Bandwidth Control

[sawi]

Exntended Networking -> Bandwidth Control

How to setting for my environment

I have 2 ip range
1) 192.168.0.1 - 192.168.0.254
2) 192.168.1.1 - 192.168.1.254

example : how to set, for all pc in ip range 192.168.0.1 to .254 ; limit bandwidth only 100kbits, except to 1 pc to full bandwidth (no limit)
and for all pc in ip range 192.168.1.1 to .254 ; limit to 512kbits but for pc ip 192.168.1.4 limit to 100kbits

any recomended setting?

[logan]

Hi sawi,

The first thing to do when implementing bandwidth control is identify the restrictions.
From your description, these would be:

• 100kbps
• 512kbps
• unrestricted

Use Bandwidth Control::Restrictions to create these restrictions.

Then you can use Bandwidth Control::Rules to assign the restrictions to certain IP/subnets. Here are a couple of images that show the process of implementing bandwidth control. Sorry for the large size and low quality. I have highlighted important settings with red squares.

bandwidthcontrol_restrictions.GIF (72.54 KiB) Viewed 29420 times

bandwidthcontrol_rules.GIF (130.64 KiB) Viewed 29424 times

[sawi]

thanks logan

[francisuk]

hi logan

How would i setup 90kbps just for one networked (linksys router) Would i just setup one rule and set the rule and set destion ip to 192.168.7.1? and submask 255.255.255.0?

192.168.7.1 > 192.168.7.9 = This is my LAN ips starting from and end with DHCP enabled in wingate. BUT for the wingate server is 192.168.7.33 and i dont wont to limit the bandwith for that server

[logan]

How would i setup 90kbps just for one networked (linksys router) Would i just setup one rule and set the rule and set destion ip to 192.168.7.1? and submask 255.255.255.0?

You're pretty much on the money there. Try creating a rule based on what you understand, but if you have any problems or questions, let the forum know and we can help out.
Keep in mind that if your bandwidth control settings end up breaking your internet connectivity (it's possible, but rare) you can simply disable Bandwidth control from Extended Networking -> General, ask some question to find out what went wrong and try again later.

192.168.7.1 > 192.168.7.9 = This is my LAN ips starting from and end with DHCP enabled in wingate. BUT for the wingate server is 192.168.7.33 and i dont wont to limit the bandwith for that server

Bandwidth control rules don't apply to the local machine that WinGate is installed on by default. This is an optional behaviour that must be enabled.

[Alen]

Hi all.

I have a question about BC too.
The question is quite simple: how to make Wingate to distribute available Internet connection speed equally among all users currently trying to connect to the Internet based on users IP addresses?
For example, if we have 256kbit/sec connection and 10 users are currently using Internet I want them to get equal parts of 256kbit/sec (in case they request for a data simultaneously). If 5 users start to read open web pages and no request are made for a while, the freed bandwidth is dynamically and equally distributed among 5 others.

And one more thing, the bandwidth should be divided equally for every ip, regardless of number of connections from the ips or type of service they use (downloading from ftp, surfing, mail sending, etc.). I mean if 9 users are just surfing and 1 is downloading 100MB file, bandwidth should be distributed evenly!

How to do this?

And I want the limit to work also for Wingate server itself, what should I do additionally to make this work?

P.S. Previously I was using the programm "Bandwidth controller", it worked fine and it was clear how to make necessary settings. But while reading Wingate help I did not get it...

[Alen]

I can't believe the question is too difficult.
Once more: I want the available at any moment Internet connection bandwidth to be dynamically and evenly divided among all my Internet users active for the moment; based on the users ips (I am going to use "assumed users" "authentication"). That's all.
How to do that?

Thanks.

[logan]

Hi Alen, sorry for the delay. I was hoping one of the developers would pick this one up as I'm not aware of future plans for bandwidth control so can't be of much help.
The current bandwidth control model is based on static restriction/rule assignment, which means on-the-fly/dynamic control is not possible. Bandwidth control is also purely IP based and not user aware.

[Alen]

Bandwidth control is also purely IP based and not user aware.

It's ok, it's what I need.

The current bandwidth control model is based on static restriction/rule assignment, which means on-the-fly/dynamic control is not possible.

It's a pity. But anyway, let's suppose we have 256kbit/sec bandwidth and 10 users\PCs (192.168.0.2 - 192.168.0.11), how should I divide this bandwidth evenly among them? Create rules giving PCs one per one with 25.6kbit/sec speed portions to each (=> 10 identical rules)?

And what will happen, if we got one more user, but he still has not any rule in bandwidth control and all bandwidth is already distributed (not bandwidth really available at this moment, but nominally available)? Will he be able to connect to Internet or totaly not until we decrease bandwidth portions for others and free some bandwidth for the new user?

P.S. Thank you for your help.

[logan]

I recommend the following for your scenario.

1. Create a restriction that limits users to 25kbps (you only need the one restriction)
2. Create a rule that applies the restriction to your entire network using the subnetmask (e.g. 192.168.1.0/255.255.255.0 == 192.168.1.0 -> 192.168.1.255)

This will apply the 25kbps retriction to the existing computers on the network. It will also apply the restriction to any new or computers that join the network. I will include more thorough instructions shortly.

[Alen]

Thank you, Logan.
I can say, the decision is quite logical. :-)

But it is also very inoptimal, because from this 10 users in average only 4-6 are online at the same time. Thus it is better to set limit to 50kbps.
The most important question here is: what will happen, if we have 256kbps actual bandwidth and in some cases not 5, but for instance 8 users? Will Wingate decrease the speed for everyone evenly and provide connection for all (with 32kbps speed in this example)?!

If yes and Wingate will decrease the speed evenly for all, then it's even better to set the limit to 256kbps - to allow users use all available bandwidth, when there is free rest of it (for example, use all 256kbps when there is only 1 user online, 64kbps - when 4 users and 25kbps when all 10 users are online). This will be very similar to dynamic bandwidth control...

What can you say?

[logan]

Will Wingate decrease the speed for everyone evenly and provide connection for all (with 32kbps speed in this example)?!

WinGate doesn't do dynamic bandwidth restriction adjustments, so the answer is WinGate won't do anything. As for what will happen, that's anyones guess and really depends on what the connected clients are doing. If the clients are just browsing the internet, chances are noone will notice a difference. If a user starts doing something very bandwidth intensive and uses the entire 50kbps granted, the other users might notice a small but negligible slow down. If all the users start doing something bandwidth intensive, then 1 or more users will be unable to obtain the maximum amount of bandwidth granted. Noone will completely lose access to bandwidth though, but an even distribution of bandwidth is not gauranteed.

I'm starting to think that you may want to drop the notion of restricting your users bandwidth while there is such little bandwidth available. Instead, you may want to look into using straight prioritisation without bandwidth restriction as I believe you will get results closer to what you require without even messing with assigning bandwidth to clients.

Prioritisation enables WinGate to accept packets into seperate queues for each bandwidth rule created (hint: this means you need to create a seperate rule for each client computer). Instead of processing packets in a "first come first served" manner, WinGate will rotate around the packet queues to ensure that everyones queue is processed at a fair rate according the their priority level. Higher priority clients get more packets processed on their turn than lower priority clients. In your case, every rule will be on the same priority level. This won't restrict users from using the entire amount of bandwidth available for transmitting packets, but it will make sure that clients are unable to hog so much bandwidth that other users are left in the dark with relatively little bandwidth.

This won't result in perfectly even distribution of bandwidth across connected users like you are expecting though. What prioritisation will result in is a fair distribution of bandwidth relative to a) the amount of clients connecting through WinGate, and b) what the clients are actually doing on the internet.

[Alen]

Dear Logan, it is still unclear for me.
From one side you are saying Wingate will not do anything, but the same time you say: ... Oops, you changed your reply since I printed it. Ok, now I have the answer on the question I wanted to ask:

Sorry about that. Sometimes when I read my replies after posting them, I realise that they make no sense what-so-ever without prior understanding of WinGate.

what will happen if I set restriction of 256kbps while having only 256kbps of bandwidth?

Nothing would happen. This would be like having a 100km/h limiter on a car that will never drive on roads with a speed limit higher than 100km/h. The limiter would never be hit.

As I understand your post I will get something like dynamic distribution, but quite chaotic and uneven. But noone will totally loose connectivity and active users will be able to use as more bandwidth as less users is online at each time period!?
Is this correct?

That is correct.

Quite logical and good solution! As I undertsand, I am creating N prioritisation (N is the total quantity of our Internet users) rules all with the same level of priority and based on user PCs ips. As a result I am getting almost evenly and dynamically working distribution of all currently available bandwidth and the amount of bandwidth each user gets does not depend on the character of Internet usage (surfing, downloading, streaming media, etc.). Plus as a bonus, we will not need to change rules when we buy more bandwidth in future.
Is this correct?

Here's a diagram similar to the one I created for sawi above, except for your scenario. This will clarify how prioritisation can be configured.

alenbc.JPG (147.77 KiB) Viewed 29144 times

P.S. Two additional questions:

1. Does Wingate work ok with 3-rd party BC tools, like Bandwidth Control?

That's hard to say. I haven't tested any, but my instinct tells me that it won't be ideal. It's generally a bad idea to put other programs in the network stack before or after WinGate as this can effect performance. However, you are welcome to test the third party tools and report your findings to the forums.

2. Can Wingate differ http surfing from downloading files using http protocol? (Just curious)

WinGate 6 can't instinctively tell the difference between client activity being browsing or downloads, but it can tell what file type is being accessed so you can get a fair idea of whether something is internet browsing (HTML, ASP, PHP, GIF, JPG, CSS, etc) or downloads (ZIP, MSI, EXE, RAR, MP3, WMA, etc) from the file type.

In WinGate 7, it will be possible to perform policy decisions on the server response. This will make differing between browsing and downloads much simpler, since the content-type header of downloads is more often than not an octet-stream, where normal browsing is usually text and images.

[Alen]

Thank you logan, now it is clear to me.
(I am not installing Wingate yet, just planning and reading help file. 300 pages finished, still have almost 200, the question about BC was the most unclear for now. I think you should include a couple of typical examples, one of which was mine - distribute available bandwidth evenly among all active users...)

P.S. Why did you "kill" my post? ;-)

[Alen]

About this:
- what will happen if I set restriction of 256kbps while having only 256kbps of bandwidth?
- Nothing would happen. This would be like having a 100km/h limiter on a car that will never drive on roads with a speed limit higher than 100km/h. The limiter would never be hit.

I meant setting restriction of 256kbps for all users, while having only 256kbps of total bandwidth.
The variant with prioritisation is still the best, but I wonder: for the first variant you said noone will lose connectivity totally and bandwidth will be devided, not evenly but it will be - from one side (when several or many users are online) and the whole bandwidth will be granted to the only active user - from the other side. => The less is active users quantity the more bandwidth they get (not evenly, but it will work like "bad" dynamic BC).
Is this correct?

[logan]

P.S. Why did you "kill" my post? ;-)

That is slightly odd isn't it :-). It was 10:30 PM here when I made that post so I was probably on autopilot for the night.

I meant setting restriction of 256kbps for all users, while having only 256kbps of total bandwidth.

Acknowledged. This will still have no effect as the internet connections limit of 256kbps will take effect before WinGate's artificial limit needs to. So there is no reason to enforce an artificial limit using bandwidth control. This is why in the diagram above, the restriction has "Unrestricted - prioritisation only" checked.

The variant with prioritisation is still the best, but I wonder: for the first variant you said noone will lose connectivity totally and bandwidth will be devided, not evenly but it will be - from one side (when several or many users are online) and the whole bandwidth will be granted to the only active user - from the other side. => The less is active users quantity the more bandwidth they get (not evenly, but it will work like "bad" dynamic BC).
Is this correct?

yes, that is correct.

[Alen]

Dear logan, I have no more questions (for now).
Thank you very much, your help was really useful!

Best regards,
Alen

[Alen]

A couple of additional questions depending BC:
1. How to limit Wingate server speed, i.e. user Internet connection speed for 127.0.0.1? Just do the same for this address?
2. How can we monitor current\average clients connection speeds (summarized by all currently used services)?

[adrien]

Hi

You can't limit 127.0.0.1, since the packets for these virtual connections don't go down the stack to NDIS and our driver. WinGate can only limit packets that go out adapters.

[Alen]

So what is the answer?
I remind you, I want to limit Internet user who is accessing Internet from the Wingate server. (This not critical, just may be usefull. And Logan said it's possible).

More questions:
3. In BC rules properties General tab we have an option "Apply to traffic to/from the local machine", and in Source\Destination tab another one: "Rule is bidirectional". What is the difference between these two? And why it is not explained in the help?

4. Logan, why you did not check any option on general tab on the screenshots you made for me? ("Control TCP window", "Apply to induced traffic, "Apply to traffic to/from the local machine")


P.S. I beg you to look at Bandwidth Controller Enterprise trial. It's very convenient tool, I was able to create (bidirectional) bandwidth restrictions for all users (to dynamically and evenly distribute the whole available speed between all of my active Internet users in each moment, while guaranteeing them also minimal connection speeds).
In Wingate I have to create individual rules for all of my 20 users to be able to make available bandwidth to be (likely) evenly and (likely) dynamically distributed.
I want you to improve this (in 7-th version may be, but you have to do it!) ;-)

[adrien]

So what is the answer?
I remind you, I want to limit Internet user who is accessing Internet from the Wingate server. (This not critical, just may be usefull. And Logan said it's possible).

There's no way the local user on the WinGate machine can connect to WinGate over any interface other than the localhost one. Even if they connect to the proxy on the LAN IP, it will still be routed by the OS to the localhost adapter and not go to the driver for bandwidth control.

therefore the only connection that can be controlled would be the connection made by the proxy to the internet. You can certainly control this with bandwidth control, but any other users of the proxy would also be subject to this rule.

More questions:
3. In BC rules properties General tab we have an option "Apply to traffic to/from the local machine", and in Source\Destination tab another one: "Rule is bidirectional". What is the difference between these two? And why it is not explained in the help?

bidirectional means the rule will match packets going both ways in a connection. E.g. would match a SYN packet and also a SYN-ACK packet (which swaps the IPs and ports).

When a connection is made, the initial packet (SYN packet for TCP) is checked against the rules, and if it matches, the rule is associated with the connection entry. We don't check for a rule each packet, only once when we set up the connection entry. So, bi-directionality is only really useful for if you want to apply the same rule to outbound HTTP vs inbound (e.g. hosting a www server as well).

Apply traffic to/from local machine just indicates whether the traffic to / from the local machine will be controlled.

4. Logan, why you did not check any option on general tab on the screenshots you made for me? ("Control TCP window", "Apply to induced traffic, "Apply to traffic to/from the local machine")


P.S. I beg you to look at Bandwidth Controller Enterprise trial. It's very convenient tool, I was able to create (bidirectional) bandwidth restrictions for all users (to dynamically and evenly distribute the whole available speed between all of my active Internet users in each moment, while guaranteeing them also minimal connection speeds).
In Wingate I have to create individual rules for all of my 20 users to be able to make available bandwidth to be (likely) evenly and (likely) dynamically distributed.
I want you to improve this (in 7-th version may be, but you have to do it!) ;-)

We have a few customers using both products actually. I've used it myself. We have a few ideas about improving bandwidth control.

[Alen]

There's no way the local user on the WinGate machine can connect to WinGate over any interface other than the localhost one. Even if they connect to the proxy on the LAN IP, it will still be routed by the OS to the localhost adapter and not go to the driver for bandwidth control.
therefore the only connection that can be controlled would be the connection made by the proxy to the internet. You can certainly control this with bandwidth control, but any other users of the proxy would also be subject to this rule.

Bandwidth control rules don't apply to the local machine that WinGate is installed on by default. This is an optional behaviour that must be enabled.

!?

Apply traffic to/from local machine just indicates whether the traffic to / from the local machine will be controlled.

Is this what I need for limiting both clients download and upload speed?

If yes does it limit download from Internet \ upload to Internet speed or it works for the client PC 2 Wingate "local" traffic? (Both will have the same effect on the client Internet connection speed, but the latter is worse, as it limits also all LAN traffic between Wingate and client PC)

[Alen]

Report: my settings (recommended by Logan) did not work as was expected (distribute available bandwidth evenly to all active users), so I had to add speed limit to my restriction, to prevent anyone to catch more bandwidth, than he should...

[Alen]

Friends,

Even after setting restrictions on speed in the BC restrictions I can see sometimes download speed is more than restriction and the whole rented bandwidth is occupied by one download (done from the client PC)!?

Particular example: I have 80kbit/sec restriction used for all users and I am downloading a file using DAP download manager and seeing the download speed is constantly higher than 12KB/sec ~ 100kbit/sec.
Why so and what to do to make restrictions to work all the time and for all types of traffic?

P.S.
Could this be because of drip-feed option is enabled and BC somehow doesn't cover it?

[logan]

How are the clients connecting through the WWW Proxy? By manual proxy setting in the client, or by transparent intercept? BC can only effect traffic that traverses the ENS driver, so only traffic that is transparently intercepted from NAT in the WWW Proxy will have BC applied. Clients that connect directly to the proxy using their browsers proxy settings will bypass NAT and subsequently BC.

[Alen]

How are the clients connecting through the WWW Proxy? By manual proxy setting in the client, or by transparent intercept?

Through web proxy directly assigned in their browsers. NAT connection have only a few users who can't work without it (they are using non-standard applications).
Download is made using managers and also via web proxies.

BC can only effect traffic that traverses the ENS driver, so only traffic that is transparently intercepted from NAT in the WWW Proxy will have BC applied. Clients that connect directly to the proxy using their browsers proxy settings will bypass NAT and subsequently BC.

Oh-h, damn.

What we have:
1. use proxy if you want maximum control and want to use antivirus and other plugins, but you will not be able to use bandwidth control,
2. use NAT to have BC, but you will not be able to use plugins and make total control of users activity.

The third is NAT + Transparent proxy + ENS policy for only used proxies ports allowed (e.g., 80, 443, 110, 25, 21), which will provide everything, but you will get a huge and unreadable logs because clients PCs will try to send to Internet everything, e.g. DNS requests, broadcasts, etc. (as Wingate PC will be their default gateway).
I don't like this variant, because we are constantly analyzing logs (directly and via IAM for Wingate).
I want the first one. :-)

What can be done to limit bandwidth for the clients using pure Proxy services?
Do you plan to separate BC function and spread its restrictions onto all types of traffic? (I suppose, the answer will be "No, as you can restrict all types of traffic by TR" :-( ).

[logan]

I can't really comment on this as I'm not a developer, but the current BC implementation works on the packet level, not the application (proxy) level. This is favorable as it's more generic and can apply to all manner of connection types instead of just a particular protocol with a supporting proxy (e.g. HTTP or FTP). I imagine that to have BC in the proxy without using NAT+TR would require writing an entire BC system specifically for the proxy and secondary to the ENS BC. As you mentioned, this would involve a lot of work which would only duplicate functionality that is already provided by ENS. But again, this query is about the inner workings of WinGate and I'm not in the best position to provide any conclusive information.

[Alen]

I imagine that to have BC in the proxy without using NAT+TR would require writing an entire BC system specifically for the proxy and secondary to the ENS BC.

Why, Logan?
All traffic is send from\to client PC ip, so restrictions could be applied (and this will be fairly) to the whole traffic addressed to\from the client ip. For example, provide that in average during each 5 seconds the ip can send\receive X KB of data. That's all.

P.S. Can Bandwidth Controller help here?

[adrien]

it's true that the bandwidth control takes place in the driver which only has access to the packets.

But it does have access to the packets travelling between the WinGate computer and any other computer, e.g. a client computer and a proxy, or the proxy and the internet. So it can be used to control bandwidth for proxy traffic, intercepted traffic, or traffic from the WinGate computer to any other computer. The exception is localhost traffic, which doesn't go down to the driver.

So yes, you can specify restrictions and rules relating to client traffic to WinGate.

[Alen]

So yes, you can specify restrictions and rules relating to client traffic to WinGate.

Well, so, what I have right now:
one restriction with speed limit and medium priority
one rule for the whole subnet: proto Any, dest Any, rule is bidirectional.

As I understand that's enough to just check the "Apply to traffic to/from the local Machine" option checkbox to provide the rule to work for any type of Internet connections (in fact it will be done at the client-Wingate level, not Internet requests servicing by Wingate level). Is this correct or I need to create new rules\restrictions?

As I understand the drawback of the method is: when I'll need to copy some files to\from Wingate machine from the network PC the operation speed will also be limited!? Is this correct?


And the second question:
As you remember initially I created one restriction without speed limits and individual rules for each user's PC for the purpose: to provide the available bandwidth to be distributed ~evenly among all active at the moment users.
Later I mentioned one download can catch the whole bandwidth (and now I understand why - it was going through the proxy) and added speed limit to the restriction. Unfortunately I also deleted all individual rules and created one common rule for the whole subnetwork, as it is enough if you use speed limits.

Now, if the above mentioned problem is solved just by checking the checkbox, I'll prefer to go back to speed unlimited restriction (and create 20 individual rules one more time :-( ).
Will this work as expected? Under "expected" I mean the following: provide the available Internet bandwidth to be (likely) dynamically distributed ~evenly among all active at the moment users regardless of the users connection methods.