Traffic Shaping - IPFW Dummynet not working as expected

[Struntzi]

EDIT:

I've set up a small testing lab so i can verify this even happens with Inter-VLAN Shaping.
I did this so i could rule out my ISP connection.

And well... Shaping Traffic between two VLANs on the OPNsense with some Network Switches in between and two notebooks on the ends running iperf3 -> success.

I was able to get stable rates up to 800 Mbit/s shaped. I don't need that much but it was nice to see that my firewall can handle this.

So the plot thikens that my "problem" has something to do with the Cable Modem provides by the ISP.
-----------------------------------

Hey Guys,

i have a (rather big) problem with the Shaper option in OPNSense.

Beforehand this is my configuration:

Firewall Hardware: Fujitsu RX100 S8 - Intel Xeon E3-1270V3 - 16 GB DDR3 Memory
Networking Hardware (for some testing): HP Dual SFP+ PCIe Card with 1G HP SX Transceiver
Internet Connection: 1Gbit/s Download / 50 Mbit/s Upload via Cable Modem
OPNSense Version: OPNsense 24.1-amd64

What i want to achive: i currently try to limit the download bandwith for one of my clients in advance to reserve bandwith for other clients in my network.

I added a pipe with varios download speeds and created a rule with a /32 mask just for that one client.
All speeds until 50-60 Mbit/s work great. Any speed above wont really work.
In advance that the cpu is the problem i changed the CPU from a Xeon E3-1220V3 to the above mentioned Xeon E3-1270V3. But this did not really made a big differnence.

I am getting varios speeds for example a Pipe dedicated to 300 Mbit/s is getting anywhere from 150 - 200 Mbit/s sometimes even less or slighty more.

I thaught maybe the Networking Hardware in the Server could be the Problem so i changed to the above mentioned Fiber Card, but (as sadly expected) no change.

Then i changed to another firewall of mine (running the same software) with a Pention G4000 and some DDR4 Memory, but also no big change.

I also changed kern.hz to 1000 / 4000 / 8000 but also no change here.

My Pipe are standard configured with the bare minimum.
My Rule is set to WAN and the destination to the Client with a /32 Mask.

The Firewall itself does not have any configuration expect LAN and WAN Port Assignments.

Maybe any of you guys have a solution or even idea to this.

ps.
I tested a bigger Server (Xeon Silver and 200+ GB of RAM) with another Internet Connection and everything runs somethly. I will test my main firewall with this Internet connection if possible.