Why I Can’t Recommend PfSense To Fix Bufferbloat For Gamers

Bufferbloat, or the massive sudden ping spikes it causes in online games, is one of the biggest issues that gamers face.
There are ways to address the issue as I showed in previous videos • Gamer Setup - This rou... but these have limits.
To overcome those limits you need hardware which has more power and a software which transforms that hardware into a router.
PfSense seemed like the obvious choice (as some of you suggested in the past).
However while PfSense is a really powerful firewall and not that complex to setup, I just can't recommend it to gamers - and I will tell you why in this video.
► Support Battle(Non)Sense:
/ battlenonsense
► RTSS: www.guru3d.com...
► Previous video: • How To Fix Stutter In ...
► Next Video: • Battlefield The Issue ...
► Connect with me:
➜ FB: BattleNonSense
➜ twitter: BattleNonSense
➜ email: [e-mail]
► Outro Music:
Many of you asked for the name of the outro song. Sadly I have to tell you that it is not a "song". It is a custom made music to be used for intros/outros that I bought a while ago.
#Bufferbloat #PfSense #FQ_CoDel

[@Jax7787]

Pfsense now has a patch available via the netgate forums that finally FINALLY resolves the issues it has had with its UPNP implementation. The underlying issues were that MiniUpnp's implementation on BSD needed needed the ability to add the correct outbound NAT rules corresponding to the ports it used for inbound port forwards, as well as nat anchors to be implemented on the miniupnp nat rules so they are followed before other outbound nat rules. The patch was created too late to be included in the last release, but it will be in he next release, and can be manually installed. I have yet to test it, but it looks like this problem has actually been solved. *Edit. The UPNP Fix has been added to PfSense CE 2.7.0. Pfsense will finally work for gamers with multiple systems, just enable UPNP set and forget!

[@partlyawesome]

What was this patch? did it work? Please let me know!

[@oicmorez4129]

No one talking about 1:45 and 1:55? look at the ad and how it's sync up with the speed test

[@Monsieur2068]

For anyone seeing this now there is testing currently on a version of miniupnp to fix this, looks to be tested in pfsense 2.5.

[@araemo]

Why in the world do games require a specific source port? I understand the server needs one because the clients need to know what to connect to (though, server browsers/matchmaking systems could list/provide the port as well..). But it needs to track per-client state anyway, there's no good reason to require the clients to use a specific source port. Just grab a random ephemeral (49152-65535 on windows) port and go from there... Is there ANY good reason for a game that doesn't run a listen server requiring a specific port on the clients?

[@squid11160]

Fairly sure it's not a source port, but rather a listen port on the client. Some games offload server capabilities to one of the clients if a client has a port open (GTA Online, for example), and for that it makes sense. However if that's not the case, I'd say it's poor design. One might argue that offloading server capabilities to clients is also poor design because it allows for easier cheating.

[@oriwan3786]

Well I’m a gamer by heart and an IT network engineer by profession. I’m using pfsense since years. Yes pfsense is complex but it is pretty straight forward. I never had any problems to setup the configuration needed for a game. Running on a dedicated server with a 4x Intel NIC with LAGG interface to a managed switch. I never had any bottlenecks on my WAN link (1gb FTTH) . The problem is you need to have deep network knowledge and understanding to setup. Still if you want to have a free firewall pfsense is the best currently.

[@VonCarlsson]

The problem, if you will, is getting over that initial knowledge hurdle, and it's a rather steep hurdle. One that most people are simply not willing to put in the required effort in order to overcome. Not because they're stupid or lazy, but rather because it's very technical and unless that interests you in the first place it's going to be major pain in the ass. As such, I think the video's conclusion is correct: it's not recommended for the average user; not even if the population in question consist primarily out of gamers.

[@steveburgess23]

Agree with this 100% though I’m running pfsense 4.4 with just upnp enabled without a static Nat rule and have a network status of reported as “moderate” buy the consoles and have zero issues with latency spikes. Forwarding the ports manually to get an “open” status has no noticeable effect on latency. If the router has plenty of memory there shouldn’t be an issue with these types of latency spikes anyway.

[@hothardwarehive1526]

@@VonCarlsson Well for the average users, bufferbloat shouldn't be an issue either as it is almost imperceptible until you are having a lot going on your network (traffics, many users) and you have some high bandwidth to reach the Internet.

[@haydenw8691]

Sophos Home UTM is also free for home use. Only limitation is the 50 IP address limit. It is also even more locked down than pfsense in the initial configuration and the installer takes a bit of work to succeed with a USB stick.

[@hothardwarehive1526]

@@haydenw8691 I would strongly suggest to use Sophos XG Home Free Edition instead as the interface is much better and is a Next Generation firewall that can do anything (IDS, IPS, Anti-virus and more). The only drawback that kept me switching from pfSense to Sophos was their abyssmal IPSec speed. Both of their own hardware (low-end to mid-end at least) or the software version (Pro or home edition) don't use the AES capabilities of modern processor(Intel and AMD) for encryption and everything falls back on the main cpu(s) (the advertised speed by Sophos for VPN speed are not achievable even at the lowest security settings). In pfSense you just enable the use of the encryption capabilities (AES offload) and you're back at your full ISP speed.

[@JasonVanPatten]

I'm not terribly surprised by the troubles you ran into. pfSense is FreeBSD using the "pf" packet filter. I like pf a *LOT* from a firewall/protection/security perspective. It's highly flexible and configurable. But it defaults to "NO!!!!" Nothing about creating pf rules is simple and easy; while pfSense has made it a lot easier, it's still very much a manual process which will lean *more* towards security and *less* towards convenience.

[@RobinCawthorne]

It's easier to predefine the rules in a script or create it a config via the GUI and use it for a baseline in the future. pf and iptables are both unbelievably versatile!

[@JasonVanPatten]

Oh, I know. I've been using both for ... ever ... it seems. But the challenge Chris is/was trying to solve isn't really *easy* to do with pf. It *IS* doable, but not very simply. Again: it's aimed at security-over-convenience. much to the chagrin of some.

[@ddallmann1373]

pf is much easier to understand when compared to ip tables, if you don't have a tool to manage ip tables.

[@hothardwarehive1526]

The problem is using UPnP which no one should really use if they care about network security. pfsense since 2.4.4 has addressed this issue and you can set it up properly (see my reply above).

[@CMDRSweeper]

Same here actually, I am operating PFSense on my network, granted since it is just me I haven't seen these issues appear myself. However, I am not a strict gamer, I run my own VPN to gain access to my network, I have VLAN setups to split networks, and I have servers running that needs outside access from time to time. Stuff I have learned to set up correctly, but yes, PFSense defaults to no rather than yes, so you often have to figure out what it is denying and then figure out how to say yes in the most secure way.

[@kanarie]

If you want to shape 500+Mbit (I've tested up to 750Mbit), get a router based on fast ARM chips and OpenWRT compatibility. E.g. Linksys WRT1900ACS or Linksys WRT32X. Flash to OpenWRT, set up SQM and use the "cake" traffic shaper to get perfect fairness of bandwidth as well as bufferbloat mitigation.

[@AI-EXREYFOX]

With openwrt ver. you use and on what device.

[@Djhg2000]

So what would the advantage be with UPnP as opposed to NAT hole punching? The latter allows for direct UDP packets between clients and doesn't require the horrible mess of UPnP, in addition to requiring zero manual configuration. Apparently some games already use this.

[@nimeq]

The distinction is upnp doesn't require an outside server to open the connection ports. UPNP is fully reliable in the sense it will forward the port to the client, NAT hole punching is dependent on the router to accept the connection establishment between unknown remotes. Also neither of these provide any authenticity to the connection, they're just methods to make a connection over two clients that aren't directly connected to the internet.

[@Djhg2000]

@@nimeq > The distinction is upnp doesn't require an outside server to open the connection ports. UPNP is fully reliable in the sense it will forward the port to the client, NAT hole punching is dependent on the router to accept the connection establishment between unknown remotes. But they both require an external node for coordination of connections. NAT hole punching doesn't add much to the process of establishing connections and pretty much all but the extremely paranoid routers allow creating UDP connections. In one of the NAT hole punching strategies you essentially assert that there is a UDP "server" at the endpoint and send packets until the router figures out that the packages it's getting on the outgoing port are related. It can be blocked in theory but distinguishing between NAT hole punching and bulk data on a side channel is in practice, without deep packet inspection, literally impossible half of the time because you look like a UDP "client" initiating a connection. The only way you'd detect is to store a table of dropped invalid packets and cross reference them with every subsequent packet, resulting in first of all a massive table and then something like O(n) overhead for each packet. > Also neither of these provide any authenticity to the connection, they're just methods to make a connection over two clients that aren't directly connected to the internet. I'm a little confused by this statement. Authenticity is well outside the scope of both implementations, so I don't see why you're bringing that up?

[@nimeq]

@@Djhg2000 You're right, I have no idea what was thinking, I guess I've been working too long on STUN (Which has a different purpose). UPNP allows you to run a classic server, as opposed to having to use p2p connection establishment strategies. Not that it's really that important for your triple-A games these days, since you can't run your own server anyway. Not that you can't also just edit the firewall rules for it.

[@Felix-ve9hs]

I first used OPNsense (pfSense Fork) to use FQ_CoDel but needed weeks to research and tweak it, but with the Ubiquiti EdgeRouterX i needed 5 minutes to set up the Smart Queue. It works just as fine as my OPNsense Router, but has way fewer features and you can't use Custom Hardware

[@solidus1983]

This is why i use OpenWRT with Cake SQM, however you could check the kernel log to see if nf_conntracks is working which is part of UPnP, if it doesn't it will show an error like "nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead."

[@StephenSalter]

Is there an updated video on this new firewall, what is it called?

[@mmmcrispyful]

I have been using pfSense for over 5 years now. I'm using it right now. We have two PS4's and two gaming PCs. I have never encountered an issue with getting the systems to play on the same game simultaneously. We play Fortnite Battle Royale with all systems since it supports cross-platform play, and we play a lot of The Division 2 on PC. No issues playing together. The simplest fix for the "Strict" issue that all games report with pfSense is to enable Hybrid Outbound NAT and add the Host PCs or consoles (eg. 10.0.1.15/32). No need to port forward or create any inbound rules. Outbound rules for each host and UPnP is all you need for the strict issue. The only issue with these settings that I have experienced is voice chat in The Division 2 does not work when set to Hybrid Outbound NAT, setting it to Automatic Outbound NAT fixes the issue. If you're having issues with multiple hosts and if you haven't already tried it, I recommend enabling NAT reflection mode's Pure NAT (System -> Advanced Firewall & NAT). As for reducing or eliminating buffer bloat using pfSense, well, that is a ripe PITA. I have tried multiple times before version 2.4.4 to get this working effectively, I have given up many times. Since it's been made a lot easier with 2.4.4, I will test it out and see how it works.

[@kirk1240]

I use pfsense with FQ_CODEL on an Intel NUC8I7HNK. Even with 1gbit the processor sits on single digit load %. You need to set up the queue and port forwarding (use hybrid NAT), but once its done, it works.

[@bobhumplick4213]

openwrt can be made to work on x86 pc's but takes some work. usually if you have a decent router and a gigabit connection you can just enable sqm on the upload side and disable it on the download. most of the bottleneck will be on the upload side anyway with such big connection. but if you install openwrt on a pc you can have sqm on ANY size connection you want. a 50 dollar dell optiplex with a 3rd gen i7 will be more than enough

[@D6isD6]

As there was no mention of it, I'm curious if you were aware of/attempted using the "+clientport XXXXX" launch command during your testing for Apex Legends.

[@NightKev]

Even if that worked, it doesn't solve the whole "set-up once and forget" solution that he wanted to present.

[@loztagain8278]

@@NightKev I'm so confused. I'm a network engineer. I have 3 gamers in my house. All behind pfsense, with way more complicated things going on than the install in this video, and I've never seen anything like being described. Play a fair bit of overwatch myself, with housemates. Never had to turn on upnp, or forward any ports for anyone. Part of me wonders if the whole worrying about what nat version it says you have might not actually be causing any problems with mentioning? I dunno... V.confused.

[@DavidGoettler]

I agree. I spent weeks troubleshooting only to realize this cannot be done. I caved and bought a USG to use a smart queue.

[@d3nswiper]

Great vid as always Chris. I think an up-to-date video-explanation from you in regards to "all things network" or something like "setting up your PC network for gaming" would be hugely popular. I know you already covered leatrix and all other things, but as I said just having everything in one video from basic windows configuration to router QoS would be absolutely awesome.

[@jeffm2787]

If you use an OpenWRT system to pass traffic to the PFSense box via a transparent bridge using Cake the results are great. At that point however you might as well just run OpenWRT (LEDE). I just gave up with my SG-3100 in Favor of a Ubiquiti USG as I found the response is much much better. I may build another transparent bridge and use Cake, always trying to balance that 24/7 power usage with what I want.

[@TurboSpeedWiFi]

Ubiquiti is so much better than OpenWRT! OpenWRT is essentially a toy.

[@jeffm2787]

@@TurboSpeedWiFi Actually when it comes to routing I think OpenWRT might have an edge. Ubiquiti routing and firewall abilities is a total joke. I do really like Unifi AP's and use them. I'll stick with PFSense combined with Unifi AP's..

[@TurboSpeedWiFi]

@@jeffm2787 The Ubiquiti Edgerouter series is not a joke at all. I do not use Unifi for routers. I also like pfSense a lot. OpenWRT just feels too amateur and unpolished to me.

[@IridiumGaming]

CAKE is a more effective algorithm that is available on OpenWRT

[@marciets1752]

Also for EdgeOs from ubiquity

[@BattleNonSense]

@@marciets1752 Well CAKE is still not finished yet (at least last time I checked the mailing list). The implementation in EdgeOS is also not something that I'd dare to show in a video yet. I really hope that UBNT will add it directly to EdgeOS though - more options are always great! I'd also like to see FQ_PIE there.

[@kanarie]

@@BattleNonSense it's part of the Linux kernel now (mainlined). So it's "finished" but also still getting small improvements.

[@misdierekt928]

@@kanarie Using Cake myself, Works Wonders on a 20mbps Fiber line running openwrt on a Mikrotik 951 Routerboard

[@jamesoxford4260]

@@misdierekt928 isn't mikrotik fantastic? it's got huge performance for little price. I've got an RB3011 with a dual core ARM. At 200Mbps it runs at like 3-5% cpu usage with 30-40 rules on the firewall...

[@swmike]

I run OpenWRT on WRT1200AC which provides enough throughput to do ~500 megabit/s using CAKE / FQ_CODEL (I personally use this on a 250/100 megabit/s connection and I am not even close to running the CPU full). If you install OpenWRT on the same PC hardware that you installed pfSense on you should be able to easily get full gig forwarding speed, with same UPNP etc support, and enable SQM to fix bufferbloat. You install basic OpenWRT and then you add the sqm_scripts package and the equivalent luci package, and then you can configure this from LUCI, quite easily. openwrt.org/docs/guide-user/network/traffic-shaping/sqm

[@SgtRock4445]

I'm going to give this a try on my 1900acs I have laying around. Thanks.

[@yukiseekyo]

PFSense is one of those Firewall Distro that go by security first and not supposed to be a one click solution to do everything but one you get it work then its a match made in heaven, untangle is the best one for gaming since it uses linux and apparently the BSD networking stack is a lot more strict on what it allows, comparing to linux that is more lax and most consumer routers uses the linux kernel as the back bone of the os.

[@yukiseekyo]

Plus it supports geoblocking which is good i guess

[@_unknown_guy]

@Battle(non)sense maybe reach out to Level1Techs. Wendel did a video on pfsense a while ago so doing a refresh on that with your use case in mind might would be a cool collab video.

[@thinj825]

As someone having to constantly reboot a router ever since I turned on its prioritization features, this is of interest to me. I already have three PC's in the house and one is positioned perfectly to function as the router for the house, this video was very nicely timed. As a newbie to all this, you've at the very least saved me from messing with PfSense. My brother moved in with me, I have two gaming PC's and multiple other devices and I need them all to work with a relative minimum of hassle. Looking forward to the video about whatever thing it is that's working better for you!

[@devidby0]

Had this issue with R6 Siege. I have 3 OpenVPN clients on my PFSense so I route each computer over a separate OpenVPN which allows me to have up to 4 devices playing together online. If you forget to enable you have to exit the game and reset states. Not a set and forget by any means but it does work. So far is the only issue I have had with PFsense over the years of using it.

[@permissionBRICK]

I finally managed to fix this. Apparently there is now a patch for the problem of UPNP not being able to switch ports, if the port is already in use, which claims you shouldnt need static port mapping anymore, which will be rolled out in the release after 2.4.0, but is available as a manual patch now. Also I had a separate issue, where upnp would just refuse to open my nat on pfsense, even though it seemed to be working, and it turned out I had not one but two other separate routers in my network which were running in wifi client mode, however were still running upnp server, since apparently you need to disable this separately, and the games tried to forward ports on these routers instead of my pfsense.

[@JagHiroshi]

Getting PFSense to work with the PS4 for NAT is a pain. I needed to work hard and to set up hybrid outbound NAT with static ports (all things you've tried) but it appears to work for me now. Setting up FQ-CoDel was a complete ball ache - but it did work eventually and bufferbloat was fixed. PfSense running on a VM after my EdgeRouter melted.

[@brandonbursley]

How does this product compare with something like the Netduma? I wanna use the edge router mainly because it seems to be way better than a Netduma would ever be, with the exception that it does not have geofiltering :(

[@TheBekker_]

What is the alternative firewall you are testing now?

[@hule8899]

maybe Sophos? Its limited just by RAM amount for home use.

[@Zeratuhl]

Don't create manual rules for a specific game. Flip the NAT rule mode to manual and change the default outbound LAN-wide rules for the complete *-* (-500) port range to not use randomization with the "static port" checkbox. Works in Warframe and will enable multiple clients to play simultaneously.

[@ectotrix7399]

Hello, i'm gonna test that but i don't understand how is it different from what he did. I think he did 1 rule for each host with the "static port" checkbox.

[@luk4aaaa]

I always enjoy watching your videos to the end cuz that outro is so gooood

[@BattleNonSense]

*PFSENSE FINALLY FIXED THIS UPNP ISSUE!* / _(fix not included in current PfSense release as of 2022.06.29)_ forum.netgate.com/topic/169837/upnp-fix-for-multiple-clients-consoles-playing-the-same-game ------------------------ Bufferbloat Test: www.dslreports.com/speedtest EdgeRouter Setup Tutorial: kzbin.info/www/bejne/pV7KY4Nph51nmtk

[@ThineHolyBacon]

So I opened this video has I hadn't really heard about Bufferbloat, but I do use pfSense as my home firewall. I can't comment on the issues of NAT, as my setup does not have two gaming computers, I can say that FQ_CoDel does work very well on pfSense, and I went from a C to A rating after adjusting it :)

[@darkpsion]

There is absolutely no need to forward ports nore enable upnp for any game with a server on the internet. The only way you would ever need to do this is if you are hosting the server or the game uses some weird peer to peer server but this is far and few between. Your router uses PAT and is a one to one connection to the server out on the internet thus another computer on your network will also connect to the same server successfully. The source port is generated randomly ensuring the connection returns to the correct source pc.

[@aldaverj5780]

I’ve used pfSense for 3 years now I haven’t experienced such ping spikes or strict NAT on my games with my firewall I suggest use 2.3.5 release. I run a wisp too ping spikes or Apex dc’s are not a problem for me (sorry for my bad english)

[@aldaverj5780]

Try the older firmware

[@shimme01]

I am absolutely excited for the next video on bufferbloat control. My last two routers (Netgear R7800 and ER-X) have been inspired by your content and I use them in tandem for my current setup with the netgear acting as an AP. I lose about 30Mbps (180 to 150) off my package with QoS enabled, but its good enough for now. I tried OpenWrt on my R7800, but it was not using all the cores for QoS so I think I got around 100Mbps from it.

[@Crashnite]

Damn you explain everything perfectly

[@kwinzman]

Edgerouter Pro is still affordable for home use. What is the SmartQueue limit of Edgerouter Pro?

[@marciets1752]

I have the edgerouter 4. About the same as the Pro. I have 360/36 setup in Smartqos. Get 300/30 with these settings

[@kanarie]

200-ish. The ER-Pro is based on an old chip (ER-Lite/USG too), so you'll get better performance with the ER4. Currently shaping 300+170Mbit with "cake" on the ER4, but that's a load balanced connection so it can use a CPU for each line.

[@kwinzman]

I am lucky to just get a new 1000 Mbit Down / 50 Mbit Up connection. Can anybody recommend a smart queue router that can handle this?

[@kanarie]

You'll have to build it yourself probably, because shaping that kind of speed requires something fast like x86. Not even the dual core 1.8Ghz Linksys WRT32X has enough CPU power to shape 1 gbit.

[@alexfooify]

Hi Chris! Have you looked anything at QUIC (protocol for HTTP/3)? Will that help gaming in any way?

[@kwinzman]

No. How do you even think of that?

[@faxxe71]

I solved my issues with Mikrotik.... cheap & reliable....Gruß aus Graz

[@a36538]

Mikrotik had malware embedded in their firmware

[@faith_healer]

@@a36538 prove your words, or the malware is in your head.

[@darkpsion]

@@a36538 no it had vulnerability on a old version that was patched out long before the botnet started using it, people were on old versions not updating firmware....get your facts straight before you make your self look bad

[@_unknown_guy]

@@darkpsion Mikrotik even has auto update so just turning that on will make you always be on latest version. Other routers rarely have auto updates and rarely anyone does manual updates.

[@445Matty]

​@@_unknown_guy Yes and MikroTik has no problem to talk about it. The company addresses vulnerabilities fast comparing to Cisco, Juniper etc.

[@ccotunai]

This flew a bit over my head. Fortunately, I don't really play multiplayer games, so ping and latency are not that important now.

[@rv112xy]

I use Traffic Shaper on pfSense and Bufferbloat is very good with it on a Multi WAN 450 MBit/s connection. Of course it runs on a i7 CPU. pfSense is doing nothing by it's own and that's good and what you want! You have to allow everything you want and setup correct. I don't know what you did there wrong, but I never used UPnP or NAT-PMP. It's also not recommenced. You should not forward any port for a game. I have multiple clients running the same game on the network and everything runs fine.

[@fusedOG]

The games will run fine but certain functions will not work depending on the game. If you have a strict NAT in Black Ops 4, you cannot invite players on the Internet to your party for example. However, you can still play the game just fine and even be invited by other players their party. My experience with pfsense is identical to what Chris ran into in this video. I.e, requiring static port outbound NAT to get past Strict NAT in games, as well as multiple players on the LAN having issues playing once this option is enabled. Also, I didn't use UPnP at all due to security concerns. I wish more games did UDP hole punching like Overwatch does. That game is flawless.

[@rv112xy]

@@fusedOG I've never seen strict NAT or something similar. Can you tell me a game beside BO4 to test with? I only use static port for VoIP.

[@ianjameslake]

A simple solution for windows machines is to run NetLimiter. It can limit programs upload and download speeds (or the whole connection). This allows you to play games, while doing a download/upload. You just set the upload/download speed to 80-90% (or so) of it's maximum speeds. You can also get routers that can set limits per machine. Search for bandwidth throttling.

[@BattleNonSense]

While you can be somewhat successful with bandwidth throttling (I'm using Netlimiter a lot as you can see in my Netcode analysis videos), it quickly starts to show its limits as soon as you have 3+ users on your network using the internet at the same time.

[@ianjameslake]

@@BattleNonSense Yeah, the only way to make that work is for everyone to run netlimiter, or run a router that limits them. Which as you indicate doesn't work great with a 3+ people, as limiting them to 1/3rd the bandwidth each, doesn't suit most households.

[@bioresadent]

Hi. Why don't you try openwrt on an x86 machine? Works absolutely fine and it has fqcodel as well as fqcake!

[@BattleNonSense]

I as not aware that you can run it on x86 CPU's. since when is that a thing? :O I might try that, thanks!

[@bioresadent]

@@BattleNonSense I don't know for how long it has been supported, but I've been using it for a while as my home router with an Intel g3258 cpu and had no problems at all. I dropped it due to being overkill for my internet bandwidth but it got the job done just fine :) glad I helped.

[@leexgx]

@@BattleNonSense needs to have cpu support AES-NI or it not work (any low end i5 will blow away any edge routers included cpus) Interesting you had issues with upnp maybe the NAT settings needed changing or they fixed something to make it more secure but broke upnp, the problem with a lot of these router software people tend to be Linux programmers and don't really like UPnP and lock it down to the point it brakes stuff (or it's NAT setting that's making the issue) I use an Asus router running asuswrt-merlin that does seem to support a lot of options and most of them in hardware acceleration still also as you have some pretty powerful if not expensive routers that have full support for Asus Merlin because asus has the Source Code open (most of the settings keep it hardware acceleration on)

[@bioresadent]

@@leexgx what do you say doesn't work? I had openwrt with sqm running in a Pentium haswell machine, which doesn't have aes ni and as I said it worked flawlessly.

[@leexgx]

@@bioresadent I just seen it was openwrt in the post (pfsense is the one that requires it)

[@emanuelpersson3168]

I have been using pfSense for more then 10 years. I first noticed this when i started playing Destiny 2. I really hope there will be a much easier way to get this to work. Great video as always Chris! :)

[@rkaaaaaaaa]

What is the name of that other Firewall PLS :) Dont leave us like this :)

[@Felix-ve9hs]

same :^)

[@N0N0111]

Well you have to come back for the next video.

[@yukiseekyo]

@@N0N0111 Its Most Likely Untangle

[@constantino185]

might it be openwrt?

[@X_B0LT]

hi, what program u said u testing and not have the problems u find on pfsense? i not have router just an old cable modem

[@Jax7787]

It looks like he went with Untangle. I might have been one of the posts on the netgate forums that he saw lol. I tried to make PFsense work in 2016, and had a back and forth with one of the long time members there. I am sad to report that while there has been some progress (there is a test build of miniupnp that "hopes to allow pf to implement upnp in the linux masquerade style") it is still an issue. At the time, my roommates forced me to give up and go back to our netgear that they could live with! honestly I should have gotten an edgerouter. Untangle was free once upon a time, but not any more. I would love to try OpenWrt, maybe it doesn't have these issues.

[@baumstamp5989]

Of course you can do it with pfSense or OPNSense. If your only goal is to reduce bufferbloat , you would make the firewall part transparent to the network (allow all rule) and only use the congestion algo from the traffic shaper.

[@jamescater66]

Thanks for sharing the dslreports site with the buffer bloat test. I can improve my buffer bloat rating from C to A by enabling QoS on my Netgear router and reducing the download speed by 45% (350 => 200 Mbps). This reduces peak throughput of course, however fixing the ping spikes in game is priceless so worth the hit IMO

[@pitspeedtv]

can i assume that you have tried setting up an IP or Alias NAT forwarding rule (bi-directional) and it failed?

[@BattousaiHBr]

hey chris! just contacted you via e-mail to get this to work with RouterOS on x86 without the need of enabling UPnP. just tried it out and it worked pretty well.

[@IsaacRhodes]

can you elaborate or is that too in depth for a KZbin comment?

[@BattousaiHBr]

@@IsaacRhodes mikrotik has several queuing algorithms, one of which is SFQ. it's an old one and doesn't work quite as well as the one in this video or CAKE, but does what it is advertised to do. literally just had to create a simple queue using the SFQ algorithm and limiting the bandwidth a bit lower than what my ISP can deliver so that it is the one doing the throttling rather than my ISP. it made downloading videos or files or updates much more responsive, latency fluctuates a lot less, but is basically ineffective if it involves flows to too many different sources (like torrents).

[@IsaacRhodes]

@@BattousaiHBr ah, I understand now. I was thinking you meant there was an alternative to using upnp sorry.

[@BattousaiHBr]

@@IsaacRhodes that's right, SFQ does not require UPnP.

[@IsaacRhodes]

As in, SQF doesn't require Upnp to work, or SQF opens ports so you don't need Upnp?

[@NinjaContravaniaManX]

Hello Chris, great video again! I've been trying to fix this problem for a long time. I have a 200 Mbit/s cable connection (Vodafon Germany) and when running the speedtest, I immediately get bufferbloat over 1000ms. Online gaming sucks on this connection but it's the best i can get here. I have a FritzBox 6490 which only has rudimentry settings for traffic shaping and is maintained by the provider, so i don't know if I can use custom firmwares. I don't have much experience with those features. Any advice you can give?

[@kayonex-2461]

I used to have a cable ISP line in the past as well. I had quite a lot of issues running games on that line due to packet loss and high jitter. I had used a Fritzbox 6430 as modem/router/gateway. Prioritizing ports didn't work for me either. Changing to another ISP with VDSL2 was the one and only solution for me.

[@NinjaContravaniaManX]

@@kayonex-2461 Yeah i was afraid of that, unfortunately, the only alternative in my area is DSL 16K, so it's pick your poison...

[@Externalzz]

Gotta admit my pfsense box likes getting fussy on certain games with upnp, but i read the title as pfsense with codelq not working? But your problems were with UPNP?

[@eXiiFTW]

is there a fix for fritzbox?

[@FlorisApon]

Put it in bridged mode, and add your own router to it (with ddwrt software, or openwrt. Or perhaps one of those routers from the other video)

[@dominikp.606]

Fritz!Box bietet Filter regeln. Dort musst du dann aber die Ports händisch als Echtzeitanwendung eingeben.

[@DerpyNoodIe]

So…. What’s the firewall software your using now? I’m currently using Pfsense but it definitely causes issues for some games I play with my friends that includes strict NAT or outright not allowing us to play at all.

[@h4X0r99221]

has this issue been resolved inn the meanwhile?

[@jebbyy32]

I am happy to report that yes it has

[@h4X0r99221]

@@jebbyy32 Thanks for the feedback!

[@LongTimeAgoNL]

Hi Battle(non)Sense, Due to your BufferBloat video last year I decided to do a bit of digging as I also suffer from that issue. However... I bought a 'probable' solution and I'm not sure if it will work, but according to some users it should be better. Due to me being in the Netherlands and having Ziggo as a provider I am 'locked' to a router. I need to have the router/modem combination in my network, that only hosts 4 ports. This thing is so poorly optimized for anything other than streaming and TV signals, your gaming connection can vary from very low pings, to massive spikes that the game does not register immediately as they are really short, only when a user starts to watch netflix or when a device starts to download a massive update or sync its files. But I bought the NetGear Nighthawk S8000 and will connect all my wired deviced to this thing as it has QoS and other "pro gaming" network features. Is it possible you can test these so called "Gaming Switches" that have QoS to enhance gaming network performance?

[@BattleNonSense]

Sadly QoS as sprovided in most consumer hardware is garbage, especially when it comes to switches.

[@MikaelKKarlsson]

Fortunately there has been more consumer routers coming out with actually working QoS features over that last year. I waited for Ubiquity to come out with something semi-consumer that wasn't built upon an ancient processor, but grew tired and gave the TP-LINK Archer C2300 a shot. Very fast and excellent latency under load. Sure the config isn't too sexy, but home routers don't need that. It even works out of the box, though that's almost frowned upon by some people.

[@slyya]

Can't wait for your next video showcasing the final solution :D

[@reallydontlikethem]

🇩🇪🇩🇪🇩🇪🇩🇪🇩🇪🇩🇪🇩🇪

[@misdierekt928]

What I Did was took my Old Mikrotik 951 Routerboard and flashed it with a build of LuCI openwrt, Then used the Cake option on the SQM QOS, I Highly reccomend a video on taking a cheap Mikrotik routerboard and Installing openwrt.

[@HappyBeezerStudios]

How many of these "solutions" work on a EuroDOCSIS cable connection? And will they be effective behind the router provided by the ISP?

[@sermerlin1]

I just did this DSLreports speedtest and i got A+ on bufferbloat without smart queue... What gives? Why am i immune to this bufferbloat? (speed is at 400mbit down / 200 mbit up)

[@dabsmasher1227]

Keep up all your good work mate. Appreciate your insight

[@635574]

Warframes famous problem with strict NAT detected, I clicked fast.

[@luk4aaaa]

Not only are you techsmart but you’re pretty good at aiming as well

[@logerer5633]

I'm not sure right now but I think D4veZ3r is his son

[@MarikHavair]

The perfect man. ;)

[@zx6guy]

How does CoDol and AQM relate? I ask becuase apparently my modem has AQM but it sounds like BB occurs at the router.

[@Supermarine0Spitfire]

It's a shame because I have issues with buffer bloat. I was thinking about building a pfsense router for this, but I have to share my connection and I don't feel like configuring pfsense for multiple connections for multiple games. I hope you can find an alternative as my networking knowledge is limited. Great content btw.

[@Enochrewt]

Wow, this issues has essentially been my last year of tinkering with pfsense 2.4.2-2.4.4 on a protecli firewall. Even after I sorted the strict NAT on two Xboxes, I had massive bufferbloat issues to work through and fix with FQCODEL. Finally I have it all working, but like the video said at a small bandwidth loss. Apparently I could tweak bucketsize but I'm going to accept the bandwidth hit for now. I'de for pfsense to address this, I like it a lot otherwise.

[@Skanic]

Does the Edge router also work with a 4G modem/router?

[@Ristogod]

I was going to build a pfsense router with some old hardware until I saw this. Now not so sure. I have a ER-4 today on a 400Mbps connection, but was hoping to go to a 1Gbps fiber option in the fall. What would be a good replacement for the ER-4?

[@ltonchis1245]

OPNsense is the alternative and I think someone mentioned about a package for better qos of gaming

[@Excellence308]

my network has been fucked with bufferbloat issues for the past week. Hopefully this vid will help

[@jasongaunt]

Jesus @ Battle(non)sense this video (and yourself) came out of the blue from a KZbin recommendation and you really hit the nail on the head. I've used pfSense in SOHO environments without issues for years and thought I'd use it at home as my Draytek Vigor simply cannot cope with anything more with 220 mbit, I tried for 3 days to get the latest stable build of pfSense to work and had exactly the same issues with multiple xbox and Warframe. To make matters worse, Warframe on xbox does NOT let you change the ports it uses, only enable IPv6 for chat :( I believe the problem seems to be a poor (or buggy) implementation of UPnP IGDv1 with "miniupnpd". You can trick pfSense into mostly working by enabling PureNAT and restricting what addresses each device can grab through UPnP by adding an allow rule under UPnP settings, and then limiting one of the consoles to static port (leaving the other defaulting to dynamic), however even though we could play two games separately we could not join the same session. To make matters worse, when a party invite was sent, the sender received an invite back to themselves, weird :) I've abandoned pfSense for now and will be trying OpenWRT on x86/64 but I fear as it also uses miniupnpd it may suffer from the same problem. The only difference is OpenWRT is Linux kernel based whereas pfSense is FreeBSD based. For now, you've got a new subscriber, keep up the good work :)

[@darealrulezbreaker9493]

weird, on dslreports.com it shows me 200+ ms of bufferbloat on upload and like 100-150ms on download, but ingame my ping is a constant 30-40 ms. how?

[@BattleNonSense]

dslreports shows you what happens to your ping if someone maxes out your up/download bandwitdh while you are gaming. simply launch a game, ALT TAB out of the game, upload a big file to onedrive/dropbox/etc., go back into your game and watch your ping go past 200ms

[@darealrulezbreaker9493]

Battle(non)sense ahh, now i understand. Yeah i remember many occasions when someone in my family made my ping go to the moon by downloading or uploading something.. so it checks out. Thanks for the explanation.

[@FractalHalia]

Its awesome seeing dave show up on the issue. Chris I'm dead serious give this man time just look his name up and it's all over the bufferbloat community. To the man himself thank you and the hard working bufferbloat community for the solutions you've given us the last decade. Back to the video. PFsense wouldn't have been my choice, though it seems from comments you either have a configuration or distro issue. My advice see how hard it would be to use a version of openwrt on that machine. Openwrt has a better routing and more consistent setup at a low level. FQ_Codel is a nice option but cake is superior. You should be commended for making your own custom router but it's good you're showing people why we need router companies to get on the ball and start offering this feature with hardware accelerated support. It's still experimental on routers that allow it so I cannot recommend it as a good options. More gamers would benefit from going in to their routers if they can and dealing with ethtool -c (coalesce) or -k (offload) settings and ensuring the bad ones are disabled and that you're packets aren't being held up. While I run games with cake on a R7800 netgear cake itself is only helping out problems on my end. Cake and FQ codel will not fix bad hops or problems on other hops. The tech is great but only if you're you have a ton of people on the LAN making Upload wan problems or you want to ensure latency/bandwidth in a situation of that nature. Openwrt offers you more be it a router or customizing you're own pc to do so. Ask dave or come to openwrt forums or contact me for help.

[@BattleNonSense]

The issue is the UPnP implementation in PfSense. I evenually moved to Untangle (see the later video). I also collaborated with Dave Taht and Sebastian Möller on this video. kzbin.info/www/bejne/gputiJKpasyEb7s

[@K7L3-93]

I get insane bufferbloat, upwards of 500ms and it's a pain in the ass, I can't wait to see your solution in the new video soon.

[@RodiMerhi]

Great video, thank ypu for the insight, looking forward to your next one, but I'm curious abor your pfsense setup, would you bye able to test Nintendo switch consoles in that setup or the next? as I'm running Pfsense myself and had issues getting one console to connect, I ended up creating a group and having to add MAC addresses for all my friends switches so that they get whitelisted, big mess, so far we've been using local play so we didnt encounter that issue, but I have a friend coming over tonight will test online play on both consoles, if it works I'll share my setup. Although not plug and play.

[@chrisz8918]

Very glad I watched this video because I currently have an Edgerouter X and have been looking to upgrade to pfsense. Guess I will wait for your next video then.

[@samcat27]

I went from pfsense to untangle. Very good user friendly ui, fq_codel, and speed. I might give openwrt a try

[@RobinCawthorne]

Openwrt is wicked! But a little more vulnerable.

[@kwinzman]

@@RobinCawthorne Vulnerable to what?

[@RobinCawthorne]

@@kwinzman I know it's not that big a deal but silly things like this --> twitter.com/hackerfantastic/status/918430717331279872?s=19

[@AK474000]

PFsesne leans more toward security than convenience so this isn't surprising. You do have to set up a lot of rules to get things working, but this also gives you more control over your network as a result. Set and forget out of the box, isn't the point of PFsense.

[@dattEnasdf]

I'm a bit confused. I do not have any bufferbloat with the Edge Router Lite - There is 2 people watching Netflix, 3 people is gaming and a few more that just browsing the web. Do I miss anything about this? Sorry. I do not have Smart Queue enabled.

[@myownsite]

Maybe your bandwidth isn't maxed by that. Also,I don't think you need the resource intensive smart queue for that, just some simple qos rules.

[@kanarie]

Maybe you have one of the few ISPs with correctly configured buffers. You could try running the DSLReports speedtest and find out if you have any bufferbloat when maxing out your connection.

[@Limeayy]

Hoping for the next video soon. Thanks chris

[@uiopuiop3472]

i get my enjoyment from manually configuring everything possible, so pfsense is perfect for me

[@myownsite]

What is the other firewall? VyOS?

[@MirrorReaper]

He replied to someone with this "Untangle www.untangle.com/get-untangle/ Don't get confused by the "25$ per month" that you will see on the website. The firewall is free, including FQ_CoDel (QoS), but they have additional apps which are not free. That said, for home use they offer a "50$ per year license" which allows you to use all apps - if you need one. I will explain all that soon. :)"

[@mralderson5627]

luuzeri the real cliffhanger

[@supernice_auto]

great video- thanks for this info. for someone that's just getting into performance firewalls etc what recommendation in terms of hardware + routing software would you have for a simple home set up? any insight would be much appreciated. I started looking into pfsense but thinking maybe openwrt makes more sense? I'm fairly technical so i should have no issue in setting things up just not sure which hardware to go with if i'm going to flash openwrt.

[@Swat_Dennis]

How is it that when I am using WIFI I have ZERO issues with pingspikes?

[@Ph42oN]

Is this just problem in pfsense? Is it blocking outgoing connections? Games can be played from behind nat, and need port forwarding only if you are hosting server, at least thats how it always worked for me.

[@foggyfrogman1]

What was the recommendation you got? Pfsense on Protectli FW6C user here looking for other options.

[@cdoublejj]

and what firewall would that be?

[@felixtag5121]

i'm not an expert by any means (an experienced user but for sure no expert!) - but would it be an option to create 2 VLan's within your Network and go past the problem to have 2 clients using the same ports as they would appear to come from 2 different LAN's???

[@magnets1000]

Why do you even need upnp? Since when is that a requirement for SQM?

[@steve-anderson]

CAN WE PLEASE GET AN XR500 REVIEW? :)

[@FreeRoamingHumans]

The root of the problem is IPv4. Its flaws already became apparent in the 90s, which is why IPv6 came to be. But instead workarounds like NAT and UPNP were invented to mitigate the issues with IPv4. Now while more and more ISPs switch to IPv6 (simply because they run out of addresses), the routers and modems they provide typically block all inbound traffic, because 'Inbound == bad'. So we inherit all the drawbacks of IPv6, most of which come down to lack of adoption, but gain none of the benefits. Rant over. Thanks for your attention.

[@MaxfieldAllison]

Hey Chris, I sent you an email about OPNsense. I can't tell if you used OPNsense or assumed it was close enough to pfsense that you didn't need to.

[@user-du9zf3jj1z]

when "enable UPNP" means "check here but do other things to get UPNP working"... *edit* untangle > pfsense.

[@SIlaelinAndCo]

If I remember well you can download packets for pfsense, maybe you could find one with a different implementation, or even create your own with time and effort ^^'. I know it's not a big help but well it's all I know.

[@Stealthy_Phenotype]

Hey maybe you can answer this question i have since you have played Warframe. Why if warframe is a P2P game do i get 400+ ping from people in my country but when i play with EU people then i get a ping of 200 standard? I would really appreciate your feedback.

[@BattleNonSense]

Warframe uses the "Client Hosted" or "Listen Server" network model, which means that one of the 4 players is the host _(his gameclient is also the server)_. Warframe is very weird when it comes to how it chooses which player should host the session, because in many cases it seems to choose the *worst* host, rather than the best. I have had matches where the host player was apologising in chat that everyone had a bad time as he uses a 3G connection to play the game and he has no clue why the game would make him the host, but apparently it does so a lot. Soooo....... O.o

[@Stealthy_Phenotype]

@@BattleNonSense Thank you for the response, yes i understand that the host is also the server but should i not have a better connection to players from my own country? Basically i have a worse connection to a host that is 40KM away from my house while people on another continent gets a better connection from him. I also think that DE is working on this since the last patch since because myself and friends have been getting host migrations at the start of the game which never use to happen if we were a pre made party before the game started. I also noticed that if you want to guarantee being host then majority of the time you need to start the game after adding 1 person into the party before hand, this has always worked for me up until recently. I just dont understand how i get 400-800 ping from someone that is so close to my location

[@BattleNonSense]

@@Stealthy_Phenotype Can you tell me how you know your ping to the host? I have not seen that anywhere. O.o

[@Stealthy_Phenotype]

@@BattleNonSense Sure no problem, when you select show fps in the interface options then it will also show your ping to the host in the bottom left of the game

[@daikar12]

I have a 250/100 connection with the edgerouter x. And I just set the down/up to 1000/150 in sqm. I get 250 down and 100 up all the time. For some reason setting it to 250 only gave me 100mbit down.

[@rtzdeejay]

I understand your issue but I prefer configuring port forwarding manually for security reasons and to better control/understand my network traffic. I don't know if many users have this issue you're facing, we have serveral PC's at home but only 1 game PC.

[@-djSRK]

Lmao that pathfinder grapple at the beginning

[@lolspc]

Im runing pfsense with 8 concurrent pc and not having any problems