Decide whether a pfSense limiter is shared or masked per client

The same numeric limit can mean one shared bucket or many independent buckets.

Source facts

Netgate explains that an unmasked limiter shares one bandwidth bucket across matching traffic. A source or destination mask creates separate buckets per host or network according to the mask. Limiters normally work in directional pairs. A limiter pipe has a hard upper limit and does not borrow bandwidth from another pipe.

Source: Netgate — Limiters.

Applicability

This concerns pfSense dummynet limiters.

DSE recommendation

DSE recommends translating the requirement into either a total segment cap or an individual client cap before setting masks. Record which address is visible at the rule’s attachment point and how the upload and download directions map to the paired limiters. Consider aggregate demand when many independently masked clients are active. Avoid describing a sum of possible per-client limits as capacity the physical link can actually deliver. Have the bandwidth owner state whether the requirement is a shared site ceiling or an individual-client ceiling before approving the mask. Test two clients together and separately under the same proposed limit, and preserve both observations so the intended bucket scope is demonstrated.

Verification

Use two authorized test clients concurrently. Compare their combined rate under an unmasked design with the intended independent behavior under a masked design. Test both directions and inspect the relevant queues. Repeat with representative IPv4 and IPv6 rules where required, and record observed contention rather than treating the configured maximum as guaranteed throughput.

Official reference

Netgate — Limiters. Reviewed October 20, 2026.