Solved

OpenBSD PF Firewall ALTQ for VOIP Priority

Posted on 2008-10-14
18
2,951 Views
Last Modified: 2013-12-09
Hello all,

I've been trying to get PF ALTQ setup and for the life of me I cannot figure out what the errors below are meaning, or at least what they are asking me to change. I have tried playing around with the values with no luck! I'm hoping someone here can assist with setting this up.

Before I get into the errors I will first outline what I am trying to accomplish with ALTQ.

I have chosen to work with HFSC as it seemed like the best option for VOIP. If this was an incorrect choice please let me know.

My ALTQ is supposed to help reduce network congestion as I am using both time sensitive and non-time sensitive services. However I would have preferred my total bandwidth to be shared by all the queues (borrow w/ CBQ) as I do not really care if one queue takes up most or all of the bandwidth as long as it gives it back when something like VOIP needs it.

VOIP vs bittorent basically. So I am looking to firstly prioritize VOIP over everything so my calls still work while also making sure traffic still flows (even if it is slower) and finally I am trying to optimize the flow of Ack's as I am on an ADSL line.

ACK Pri Ref #1: http://www.benzedrine.cx/ackpri.html
ACK Pri Ref #2: http://www.openbsd.org/faq/pf/queueing.html

Could you please assist with:

1. Getting my ALTQ working properly for my situation
2. Making sure I am doing the ACK prioritization properly.  


Thanks for your help!


ALTQ Portion of PF:
 

altq on $ext_if bandwidth 600Kb hfsc queue { ack, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 
 

queue ack priority 7 qlimit 500 hfsc (realtime 20% red ecn)

Note: I am not sure how much I should devote to ACK packets --comments?
 

queue voip priority 6 qlimit 500 hfsc (realtime 65% red enc)

queue dns priority 5 qlimit 500 hfsc (realtime 5% red ecn)

queue ssh priority 4 qlimit 500 hfsc (realtime 2% red ecn) {ssh_login, ssh_bulk}

queue ssh_login priority 4 qlimit 500

queue ssh_bulk priority 3 qlimit 500

rdpvnc priority 4 qlimit 500 hfsc (realtime 3% red ecn)

webftp priority 4 qlimit 500 hfsc (upperlimit 70% red ecn)

games priority 2 qlimit 500 hfsc (upperlimit 70% red ecn)

bitt     priority 3 qlimit 500 hfsc (upperlimit 80% red enc)

general priority 1 qlimit 500 hfsc (upperlimit 75% red ecn default)
 
 
 
 

Errors When Running PF:
 

pfctl: linkshare sc exceeds parent's sc 

/etc/pf.conf:34: errors in queue definition

pfctl: the sum of the child bandwidth higher than parent "root_fxp0" 

pfctl: linkshare sc exceeds parent's sc

/etc/pf.conf:35: errors in queue definition

parent ssh not found for ssh_login

/etc/pf.conf:36: errors in queue definition
 

Line 35 as an example is the start of my SSH queue
 

....and on and on...
 
 
 
 

PASS Rules For PF:
 

pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)

pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)

pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh_bulk, ssh_login)

pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 

and I have one for each queue...

Open in new window

0
Comment
Question by:plexter2k
  • 10
  • 8
18 Comments
 
LVL 61

Expert Comment

by:gheist
Comment Utility
ECN does not always work esp over frame relay, vpn and the likes.
There is usually one ack packet over 12k-64k window. It has no data just header. Over serial line that would make 1/1000 of bytes transferred, On ethernet given we send always full frame that will be 1/40 of traffic. If we experience resending things change for worse.

I'd suggest blindly adding 1:1:1:1 for each of  classes and unallocated in each priority group (And then pfctl -s queues to see overused ones)
0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
Actually you have to give high priority to DNS access so users get good interactive response out of web browsers, and NTP should have highest priority possible so that clocks are accurate if you use it.
0
 

Author Comment

by:plexter2k
Comment Utility
Hi gheist,

thank you for the response however I would not be able to implement anything until my ALTQ is working.

While I was waiting for a reply I tried implementing CBQ to see if this would work any better.

I get a different error which may also be why HFSC was not working.

The errors says there is something wrong with line 30. This is my opening ALTQ statement. I do not anything wrong!

I have attached my PF.CONF.

Hope you can help!
Thanks


#Interfaces

ext_if="fxp0"

int_if="fxp1"
 

#Options

set require-order yes

set block-policy drop

set loginterface $ext_if

set state-policy if-bound

set fingerprints "/etc/pf.os"

set ruleset-optimization none
 

#Timeout Settings

set optimization aggressive

set timeout { frag 10, tcp.established 3600 }

set timeout { tcp.first 30, tcp.closing 10, tcp.closed 10, tcp.finwait 10 }

set timeout { udp.first 30, udp.single 30, udp.multiple 30 }

set timeout { other.first 30, other.single 30, other.multiple 30 }

set timeout { adaptive.start 5000, adaptive.end 10000 }
 

#Connection Normalization
 

scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp fragment reassemble
 

#Queuing ALTQ

#Upload assumed aprox 80kb or 640Kb queued aprox 94%
 

altq on $ext_if cbq bandwidth 600Kb qlimit 500 queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 

queue   tos     bandwidth 20% priority 7      qlimit 500 cbq (borrow red ecn) { ack, ssh_login }

                queue   ack             bandwidth 90%   qlimit 500 cbq (borrow red ecn)

                queue   ssh_login       bandwidth 10%   qlimit 500 cbq (borrow red ecn)

queue   voip    bandwidth 50% priority 6      qlimit 500 cbq (borrow red ecn)

queue   dns     bandwidth 5%  priority 5      qlimit 500 cbq (borrow red ecn)

queue   ssh     bandwidth 2%  priority 4      qlimit 500 cbq (borrow red ecn)

queue   webftp  bandwidth 5%  priority 4      qlimit 500 cbq (borrow red ecn)

queue   games   bandwidth 5%  priority 3      qlimit 500 cbq (borrow red ecn)

queue   bitt    bandwidth 10% priority 2      qlimit 500 cbq (borrow red ecn)

queue   general bandwidth 3%  priority 1      qlimit 500 cbq (borrow red ecn default)
 

pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)

pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)

pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh, ssh_login)

pass out quick on $ext_if inet proto tcp from any to any port 3389 modulate state queue (rdpvnc, ack)

pass out quick on $ext_if inet proto udp from any to any port 30340:30341 keep state queue (games, ack)

pass out quick on $ext_if inet proto udp from any to any port 6112 keep state queue (games, ack)

pass out quick on $ext_if inet proto tcp from any to any port 10050 modulate state queue (bitt, ack)

pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 

pass in

pass out

Open in new window

0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
Have you got altq and all schedulers in your kernel?
Try loading with pfctl -nvf that will give you exact line when problems occur with somewhat explaining error message
0
 

Author Comment

by:plexter2k
Comment Utility
It was my understanding that OpenBSD comes with full support for PF right out of the box. Am I incorrect in this assumption?
0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
500 ethernet frames packets over 600kbps line would take 10 seconds to clear. I think autotuning of queue sizes is smarter than me and you.

I guess queue of line 30 exhausts resources of queue defined at line 28 (if both are syntactically correct at all)
0
 

Author Comment

by:plexter2k
Comment Utility
Hello,

I have removed all the queue size limits as I don't really care about them anyhow.  At least not now or until I need to. :P

I tried starting with your pfctl -nvf ... and I see all the config pop up followed by the same error. "Syntax incorrect"

I believe there is a bit of a mistake here. I think line 30 is showing up wrong. Line 30 in my actual config is the first line of ALTQ (line 28 on this site)

altq on $ext_if cbq bandwidth 600Kb queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }

Is now how it should be reading.

I just don't get why it says syntax error.




0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
I am running priq with 3 classes and happy with that. No bw and queue accounting when configuring and all that.

Errors in initial post say:
children use more than IF bandwidth and more queue space than parent has.
0
 

Author Comment

by:plexter2k
Comment Utility
Correct my original post was using HFSC queuing.

I have switched to CBQ as noted in the following post which did not produce near as many errors. I also noted that I think both CBQ and HFSC were having trouble for the same issue at hand now.

For some reason my main ALTQ statement is not accepted. This is causing all commands thereafter to produce errors because the PARENT queue no longer exists.


0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 

Author Comment

by:plexter2k
Comment Utility
Also see the code I have modified my pf.conf to be even simpler with no queue limitations...etc manually set (noted above).

Once again the line numbers referenced in the code are not the same as those on the OpenBSD box.

#Interfaces

ext_if="fxp0"

int_if="fxp1"
 

#Options

set require-order yes

set block-policy drop

set loginterface $ext_if

set state-policy if-bound

set fingerprints "/etc/pf.os"

set ruleset-optimization none
 

#Timeout Settings

set optimization aggressive

set timeout { frag 10, tcp.established 3600 }

set timeout { tcp.first 30, tcp.closing 10, tcp.closed 10, tcp.finwait 10 }

set timeout { udp.first 30, udp.single 30, udp.multiple 30 }

set timeout { other.first 30, other.single 30, other.multiple 30 }

set timeout { adaptive.start 5000, adaptive.end 10000 }
 

#Connection Normalization
 

scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp fragment reassemble
 

#Queuing ALTQ

#Upload assumed aprox 80kb or 640Kb queued aprox 94%
 

altq on $ext_if cbq bandwidth 600Kb queue { tos, voip, dns, ssh, webftp, bitt, general }
 

queue   tos     bandwidth 20% priority 7      cbq (borrow red) { ack, ssh_login }

                queue   ack             bandwidth 90%   cbq (borrow red)

                queue   ssh_login       bandwidth 10%   cbq (borrow red)

queue   voip    bandwidth 50% priority 6      cbq (borrow red)

queue   dns     bandwidth 7%  priority 5      cbq (borrow red)

queue   ssh     bandwidth 3%  priority 4      cbq (borrow red)

queue   webftp  bandwidth 5%  priority 4      cbq (borrow red)

queue   bitt    bandwidth 10% priority 2      cbq (borrow red)

queue   general bandwidth 5%  priority 1      cbq (borrow red default)
 

pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)

pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)

pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh, ssh_login)

pass out quick on $ext_if inet proto tcp from any to any port 10050 modulate state queue (bitt, ack)

pass out quick on $ext_if inet proto { tcp, udp } from any to any keep state queue (general, ack)
 

pass in

pass out

Open in new window

0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
There is no problem with this one line:

altq on $ext_if cbq bandwidth 600Kb qlimit 500 queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }

qlimit 500 on next line actually uses all the interface queue and rest of rules do not load.

please disable all of ECN usage. That is feedback protocol and very unlikely to be working at 640kbps consumer line.
0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
this effectively disconnects you from the internet behind next router:
min-ttl 254


0
 

Author Comment

by:plexter2k
Comment Utility
Okay what does that have to do with ALTQ?
0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
If you unplug network cable internet does not come into your house.

Can you post errors from pfctl -evf on that last config file. I have OpenBSD 3.5 where altq is outside PF, so I cannot help.
0
 

Author Comment

by:plexter2k
Comment Utility
Hello again,

The box is already off of the net. It is not a production box yet since it does not work.

I thought I had already posted the error. SYNTAX ERROR on LINE 30 (28 on the above pf.conf)

altq on $ext_if cbq bandwidth 600Kb queue { tos, voip, dns, ssh, webftp, bitt, general }

0
 
LVL 61

Accepted Solution

by:
gheist earned 500 total points
Comment Utility
It may count lines not commented or lines containing actual statements...
at least ipf did so long ago. so I suspect lines defining queues a bit further.

line you mentioned matches whats described in pf.conf manual page, so I assume no problem there.

what is with webftp queue ? May it complain it is not used hard way?
I am to install latest OpenBSD to do some testing on my own. expect more in couple of days.
0
 

Author Comment

by:plexter2k
Comment Utility
Hello gheist,

I am not sure exactly what I've done but i tried PRIQ based off of someone elses script and that worked fine! Then I tried CBQ again but a little simpler than my original and it works fine now also!!! I HAVE NO IDEA what is different or why its working now, but it is!

So thanks for your input none the less. :)

I believe I should be fine for now...at least until I encounter a new mystery!
0
 
LVL 61

Expert Comment

by:gheist
Comment Utility
If PRIQ does not do its job - i.e. high-priority class takes over all traffic and some other traffic gets stuck, go explore CBQ.
Basically CBQ is available on Hi-End routers, and does good there. Best home gateway devices do look similar to workings of PRIQ.
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Join & Write a Comment

This is a guide to the following problem (not exclusive but here) on Windows: Users need our support and we supporters often use global administrative accounts to do this. Using these accounts safely is a real challenge. Any admin who takes se…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now