pfSense Traffic Shaping and QoS
When a video call freezes exactly as someone starts a large backup, the network has not run out of capacity; it has run out of priority. Routers buffer everything equally by default, so a bulk transfer can fill a link and add hundreds of milliseconds of delay to packets that needed a few. Traffic shaping on pfSense fixes this by classifying traffic into queues with different priorities and drop behavior, so the small urgent packets pass while the large patient ones wait.
Understand what shaping can and cannot do
A shaper controls traffic leaving an interface on your own hardware. It cannot speed up your ISP, and it cannot prioritize packets once they reach a congested link upstream. What it can do is decide which of your own packets wait in your own buffers, and that decision covers the most common case: a saturated access link where the queue that matters sits in your gateway.
Set expectations accordingly. Shaping reduces latency and jitter for chosen traffic under load; it does not create bandwidth. If a link is genuinely too small for the aggregate demand, shaping softens the pain but no queue configuration replaces a bigger circuit.
Measure real bandwidth before setting limits
Shaper values must match reality. Run speed tests at several times of day, on both the download and upload paths, and note the lowest consistent results rather than the best moment. Configure the shaper slightly below the measured floor, because the classic mistake is to enter the advertised rate: the queue then never engages where congestion actually begins, and all the careful priorities do nothing.
On asymmetric connections, remember that upload congestion is the usual culprit. A computer syncing to the cloud fills the upstream, ACK packets for downloads are delayed, and everything feels slow. Prioritizing small ACK traffic often fixes perceived download slowness without touching anything else.
Classify traffic by behavior, not by rumor
Identify the flows that need protection: voice and video conferencing are sensitive to delay and jitter, interactive gaming and remote desktop care about round-trip time, while backups, updates, and streaming tolerate queuing. pfSense lets you match traffic by source or destination aliases, by protocol and port, and by interface, so classification usually starts with the applications you can name and their known endpoints.
Keep the categories few. A shaper with a dozen overlapping queues is impossible to reason about when something misbehaves. Three to five tiers, such as urgent, interactive, normal, and bulk, cover most networks, and a catch-all default queue absorbs whatever was not classified rather than punishing it.
Size queues and buffers deliberately
Queue bandwidth values are commitments, not wishes. The sum of guarantees must fit within the shaper's overall limit, high-priority queues need enough headroom for the peak demand they will see, and the bulk queue should accept being throttled. Excess bandwidth sharing lets idle priorities lend capacity to busy lower tiers, which keeps the link efficient when not everyone is on a call.
Buffer settings deserve a conservative hand. Deep queues smooth bursts but add latency of their own, recreating the problem shaping exists to solve. Smaller queues with early drops push congestion awareness toward the applications causing it, which is usually the behavior you want for bulk traffic.
Test under real load and watch the results
Validation is simple in principle: start a sustained bulk transfer, then join a video call. Without shaping the call degrades; with sensible queues it should barely notice. Repeat during peak hours, from the devices your users actually hold, and record latency and jitter before and after. Live queue graphs on pfSense show drops per queue, and steady drops in the urgent queue mean your classification is missing some of that traffic, not that priorities are wrong.
Shaping decisions also interact with rule design and multi-WAN routing described in our other guides, and readers assembling a new gateway can review the platform overview before they download pfSense to confirm their hardware suits the version they plan to install.
Revisit when the network changes
Shaper configuration is a snapshot of one network at one moment. New conferencing tools change ports and endpoints, ISP upgrades change the numbers the queues depend on, and a new office wing changes the demand. Re-measure bandwidth after circuit changes, re-test after major application changes, and keep a note of when shaping was last validated. Queues that reflect the current network keep calls clear; queues that reflect last year's network just add complexity at the worst time.