wg-easy/docs/content/guides/bandwidth-limiting.md

title
Bandwidth Limiting

WG-Easy supports global bandwidth limiting for all VPN traffic using Linux Traffic Control (tc).

How It Works

Bandwidth limiting uses Linux Traffic Control (tc) with HTB (Hierarchical Token Bucket):

• Download limiting: Applied directly to WireGuard interface egress
• Upload limiting: Uses IFB (Intermediate Functional Block) device to mirror ingress traffic

The tc commands are injected as PostUp/PostDown hooks in the WireGuard configuration.

Setup Guide

1. Access Admin Panel

Navigate to Admin Panel → General section.

2. Enable Bandwidth Limiting

Toggle "Enable Bandwidth Limiting" switch to ON.

3. Configure Limits

Setting	Description	Range
Download Limit (Mbps)	Max download speed for clients	1-10000 (0 = unlimited)
Upload Limit (Mbps)	Max upload speed from clients	1-10000 (0 = unlimited)

4. Save Settings

Click Save. WireGuard interface will automatically restart to apply changes.

Requirements

Download Limiting

• Works out of the box on all Linux systems

Upload Limiting

Requires the ifb (Intermediate Functional Block) kernel module:

# Check if IFB is available
modprobe ifb
lsmod | grep ifb

If IFB is not available:

• Download limiting will still work
• Upload limiting will be skipped
• A warning will display in the admin panel

Docker Container

The container must run with:

• --cap-add=NET_ADMIN (required for tc commands)
• --cap-add=SYS_MODULE (required for IFB module loading)

Example docker-compose:

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    # ... other settings

Technical Details

TC Commands Generated

Download (egress on wg0):

tc qdisc add dev wg0 root handle 1: htb default 10
tc class add dev wg0 parent 1: classid 1:1 htb rate 100mbit ceil 100mbit
tc class add dev wg0 parent 1:1 classid 1:10 htb rate 100mbit ceil 100mbit

Upload (ingress via IFB mirror):

ip link add ifb0 type ifb
ip link set ifb0 up
tc qdisc add dev wg0 handle ffff: ingress
tc filter add dev wg0 parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev ifb0
tc qdisc add dev ifb0 root handle 1: htb default 10
tc class add dev ifb0 parent 1: classid 1:1 htb rate 50mbit ceil 50mbit
tc class add dev ifb0 parent 1:1 classid 1:10 htb rate 50mbit ceil 50mbit

Database Schema

Settings stored in general_table:

• bandwidth_enabled (boolean)
• download_limit_mbps (integer)
• upload_limit_mbps (integer)

API Endpoints

Method	Endpoint	Description
GET	/api/admin/general	Get current settings
POST	/api/admin/general	Update settings (triggers restart)
GET	/api/admin/bandwidth-status	Check IFB availability

Troubleshooting

Bandwidth limits not applied

1. Check if container has NET_ADMIN capability
2. Verify WireGuard interface is running: wg show
3. Check tc rules: tc qdisc show dev wg0

Upload limiting not working

1. Check IFB module: lsmod | grep ifb
2. Ensure container has SYS_MODULE capability
3. Some cloud VPS may not support IFB kernel module

Settings not saving

Check browser console and server logs for API errors.