Trafic Shaping issue

thomas7467

Hi All,

I've configured an OpenVPN tunnel between 2 sites with 2 Pfsense 2.2-release boxes :

Site A: LAN 192.168.92.0/24
Site B : LAN 192.168.93.0/24

Tunnel works fine.

Site B hosts an Alcatel OXO (IP 192.168.93.2).
Site hosts an Alcatel IP Phone (IP 192.168.92.9).
IP communication work fine through OpenVPN.

Now, I'm trying to use Trafic shaping to allow 20% bandwith for Voip.

I've used the trafic shaper wizard for initial configuration. I've created 2 floating rules, for using Qvoip for all trafic coming from my IPphone.

But during ipphone calls testing the trafic won't use the queues I've configured - what could be wrong in my configuration?

Thank you,

Best regards,

Thomas

1.JPG_thumb
2.JPG_thumb

doktornotor

Pardon me… how exactly do you imagine the shaper to see the encrypted traffic?

Derelict

If the VPN is primarily used for VoIP, then you can just prefer the OpenVPN traffic as if it were VoIP. In fact it's easier because all the RTP, etc are in one firewall state.

How you set that up is determined by which site is the server and which is the client.

And it's easier if you only shape in one direction. Or shape sent traffic at both ends.

If you want to shape different types of traffic within the OpenVPN tunnel, things get a lot more complicated. I think I got it sort of working but I had OpenVPN instances spinning 100% CPU after a time. Removing the shaping fixed that. At this point in time I'd consider it a not-ready-for-production hack.

If you really want to shape VPN traffic differently, you might consider one tunnel for voice and one for everything else. This would probably involve Voice VLANs at each site.

thomas7467

Hi,

Thank you for your replies - Sorry doktornotor, you've probably never been a newbie ;) I thought shapping would happen before encryption for LAN sent traffic.

Initially, I wanted to sent DATA and VoIP through VPN. according to your replies, I think I'll try to do my configuration like this :

DATA through VPN
VoIP through WAN without encryption, but with use of shaping, that should work?

Following your advice Derelict, I shoud shape sent traffic at both ends, OpenVPN server and client sides?
My goal is to connect 4 remote sites to a main sites, hosting Alcatel OXO and Data server.

Thks,

Thomas