Solved

OpenBSD PF Firewall ALTQ for VOIP Priority

Posted on 2008-10-14
18
2,988 Views
Last Modified: 2013-12-09
Hello all,

I've been trying to get PF ALTQ setup and for the life of me I cannot figure out what the errors below are meaning, or at least what they are asking me to change. I have tried playing around with the values with no luck! I'm hoping someone here can assist with setting this up.

Before I get into the errors I will first outline what I am trying to accomplish with ALTQ.

I have chosen to work with HFSC as it seemed like the best option for VOIP. If this was an incorrect choice please let me know.

My ALTQ is supposed to help reduce network congestion as I am using both time sensitive and non-time sensitive services. However I would have preferred my total bandwidth to be shared by all the queues (borrow w/ CBQ) as I do not really care if one queue takes up most or all of the bandwidth as long as it gives it back when something like VOIP needs it.

VOIP vs bittorent basically. So I am looking to firstly prioritize VOIP over everything so my calls still work while also making sure traffic still flows (even if it is slower) and finally I am trying to optimize the flow of Ack's as I am on an ADSL line.

ACK Pri Ref #1: http://www.benzedrine.cx/ackpri.html
ACK Pri Ref #2: http://www.openbsd.org/faq/pf/queueing.html

Could you please assist with:

1. Getting my ALTQ working properly for my situation
2. Making sure I am doing the ACK prioritization properly.  


Thanks for your help!


ALTQ Portion of PF:
 
altq on $ext_if bandwidth 600Kb hfsc queue { ack, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 
 
queue ack priority 7 qlimit 500 hfsc (realtime 20% red ecn)
Note: I am not sure how much I should devote to ACK packets --comments?
 
queue voip priority 6 qlimit 500 hfsc (realtime 65% red enc)
queue dns priority 5 qlimit 500 hfsc (realtime 5% red ecn)
queue ssh priority 4 qlimit 500 hfsc (realtime 2% red ecn) {ssh_login, ssh_bulk}
queue ssh_login priority 4 qlimit 500
queue ssh_bulk priority 3 qlimit 500
rdpvnc priority 4 qlimit 500 hfsc (realtime 3% red ecn)
webftp priority 4 qlimit 500 hfsc (upperlimit 70% red ecn)
games priority 2 qlimit 500 hfsc (upperlimit 70% red ecn)
bitt     priority 3 qlimit 500 hfsc (upperlimit 80% red enc)
general priority 1 qlimit 500 hfsc (upperlimit 75% red ecn default)
 
 
 
 
Errors When Running PF:
 
pfctl: linkshare sc exceeds parent's sc 
/etc/pf.conf:34: errors in queue definition
pfctl: the sum of the child bandwidth higher than parent "root_fxp0" 
pfctl: linkshare sc exceeds parent's sc
/etc/pf.conf:35: errors in queue definition
parent ssh not found for ssh_login
/etc/pf.conf:36: errors in queue definition
 
Line 35 as an example is the start of my SSH queue
 
....and on and on...
 
 
 
 
PASS Rules For PF:
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh_bulk, ssh_login)
pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 
and I have one for each queue...

Open in new window

0
Comment
Question by:plexter2k
  • 10
  • 8
18 Comments
 
LVL 62

Expert Comment

by:gheist
ID: 22729163
ECN does not always work esp over frame relay, vpn and the likes.
There is usually one ack packet over 12k-64k window. It has no data just header. Over serial line that would make 1/1000 of bytes transferred, On ethernet given we send always full frame that will be 1/40 of traffic. If we experience resending things change for worse.

I'd suggest blindly adding 1:1:1:1 for each of  classes and unallocated in each priority group (And then pfctl -s queues to see overused ones)
0
 
LVL 62

Expert Comment

by:gheist
ID: 22729170
Actually you have to give high priority to DNS access so users get good interactive response out of web browsers, and NTP should have highest priority possible so that clocks are accurate if you use it.
0
 

Author Comment

by:plexter2k
ID: 22733285
Hi gheist,

thank you for the response however I would not be able to implement anything until my ALTQ is working.

While I was waiting for a reply I tried implementing CBQ to see if this would work any better.

I get a different error which may also be why HFSC was not working.

The errors says there is something wrong with line 30. This is my opening ALTQ statement. I do not anything wrong!

I have attached my PF.CONF.

Hope you can help!
Thanks


#Interfaces
ext_if="fxp0"
int_if="fxp1"
 
#Options
set require-order yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
 
#Timeout Settings
set optimization aggressive
set timeout { frag 10, tcp.established 3600 }
set timeout { tcp.first 30, tcp.closing 10, tcp.closed 10, tcp.finwait 10 }
set timeout { udp.first 30, udp.single 30, udp.multiple 30 }
set timeout { other.first 30, other.single 30, other.multiple 30 }
set timeout { adaptive.start 5000, adaptive.end 10000 }
 
#Connection Normalization
 
scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp fragment reassemble
 
#Queuing ALTQ
#Upload assumed aprox 80kb or 640Kb queued aprox 94%
 
altq on $ext_if cbq bandwidth 600Kb qlimit 500 queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }
 
queue   tos     bandwidth 20% priority 7      qlimit 500 cbq (borrow red ecn) { ack, ssh_login }
                queue   ack             bandwidth 90%   qlimit 500 cbq (borrow red ecn)
                queue   ssh_login       bandwidth 10%   qlimit 500 cbq (borrow red ecn)
queue   voip    bandwidth 50% priority 6      qlimit 500 cbq (borrow red ecn)
queue   dns     bandwidth 5%  priority 5      qlimit 500 cbq (borrow red ecn)
queue   ssh     bandwidth 2%  priority 4      qlimit 500 cbq (borrow red ecn)
queue   webftp  bandwidth 5%  priority 4      qlimit 500 cbq (borrow red ecn)
queue   games   bandwidth 5%  priority 3      qlimit 500 cbq (borrow red ecn)
queue   bitt    bandwidth 10% priority 2      qlimit 500 cbq (borrow red ecn)
queue   general bandwidth 3%  priority 1      qlimit 500 cbq (borrow red ecn default)
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh, ssh_login)
pass out quick on $ext_if inet proto tcp from any to any port 3389 modulate state queue (rdpvnc, ack)
pass out quick on $ext_if inet proto udp from any to any port 30340:30341 keep state queue (games, ack)
pass out quick on $ext_if inet proto udp from any to any port 6112 keep state queue (games, ack)
pass out quick on $ext_if inet proto tcp from any to any port 10050 modulate state queue (bitt, ack)
pass out quick on $ext_if inet proto (tcp, udp) from any to any keep state queue (general, ack)
 
pass in
pass out

Open in new window

0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 62

Expert Comment

by:gheist
ID: 22738067
Have you got altq and all schedulers in your kernel?
Try loading with pfctl -nvf that will give you exact line when problems occur with somewhat explaining error message
0
 

Author Comment

by:plexter2k
ID: 22740556
It was my understanding that OpenBSD comes with full support for PF right out of the box. Am I incorrect in this assumption?
0
 
LVL 62

Expert Comment

by:gheist
ID: 22743249
500 ethernet frames packets over 600kbps line would take 10 seconds to clear. I think autotuning of queue sizes is smarter than me and you.

I guess queue of line 30 exhausts resources of queue defined at line 28 (if both are syntactically correct at all)
0
 

Author Comment

by:plexter2k
ID: 22749051
Hello,

I have removed all the queue size limits as I don't really care about them anyhow.  At least not now or until I need to. :P

I tried starting with your pfctl -nvf ... and I see all the config pop up followed by the same error. "Syntax incorrect"

I believe there is a bit of a mistake here. I think line 30 is showing up wrong. Line 30 in my actual config is the first line of ALTQ (line 28 on this site)

altq on $ext_if cbq bandwidth 600Kb queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }

Is now how it should be reading.

I just don't get why it says syntax error.




0
 
LVL 62

Expert Comment

by:gheist
ID: 22749631
I am running priq with 3 classes and happy with that. No bw and queue accounting when configuring and all that.

Errors in initial post say:
children use more than IF bandwidth and more queue space than parent has.
0
 

Author Comment

by:plexter2k
ID: 22750021
Correct my original post was using HFSC queuing.

I have switched to CBQ as noted in the following post which did not produce near as many errors. I also noted that I think both CBQ and HFSC were having trouble for the same issue at hand now.

For some reason my main ALTQ statement is not accepted. This is causing all commands thereafter to produce errors because the PARENT queue no longer exists.


0
 

Author Comment

by:plexter2k
ID: 22750031
Also see the code I have modified my pf.conf to be even simpler with no queue limitations...etc manually set (noted above).

Once again the line numbers referenced in the code are not the same as those on the OpenBSD box.

#Interfaces
ext_if="fxp0"
int_if="fxp1"
 
#Options
set require-order yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
 
#Timeout Settings
set optimization aggressive
set timeout { frag 10, tcp.established 3600 }
set timeout { tcp.first 30, tcp.closing 10, tcp.closed 10, tcp.finwait 10 }
set timeout { udp.first 30, udp.single 30, udp.multiple 30 }
set timeout { other.first 30, other.single 30, other.multiple 30 }
set timeout { adaptive.start 5000, adaptive.end 10000 }
 
#Connection Normalization
 
scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp fragment reassemble
 
#Queuing ALTQ
#Upload assumed aprox 80kb or 640Kb queued aprox 94%
 
altq on $ext_if cbq bandwidth 600Kb queue { tos, voip, dns, ssh, webftp, bitt, general }
 
queue   tos     bandwidth 20% priority 7      cbq (borrow red) { ack, ssh_login }
                queue   ack             bandwidth 90%   cbq (borrow red)
                queue   ssh_login       bandwidth 10%   cbq (borrow red)
queue   voip    bandwidth 50% priority 6      cbq (borrow red)
queue   dns     bandwidth 7%  priority 5      cbq (borrow red)
queue   ssh     bandwidth 3%  priority 4      cbq (borrow red)
queue   webftp  bandwidth 5%  priority 4      cbq (borrow red)
queue   bitt    bandwidth 10% priority 2      cbq (borrow red)
queue   general bandwidth 5%  priority 1      cbq (borrow red default)
 
pass out quick on $ext_if inet proto udp from any to any port 5060 keep state queue (voip, ack)
pass out quick on $ext_if inet proto udp from any to any port domain keep state queue (dns, ack)
pass out quick on $ext_if inet proto tcp from any to any port ssh modulate state queue (ssh, ssh_login)
pass out quick on $ext_if inet proto tcp from any to any port 10050 modulate state queue (bitt, ack)
pass out quick on $ext_if inet proto { tcp, udp } from any to any keep state queue (general, ack)
 
pass in
pass out

Open in new window

0
 
LVL 62

Expert Comment

by:gheist
ID: 22750086
There is no problem with this one line:

altq on $ext_if cbq bandwidth 600Kb qlimit 500 queue { tos, dns, ssh, webftp, bitt, voip, rdpvnc, general }

qlimit 500 on next line actually uses all the interface queue and rest of rules do not load.

please disable all of ECN usage. That is feedback protocol and very unlikely to be working at 640kbps consumer line.
0
 
LVL 62

Expert Comment

by:gheist
ID: 22750094
this effectively disconnects you from the internet behind next router:
min-ttl 254


0
 

Author Comment

by:plexter2k
ID: 22750187
Okay what does that have to do with ALTQ?
0
 
LVL 62

Expert Comment

by:gheist
ID: 22750210
If you unplug network cable internet does not come into your house.

Can you post errors from pfctl -evf on that last config file. I have OpenBSD 3.5 where altq is outside PF, so I cannot help.
0
 

Author Comment

by:plexter2k
ID: 22753788
Hello again,

The box is already off of the net. It is not a production box yet since it does not work.

I thought I had already posted the error. SYNTAX ERROR on LINE 30 (28 on the above pf.conf)

altq on $ext_if cbq bandwidth 600Kb queue { tos, voip, dns, ssh, webftp, bitt, general }

0
 
LVL 62

Accepted Solution

by:
gheist earned 500 total points
ID: 22753959
It may count lines not commented or lines containing actual statements...
at least ipf did so long ago. so I suspect lines defining queues a bit further.

line you mentioned matches whats described in pf.conf manual page, so I assume no problem there.

what is with webftp queue ? May it complain it is not used hard way?
I am to install latest OpenBSD to do some testing on my own. expect more in couple of days.
0
 

Author Comment

by:plexter2k
ID: 22800319
Hello gheist,

I am not sure exactly what I've done but i tried PRIQ based off of someone elses script and that worked fine! Then I tried CBQ again but a little simpler than my original and it works fine now also!!! I HAVE NO IDEA what is different or why its working now, but it is!

So thanks for your input none the less. :)

I believe I should be fine for now...at least until I encounter a new mystery!
0
 
LVL 62

Expert Comment

by:gheist
ID: 22800575
If PRIQ does not do its job - i.e. high-priority class takes over all traffic and some other traffic gets stuck, go explore CBQ.
Basically CBQ is available on Hi-End routers, and does good there. Best home gateway devices do look similar to workings of PRIQ.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
is this a virus? 3 59
Laptop "remote wipe" -- stolen ? 10 111
capture vmstat info and insert it into an oracle table 31 39
Solaris acount issues 44 29
SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to moveā€¦

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question