• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3079
  • Last Modified:

OpenBSD PF Firewall ALTQ for VOIP Priority

Hello all,

I've been trying to get PF ALTQ setup and for the life of me I cannot figure out what the errors below are meaning, or at least what they are asking me to change. I have tried playing around with the values with no luck! I'm hoping someone here can assist with setting this up.

Before I get into the errors I will first outline what I am trying to accomplish with ALTQ.

I have chosen to work with HFSC as it seemed like the best option for VOIP. If this was an incorrect choice please let me know.

My ALTQ is supposed to help reduce network congestion as I am using both time sensitive and non-time sensitive services. However I would have preferred my total bandwidth to be shared by all the queues (borrow w/ CBQ) as I do not really care if one queue takes up most or all of the bandwidth as long as it gives it back when something like VOIP needs it.

VOIP vs bittorent basically. So I am looking to firstly prioritize VOIP over everything so my calls still work while also making sure traffic still flows (even if it is slower) and finally I am trying to optimize the flow of Ack's as I am on an ADSL line.

ACK Pri Ref #1: http://www.benzedrine.cx/ackpri.html
ACK Pri Ref #2: http://www.openbsd.org/faq/pf/queueing.html

Could you please assist with:

1. Getting my ALTQ working properly for my situation
2. Making sure I am doing the ACK prioritization properly.  


Thanks for your help!


ALTQ Portion of PF:
 
altq on $ext_if bandwidth 600Kb hfsc queue { ack, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 
 
queue ack priority 7 qlimit 500 hfsc (realtime 20% red ecn)
Note: I am not sure how much I should devote to ACK packets --comments?
 
queue voip priority 6 qlimit 500 hfsc (realtime 65% red enc)
queue dns priority 5 qlimit 500 hfsc (realtime 5% red ecn)
queue ssh priority 4 qlimit 500 hfsc (realtime 2% red ecn) {ssh_login, ssh_bulk}
queue ssh_login priority 4 qlimit 500
queue ssh_bulk priority 3 qlimit 500
rdpvnc priority 4 qlimit 500 hfsc (realtime 3% red ecn)
webftp priority 4 qlimit 500 hfsc (upperlimit 70% red ecn)
games priority 2 qlimit 500 hfsc (upperlimit 70% red ecn)
bitt     priority 3 qlimit 500 hfsc (upperlimit 80% red enc)
general priority 1 qlimit 500 hfsc (upperlimit 75% red ecn default)
 
 
 
 
Errors When Running PF:
 
pfctl: linkshare sc exceeds parent's sc 
/etc/pf.conf:34: errors in queue definition
pfctl: the sum of the child bandwidth higher than parent "root_fxp0" 
pfctl: linkshare sc exceeds parent's sc
/etc/pf.conf:35: errors in queue definition
parent ssh not found for ssh_login
/etc/pf.conf:36: errors in queue definition
 
Line 35 as an example is the start of my SSH queue
 
....and on and on...
 
 
 
 
PASS Rules For PF:
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh_bulk, ssh_login)
pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 
and I have one for each queue...

Open in new window

0
plexter2k
Asked:
plexter2k
  • 10
  • 8
1 Solution
 
gheistCommented:
ECN does not always work esp over frame relay, vpn and the likes.
There is usually one ack packet over 12k-64k window. It has no data just header. Over serial line that would make 1/1000 of bytes transferred, On ethernet given we send always full frame that will be 1/40 of traffic. If we experience resending things change for worse.

I'd suggest blindly adding 1:1:1:1 for each of  classes and unallocated in each priority group (And then pfctl -s queues to see overused ones)
0
 
gheistCommented:
Actually you have to give high priority to DNS access so users get good interactive response out of web browsers, and NTP should have highest priority possible so that clocks are accurate if you use it.
0
 
plexter2kAuthor Commented:
Hi gheist,

thank you for the response however I would not be able to implement anything until my ALTQ is working.

While I was waiting for a reply I tried implementing CBQ to see if this would work any better.

I get a different error which may also be why HFSC was not working.

The errors says there is something wrong with line 30. This is my opening ALTQ statement. I do not anything wrong!

I have attached my PF.CONF.

Hope you can help!
Thanks


#Interfaces
ext_if="fxp0"
int_if="fxp1"
 
#Options
set require-order yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
 
#Timeout Settings
set optimization aggressive
set timeout { frag 10, tcp.established 3600 }
set timeout { tcp.first 30, tcp.closing 10, tcp.closed 10, tcp.finwait 10 }
set timeout { udp.first 30, udp.single 30, udp.multiple 30 }
set timeout { other.first 30, other.single 30, other.multiple 30 }
set timeout { adaptive.start 5000, adaptive.end 10000 }
 
#Connection Normalization
 
scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp fragment reassemble
 
#Queuing ALTQ
#Upload assumed aprox 80kb or 640Kb queued aprox 94%
 
altq on $ext_if cbq bandwidth 600Kb qlimit 500 queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 
queue   tos     bandwidth 20% priority 7      qlimit 500 cbq (borrow red ecn) { ack, ssh_login }
                queue   ack             bandwidth 90%   qlimit 500 cbq (borrow red ecn)
                queue   ssh_login       bandwidth 10%   qlimit 500 cbq (borrow red ecn)
queue   voip    bandwidth 50% priority 6      qlimit 500 cbq (borrow red ecn)
queue   dns     bandwidth 5%  priority 5      qlimit 500 cbq (borrow red ecn)
queue   ssh     bandwidth 2%  priority 4      qlimit 500 cbq (borrow red ecn)
queue   webftp  bandwidth 5%  priority 4      qlimit 500 cbq (borrow red ecn)
queue   games   bandwidth 5%  priority 3      qlimit 500 cbq (borrow red ecn)
queue   bitt    bandwidth 10% priority 2      qlimit 500 cbq (borrow red ecn)
queue   general bandwidth 3%  priority 1      qlimit 500 cbq (borrow red ecn default)
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh, ssh_login)
pass out quick on $ext_if inet proto tcp from any to any port 3389 modulate state queue (rdpvnc, ack)
pass out quick on $ext_if inet proto udp from any to any port 30340:30341 keep state queue (games, ack)
pass out quick on $ext_if inet proto udp from any to any port 6112 keep state queue (games, ack)
pass out quick on $ext_if inet proto tcp from any to any port 10050 modulate state queue (bitt, ack)
pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 
pass in
pass out

Open in new window

0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
gheistCommented:
Have you got altq and all schedulers in your kernel?
Try loading with pfctl -nvf that will give you exact line when problems occur with somewhat explaining error message
0
 
plexter2kAuthor Commented:
It was my understanding that OpenBSD comes with full support for PF right out of the box. Am I incorrect in this assumption?
0
 
gheistCommented:
500 ethernet frames packets over 600kbps line would take 10 seconds to clear. I think autotuning of queue sizes is smarter than me and you.

I guess queue of line 30 exhausts resources of queue defined at line 28 (if both are syntactically correct at all)
0
 
plexter2kAuthor Commented:
Hello,

I have removed all the queue size limits as I don't really care about them anyhow.  At least not now or until I need to. :P

I tried starting with your pfctl -nvf ... and I see all the config pop up followed by the same error. "Syntax incorrect"

I believe there is a bit of a mistake here. I think line 30 is showing up wrong. Line 30 in my actual config is the first line of ALTQ (line 28 on this site)

altq on $ext_if cbq bandwidth 600Kb queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }

Is now how it should be reading.

I just don't get why it says syntax error.




0
 
gheistCommented:
I am running priq with 3 classes and happy with that. No bw and queue accounting when configuring and all that.

Errors in initial post say:
children use more than IF bandwidth and more queue space than parent has.
0
 
plexter2kAuthor Commented:
Correct my original post was using HFSC queuing.

I have switched to CBQ as noted in the following post which did not produce near as many errors. I also noted that I think both CBQ and HFSC were having trouble for the same issue at hand now.

For some reason my main ALTQ statement is not accepted. This is causing all commands thereafter to produce errors because the PARENT queue no longer exists.


0
 
plexter2kAuthor Commented:
Also see the code I have modified my pf.conf to be even simpler with no queue limitations...etc manually set (noted above).

Once again the line numbers referenced in the code are not the same as those on the OpenBSD box.

#Interfaces
ext_if="fxp0"
int_if="fxp1"
 
#Options
set require-order yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
 
#Timeout Settings
set optimization aggressive
set timeout { frag 10, tcp.established 3600 }
set timeout { tcp.first 30, tcp.closing 10, tcp.closed 10, tcp.finwait 10 }
set timeout { udp.first 30, udp.single 30, udp.multiple 30 }
set timeout { other.first 30, other.single 30, other.multiple 30 }
set timeout { adaptive.start 5000, adaptive.end 10000 }
 
#Connection Normalization
 
scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp fragment reassemble
 
#Queuing ALTQ
#Upload assumed aprox 80kb or 640Kb queued aprox 94%
 
altq on $ext_if cbq bandwidth 600Kb queue { tos, voip, dns, ssh, webftp, bitt, general }
 
queue   tos     bandwidth 20% priority 7      cbq (borrow red) { ack, ssh_login }
                queue   ack             bandwidth 90%   cbq (borrow red)
                queue   ssh_login       bandwidth 10%   cbq (borrow red)
queue   voip    bandwidth 50% priority 6      cbq (borrow red)
queue   dns     bandwidth 7%  priority 5      cbq (borrow red)
queue   ssh     bandwidth 3%  priority 4      cbq (borrow red)
queue   webftp  bandwidth 5%  priority 4      cbq (borrow red)
queue   bitt    bandwidth 10% priority 2      cbq (borrow red)
queue   general bandwidth 5%  priority 1      cbq (borrow red default)
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh, ssh_login)
pass out quick on $ext_if inet proto tcp from any to any port 10050 modulate state queue (bitt, ack)
pass out quick on $ext_if inet proto { tcp, udp } from any to any keep state queue (general, ack)
 
pass in
pass out

Open in new window

0
 
gheistCommented:
There is no problem with this one line:

altq on $ext_if cbq bandwidth 600Kb qlimit 500 queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }

qlimit 500 on next line actually uses all the interface queue and rest of rules do not load.

please disable all of ECN usage. That is feedback protocol and very unlikely to be working at 640kbps consumer line.
0
 
gheistCommented:
this effectively disconnects you from the internet behind next router:
min-ttl 254


0
 
plexter2kAuthor Commented:
Okay what does that have to do with ALTQ?
0
 
gheistCommented:
If you unplug network cable internet does not come into your house.

Can you post errors from pfctl -evf on that last config file. I have OpenBSD 3.5 where altq is outside PF, so I cannot help.
0
 
plexter2kAuthor Commented:
Hello again,

The box is already off of the net. It is not a production box yet since it does not work.

I thought I had already posted the error. SYNTAX ERROR on LINE 30 (28 on the above pf.conf)

altq on $ext_if cbq bandwidth 600Kb queue { tos, voip, dns, ssh, webftp, bitt, general }

0
 
gheistCommented:
It may count lines not commented or lines containing actual statements...
at least ipf did so long ago. so I suspect lines defining queues a bit further.

line you mentioned matches whats described in pf.conf manual page, so I assume no problem there.

what is with webftp queue ? May it complain it is not used hard way?
I am to install latest OpenBSD to do some testing on my own. expect more in couple of days.
0
 
plexter2kAuthor Commented:
Hello gheist,

I am not sure exactly what I've done but i tried PRIQ based off of someone elses script and that worked fine! Then I tried CBQ again but a little simpler than my original and it works fine now also!!! I HAVE NO IDEA what is different or why its working now, but it is!

So thanks for your input none the less. :)

I believe I should be fine for now...at least until I encounter a new mystery!
0
 
gheistCommented:
If PRIQ does not do its job - i.e. high-priority class takes over all traffic and some other traffic gets stuck, go explore CBQ.
Basically CBQ is available on Hi-End routers, and does good there. Best home gateway devices do look similar to workings of PRIQ.
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 10
  • 8
Tackle projects and never again get stuck behind a technical roadblock.
Join Now