidth. Just note that the limit is set in Bytes, not bits.

 

None of the methods have a major impact on CPU - proxy can distinguish between different types of web traffic, bandwidth cannot but can handle web as one and all other traffic types. That's the main difference.

[mrstrong]

great, one final query, could you explain how to do it :

I'd recommend turning a generic one on for all users as that will allow the proxy to do fair distribution of bandwidth

e.g. do you mean just having this policy :

 

 

who      what       where      when   bandwidth-limit allocation
everyone everything everywhere always #kbytes         shared

Edited May 14, 2021 by mrstrong

[mrstrong]

@ibpalle sorry to pester, is policy in last post correct ?

 

Went ahead and turned on spoofing for guest vlan, did get a warning I don't fully understand, not sure if I need to do anything extra:

The local traffic rule for Guardian on Source NAT & LLB policies page does not apply to spoofed traffic. Add explicit Source NAT policies.

So far seems to be working (no helpdesk calls yet)

[ibpalle]

Yes, the warning is to make sure it's understood that the outgoing traffic from the web proxy will now be treated as coming from the client, not the proxy. This means that the dropdown for Guardian traffic you can see in the Source NAT & LLB policies page, no longer applies.

[mrstrong]

thanks just got back onto this, was my policy correct ?

 

 

who      what       where      when   bandwidth-limit allocation
everyone everything everywhere always #kbytes         shared

[ibpalle]

Yes that looks right - obviously the #kB needs filling in