# Reserve a separate OPNsense control-plane shaping class > The OPNsense control-plane guide requires a separate class and marks WFQ and QFQ usable for its weighted design. Review that allocation alongside existing pipe bandwidth. - Canonical URL: https://update.dsesecurity.com/updates/reserve-a-separate-opnsense-control-plane-shaping-class/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T19:49:45+00:00 - Modified: 2026-10-29T19:50:08+00:00 - Last reviewed by DSE: 2026-10-29 - Resource type: Guide - DSE priority: Advisory - Topics: Networks & Infrastructure - Reading time: 3 minutes ## What you need to know The OPNsense control-plane guide requires a separate class and marks WFQ and QFQ usable for its weighted design. Review that allocation alongside existing pipe bandwidth. ## Potentially affected OPNsense traffic shaping using the documented dedicated control-plane design. ## DSE recommendation Review a separate control-plane class, supported weighted scheduler and reconciled directional bandwidth budget before the pilot. ## Article Bottom line: Review control traffic as a distinct allocation. Keep its class, scheduler, matching rules and directional budget visible rather than adding another queue to the existing data-traffic plan without reconciliation. ## Source fact: what the authority says The [OPNsense Control Plane Shaping guide](https://docs.opnsense.org/manual/how-tos/shaper_control_plane.html) says control-plane traffic should not share a pipe or queue class with another traffic type. It requires bandwidth given to a different pipe to be subtracted from existing pipes. Its scheduler table marks WFQ and QFQ usable for their weighting capability, while FQ_CoDel and FQ_PIE are marked unusable because of AQM back-pressure. The IPv6 example uses separate download and upload classes and requires its matching rules to precede catch-all rules that would capture the traffic. ## What the source does not establish The guide’s example rates do not establish an appropriate reservation for a particular circuit. This article concerns the dedicated control-plane class decision; it does not promise uninterrupted routing or replace the separately reviewed data-plane tuning procedure. ## Applicability questions - Which control protocols must the proposed class match? - What current upload and download allocations must be reconciled? - Which existing rules would capture the same traffic first? - What control-session and workload observations will the owners accept? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends a directional budget with the existing data allocation, proposed control allocation and resulting total written explicitly. Have the network owner review the arithmetic against the intended shaping envelope. Keep download and upload values separate and avoid copying the guide’s example rates into an unrelated circuit. Draw the dedicated pipes, queues and matching rules before editing them. Select the weighted scheduler from the documented design rather than assuming a scheduler suitable for ordinary traffic is interchangeable here. Record the protocol and direction represented by each rule, including the earlier rules that could match it. Use a proposed IPv6 control-traffic pilot on one approved link. Identify the expected control-session observation and a representative user transaction before adding load. Keep additional protocol classes outside that first pilot unless their matching rules and weights have also been reviewed. Preserve the previous shaping configuration and agree a rollback trigger with the routing owner. Do not close the change solely because the new objects appear in the interface; require the budget and rule-order decisions to match the reviewed diagram. ## Verification and evidence Proposed verification: compare the active pipe rates, scheduler, queue assignments and rule sequence with the directional plan. Under authorized representative load, observe the named control session and user transaction together. Label the load conditions and retain any unexplained session loss or throughput change. Check that the intended traffic reaches its dedicated class using the available approved observations. Reconcile each final allocation after the pilot and restore the prior configuration if the selected traffic cannot be explained. Treat the measured result as specific to that link and test condition. ## Official references - [OPNsense — Control Plane Shaping](https://docs.opnsense.org/manual/how-tos/shaper_control_plane.html) — official product documentation; confirm the installed release and configuration. Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: OPNsense — Control Plane Shaping - Authority: docs.opnsense.org - URL: https://docs.opnsense.org/manual/how-tos/shaper_control_plane.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Reserve a separate OPNsense control-plane shaping class,” DSE Security, https://update.dsesecurity.com/updates/reserve-a-separate-opnsense-control-plane-shaping-class/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.