Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Playing with fq_codel in 2.4

    Scheduled Pinned Locked Moved Traffic Shaping
    1.1k Posts 123 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bobbenheim @Zeny001
      last edited by

      @Zeny001 try setting queue management algorithm under the queues to Tail drop and see if that helps.

      Z 1 Reply Last reply Reply Quote 1
      • Z
        Zeny001 @bobbenheim
        last edited by Zeny001

        @bobbenheim

        Wow. That did it. From C bufferbloat on DSLreports to A+.

        Thanks a bunch. For anyone having trouble remember to uncheck ECN since tail drop does not support it

        I lost about 300mbps of bandwidth though.

        I have a gigabit connection and I'm getting about 600mbps now, was getting 900ish before. I dont really care though, but if anyones got any tips let me know :)

        B 1 Reply Last reply Reply Quote 0
        • B
          bobbenheim @Zeny001
          last edited by

          @Zeny001 you could try lowering limit by a factor of ten and increase flows by the same and see if that makes a difference.

          1 Reply Last reply Reply Quote 0
          • J
            jgalak
            last edited by

            Just wanted to say thanks - I applied the technique in the video and my Bufferbloat and Quality on the DSL reports test went from C/C to A/A+. Hopefully this will resolve some weird network issues I've been having.

            1 Reply Last reply Reply Quote 0
            • T
              tman222 @uptownVagrant
              last edited by

              @uptownVagrant - wanted to thank you for posting these detailed steps on how to setup FQ-CoDel using floating rules.

              https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4/815

              Originally I had FQ-CoDel setup on my LAN interfaces, but using floating rules the approach is definitely simplified. Everything is working great and as expected. I use Linux so do run into the issue with traceroute (mentioned earlier in this thread) because UDP is used by default. Easily worked around though by using traceroute -I instead (which will use ICMP). Do you have any suggestions how to modify the floating rules so that traceroute using UDP might work properly?

              Thanks in advance.

              B T 2 Replies Last reply Reply Quote 0
              • R
                Ricardox
                last edited by

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • R
                  Ricardox
                  last edited by

                  Não tive mais problemas depois que fiz essa configuração :

                  Imagem.png

                  1 Reply Last reply Reply Quote 0
                  • B
                    bobbenheim @tman222
                    last edited by

                    @tman222 using traceroute in windows gives the same problem, the only solution so far seems to be making a rule omitting ICMP traffic from FQ-CoDel.
                    Weird thing is that it works fine with IPfire which i briefly tried some months ago, so it might be something with the FreeBSD implementation of it.

                    1 Reply Last reply Reply Quote 0
                    • T
                      tomashk @tman222
                      last edited by

                      @tman222 said in Playing with fq_codel in 2.4:

                      Do you have any suggestions how to modify the floating rules so that traceroute using UDP might work properly?

                      For me the following works:
                      Create floating rule with limiters (with match action) not on "WAN out" but on "LAN/VLAN in" (in one floating rule you can select multiple interfaces/vlans) for traffic with source "any" and destination "not-your-local-networks-alias" - that works great for me, and for my easy setup I need only one floating rule for all my VLANS and with "in" traffic you don't need to set gateway.

                      Unfortunately it won't work for traffic with source IP of your pfsense router

                      1 Reply Last reply Reply Quote 0
                      • K
                        kasper93 @uptownVagrant
                        last edited by kasper93

                        @uptownVagrant said in Playing with fq_codel in 2.4:

                        1.) Add quick pass floating rule to handle ICMP traceroute. This rule matches ICMP traceroute packets so that they are not matched by the WAN-Out limiter rule that utilizes policy routing. Policy routing breaks traceroute.

                        Are you guys actually sure it is this issue? The linked doc page and bug #932 is quite the opposite what we see here. It makes perfect sense that policy routing in certain cases does not decrease TTL making router (pfsense box) invisible in traceroute, but the rest of the hops looks ok.

                        Our issue is that it shows only one hop which is destination and nothing else. Which arguably doesn't make sense. Have anyone actually look into it or just found not quite similar traceroute issue and call it a day?

                        With Limiter:

                          1    <1 ms    <1 ms    <1 ms  <...> [192.168.0.1]
                          2     *        *        *     Request timed out.
                          3    11 ms    14 ms     8 ms  one.one.one.one [1.1.1.1]
                          4    12 ms    11 ms    12 ms  one.one.one.one [1.1.1.1]
                          5    12 ms    14 ms    18 ms  one.one.one.one [1.1.1.1]
                          6    13 ms    13 ms    11 ms  one.one.one.one [1.1.1.1]
                          7    13 ms    10 ms    11 ms  one.one.one.one [1.1.1.1]
                          8    55 ms    54 ms    54 ms  one.one.one.one [1.1.1.1]
                          9    49 ms    49 ms    51 ms  one.one.one.one [1.1.1.1]
                         10    37 ms    37 ms    56 ms  one.one.one.one [1.1.1.1]
                         11    55 ms    52 ms    50 ms  one.one.one.one [1.1.1.1]
                        

                        Without Limiter:

                          1    <1 ms    <1 ms    <1 ms  <...> [192.168.0.1]
                          2     *        *        *     Request timed out.
                          <removed some hops, but they are properly shown>
                          8    55 ms    53 ms    50 ms  ae-12.r24.amstnl02.nl.bb.gin.ntt.net [129.250.3.81]
                          9    59 ms    54 ms    53 ms  ae-7.r03.amstnl02.nl.bb.gin.ntt.net [129.250.2.103]
                         10    58 ms    59 ms    60 ms  81.20.65.150
                         11    56 ms    64 ms    56 ms  one.one.one.one [1.1.1.1]
                        
                        1 Reply Last reply Reply Quote 0
                        • P
                          PNet
                          last edited by PNet

                          I wanted to check to see if anyone else is having issues with the newly released 2.4.5 (released 2020-03-26) using fq_codel. I had a perfectly working limiter setup with 2.4.4_3 and upgraded to 2.4.5 and now It will no longer load up the limiter, having the following in the logs:

                          • php-fpm[351]: /rc.filter_configure_sync: The command '/sbin/kldload dummynet' returned exit code '1', the output was 'kldload: can't load dummynet: No such file or directory'
                          • php-fpm[351]: /rc.filter_configure_sync: The command '/sbin/ipfw /tmp/rules.limiter' returned exit code '1', the output was 'Line 2: setsockopt(IP_DUMMYNET_CONFIGURE): Protocol not available'

                          I completely removed my limiters/queue and floating rule, recreated within the gui and the same occurs. Was the dummynet kernel module not built with the 2.4.5 release or can I manually add it back? I found an old thread that this happened within the builds back in 2010 but nothing else current. At this point limiters are dead for me due to the non existent dummynet kernel module.

                          uname info:
                          FreeBSD XXXXXXXXXX 11.3-STABLE FreeBSD 11.3-STABLE #236 21cbb70bbd1(RELENG_2_4_5): Tue Mar 24 15:26:53 EDT 2020 root@buildbot1-nyi.netgate.com:/build/ce-crossbuild-245/obj/amd64/YNx4Qq3j/build/ce-crossbuild-245/sources/FreeBSD-src/sys/pfSense amd64

                          Just an FYI I resolved the issue incase anyone else encounters this. Not sure if it is the correct fix. but I utilize ZFS instead of UFS, and it appears the old /boot use to actually be /bootpool/boot but after upgrade to 2.4.5 it has a new /boot under the root filesystem. This new /boot did not contain the /boot/kernel subdirectory and kernel modules so I did the following and rebooted
                          mkdir /boot/kernel
                          # cp -p /bootpool/boot/kernel/* /boot/kernel/
                          # cp -p /boot/loader.conf /boot/loader.conf.orig
                          # cp /bootpool/boot/loader.conf /boot/loader.conf

                          Then rebooted and the system was able to load the dummynet kernel module - resolved.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kasper93
                            last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 0
                            • T
                              tman222 @uptownVagrant
                              last edited by

                              Hi @uptownVagrant - I have a quick question regarding your quick pass floating rule for echo-request and echo-reply from your configuration in post 815:


                              2.) Add quick pass floating rule to handle ICMP echo-request and echo-reply. This rule matches ping packets so that they are not matched by the limiter rules. See bug 9024 for more info.

                              Action: Pass
                              Quick: Tick Apply the action immediately on match.
                              Interface: WAN
                              Direction: any
                              Address Family: IPv4
                              Protocol: ICMP
                              ICMP subtypes: Echo reply, Echo Request
                              Source: any
                              Destination: any
                              Description: limiter drop echo-reply under load workaround
                              Click Save


                              I see that this rules also allows the firewall (WAN IP) to respond to pings from the internet. How would you change this rule to avoid that (i.e. only allow outgoing ping but not incoming)? Would it just be as simple as changing the Source from "any" to e.g. "WAN Address"?

                              Thanks in advance.

                              B 1 Reply Last reply Reply Quote 0
                              • B
                                bobbenheim @tman222
                                last edited by

                                @tman222 setting direction to "out" and choose your gateway in advanced should give the result you want.

                                T 1 Reply Last reply Reply Quote 0
                                • T
                                  tman222 @bobbenheim
                                  last edited by

                                  @bobbenheim said in Playing with fq_codel in 2.4:

                                  @tman222 setting direction to "out" and choose your gateway in advanced should give the result you want.

                                  Thanks @bobbenheim - that worked! I actually did try setting the direction on the rule to "Out" at first, but then outbound pings from LAN interfaces stopped working. Now I see why - I didn't realize I needed to set the gateway in advanced settings. Thanks again.

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    dtaht
                                    last edited by

                                    @gsakes @uptownVagrant etc. I've been looking for some coherent recommendations for zoom, especially, as to how to improve your videoconferencing experience. Also curious as to how just generic fq_codel is treating that for y'all?

                                    Oy, what a long thread this has been!

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mikekoke
                                      last edited by

                                      Hi, I have a problem, if after enabling the limiter I start to download a game that saturates the band and in the meantime I perform a ping, the ping increases from 10 ms to 50 ms.
                                      Here are the screenshots of the settings, my bandwidth is 120/20.
                                      Should I change something?

                                      Screenshot (183).png spoiler

                                      Screenshot (184).png spoiler

                                      Screenshot (185).png

                                      Screenshot (186).png

                                      R 2 Replies Last reply Reply Quote 0
                                      • R
                                        Ricardox @mikekoke
                                        last edited by

                                        @mikekoke Sorry my English, I play without problems with these settings, stable ping + or - 2ms of variation.

                                        Imagem -1.png Imagem -2.jpg

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          Ricardox @mikekoke
                                          last edited by

                                          @mikekoke My result

                                          Imagem -3.jpg

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mikekoke
                                            last edited by

                                            Hi, thanks for the reply, but i have already tried to enable those two settings and the result does not change.
                                            By doing the test on dslreports with the configuration shown in the screenshots i get three A + but if i download a game and at the same time i ping 8.8.8.8 the latency increases from 10 to 50 ms.

                                            R 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.