1

In our infrastructure we have no WSUS installed so when microsoft pushes new updates all our computers start excessive downloads, we use pfsense and as I am new to it, I need an advise how can I limit the download bandwidth from the certain hosts having only hostnames of the update servers from here https://technet.microsoft.com/en-us/library/cc708605(v=ws.10).aspx

  • Limiting incoming traffic can be a problem, since by the time you see the traffic, it has already used your bandwidth. You could drop it after it reaches your network, but that doesn't unclog the WAN pipe. – Ron Maupin Sep 22 '16 at 15:19
  • Actually I have two pfsense routers and ingress traffic on one interface is egress traffic for another interface, can't I limit it there? – Edik Mkoyan Sep 22 '16 at 15:51
  • You can limit it anywhere you see the traffic, but my point is that it has already clogged your inbound WAN by the time you see it. – Ron Maupin Sep 22 '16 at 15:53
  • TCP's flow control can adjust the windows size from the client size, isn't it? – Edik Mkoyan Sep 22 '16 at 16:06
  • Anyways I can try if you can "show" me how to do that in pfsens having only hostnames – Edik Mkoyan Sep 22 '16 at 16:06
1

If the rest of your pfSense setup plays well with it, setting up your pfSense so that squid can cache the updates really speeds things up, while limiting the WAN traffic. This may require more resources than many people seem to allocate to a pfSense install, and it spent quite a while being broken from 2.15 or so forward (I don't know if it's actually fixed for sure in the current release, it partly depends on what other things you are doing with pfSense, IIRC.)

Alternatively, set up a separate squid box, tuned to handle the rather portly things that are system updates, as opposed to the typical default tuning for smaller things that leaves updates out of the cache.

On the third hand, setting up a local WSUS might be the most sensible approach for your location, if it's ONLY windows updates that are the issue. Otherwise all those hosts are going to move all that traffic eventually, while having that set up will limit your WAN traffic to pulling down one copy.

1
With traffic shaper you can limit bandwidth to destination IP's.

List of domains used by windows update, but you need to resolve those IP's yourslef as they change time to time.
http://windowsupdate.microsoft.com
http://*.windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://*.update.microsoft.com
https://*.update.microsoft.com
http://*.windowsupdate.com
http://download.windowsupdate.com
http://download.microsoft.com
http://*.download.windowsupdate.com
http://wustat.windows.com
http://ntservicepack.microsoft.com
http://stats.microsoft.com
https://stats.microsoft.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.