November 19, 2008 02:24am pst

1. gheist 17,569
2. Tintin 5,950
3. Rowley 5,800
4. blu 5,200
5. TeRReF 4,000
5. sunnycoder 4,000
7. ravenpl 3,800
8. omarfarid 3,730
9. Blaz 3,172
10. lrmoore 2,000
10. mr_egypt... 2,000
10. jausions 2,000
10. dwaynec... 2,000
10. gbougiakas 2,000
10. KCTS 2,000
10. Arthur_M... 2,000
10. sda100 2,000
10. louisbohm 2,000
10. shakoush... 2,000
10. riotz 2,000
10. tprpics 2,000
10. sjm_ee 2,000
10. woolmilkp... 2,000
10. gnurl 2,000
25. richrumble 1,600

1. ahoffmann 58,928
2. gheist 45,908
3. yuzh 35,347
4. Tintin 32,873
5. ravenpl 18,155
6. jlevie 17,456
7. chris_cal... 14,021
8. wesly_c... 8,820
9. ppfoong 8,019
10. blu 7,425
11. liddler 7,400
12. sunnycoder 6,080
13. Rowley 5,800
14. PsiCop 4,792
15. amit_g 4,750
16. TeRReF 4,600
17. omarfarid 4,530
18. JustUNIX 3,400
19. Blaz 3,172
20. zgrp 3,000
20. sparks1... 3,000
22. sjm_ee 2,750
23. sppalser 2,640
24. nixfreak 2,525
25. tfewster 2,505

10.14.2008 at 02:39PM PDT, ID: 23814646

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

6.5

OpenBSD PF Firewall ALTQ for VOIP Priority

Asked by plexter2k in OpenBSD, Network Software Firewalls, Unix Network Security

Tags: OpenBSD, PF Packet Filter, 4.3, Firewall ALTQ

Hello all,

I've been trying to get PF ALTQ setup and for the life of me I cannot figure out what the errors below are meaning, or at least what they are asking me to change. I have tried playing around with the values with no luck! I'm hoping someone here can assist with setting this up.

Before I get into the errors I will first outline what I am trying to accomplish with ALTQ.

I have chosen to work with HFSC as it seemed like the best option for VOIP. If this was an incorrect choice please let me know.

My ALTQ is supposed to help reduce network congestion as I am using both time sensitive and non-time sensitive services. However I would have preferred my total bandwidth to be shared by all the queues (borrow w/ CBQ) as I do not really care if one queue takes up most or all of the bandwidth as long as it gives it back when something like VOIP needs it.

VOIP vs bittorent basically. So I am looking to firstly prioritize VOIP over everything so my calls still work while also making sure traffic still flows (even if it is slower) and finally I am trying to optimize the flow of Ack's as I am on an ADSL line.

ACK Pri Ref #1: http://www.benzedrine.cx/ackpri.html
ACK Pri Ref #2: http://www.openbsd.org/faq/pf/queueing.html

Could you please assist with:

1. Getting my ALTQ working properly for my situation
2. Making sure I am doing the ACK prioritization properly.

Thanks for your help!

Start Free Trial

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:

           
           
             ALTQ Portion of PF:
 
altq on $ext_if bandwidth 600Kb hfsc queue { ack, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 
 
queue ack priority 7 qlimit 500 hfsc (realtime 20% red ecn)
Note: I am not sure how much I should devote to ACK packets --comments?
 
queue voip priority 6 qlimit 500 hfsc (realtime 65% red enc)
queue dns priority 5 qlimit 500 hfsc (realtime 5% red ecn)
queue ssh priority 4 qlimit 500 hfsc (realtime 2% red ecn) {ssh_login, ssh_bulk}
queue ssh_login priority 4 qlimit 500
queue ssh_bulk priority 3 qlimit 500
rdpvnc priority 4 qlimit 500 hfsc (realtime 3% red ecn)
webftp priority 4 qlimit 500 hfsc (upperlimit 70% red ecn)
games priority 2 qlimit 500 hfsc (upperlimit 70% red ecn)
bitt     priority 3 qlimit 500 hfsc (upperlimit 80% red enc)
general priority 1 qlimit 500 hfsc (upperlimit 75% red ecn default)
 
 
 
 
Errors When Running PF:
 
pfctl: linkshare sc exceeds parent's sc 
/etc/pf.conf:34: errors in queue definition
pfctl: the sum of the child bandwidth higher than parent "root_fxp0" 
pfctl: linkshare sc exceeds parent's sc
/etc/pf.conf:35: errors in queue definition
parent ssh not found for ssh_login
/etc/pf.conf:36: errors in queue definition
 
Line 35 as an example is the start of my SSH queue
 
....and on and on...
 
 
 
 
PASS Rules For PF:
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh_bulk, ssh_login)
pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 
and I have one for each queue...

           
         

Keywords: OpenBSD PF Firewall ALTQ for VOIP P…

	Title
1	VOIP Some advice needed for busines…
2	VOIP Bandwidth usage and information
3	VoIP Ballpark Pricing
4	voip sender number
5	VOIP basic requirements ???
6	VOIP software / deployment on an ex…

Loading Advertisement...

20080716-EE-VQP-32 / EE_QW_2_20070628

OpenBSD PF Firewall ALTQ for VOIP Priority

Asked by plexter2k in OpenBSD, Network Software Firewalls, Unix Network Security

Tags: OpenBSD, PF Packet Filter, 4.3, Firewall ALTQ

About this solution