Playing with fq_codel in 2.4
-
I wanted to check to see if anyone else is having issues with the newly released 2.4.5 (released 2020-03-26) using fq_codel. I had a perfectly working limiter setup with 2.4.4_3 and upgraded to 2.4.5 and now It will no longer load up the limiter, having the following in the logs:
- php-fpm[351]: /rc.filter_configure_sync: The command '/sbin/kldload dummynet' returned exit code '1', the output was 'kldload: can't load dummynet: No such file or directory'
- php-fpm[351]: /rc.filter_configure_sync: The command '/sbin/ipfw /tmp/rules.limiter' returned exit code '1', the output was 'Line 2: setsockopt(IP_DUMMYNET_CONFIGURE): Protocol not available'
I completely removed my limiters/queue and floating rule, recreated within the gui and the same occurs. Was the dummynet kernel module not built with the 2.4.5 release or can I manually add it back? I found an old thread that this happened within the builds back in 2010 but nothing else current. At this point limiters are dead for me due to the non existent dummynet kernel module.
uname info:
FreeBSD XXXXXXXXXX 11.3-STABLE FreeBSD 11.3-STABLE #236 21cbb70bbd1(RELENG_2_4_5): Tue Mar 24 15:26:53 EDT 2020 root@buildbot1-nyi.netgate.com:/build/ce-crossbuild-245/obj/amd64/YNx4Qq3j/build/ce-crossbuild-245/sources/FreeBSD-src/sys/pfSense amd64Just an FYI I resolved the issue incase anyone else encounters this. Not sure if it is the correct fix. but I utilize ZFS instead of UFS, and it appears the old /boot use to actually be /bootpool/boot but after upgrade to 2.4.5 it has a new /boot under the root filesystem. This new /boot did not contain the /boot/kernel subdirectory and kernel modules so I did the following and rebooted
mkdir /boot/kernel
# cp -p /bootpool/boot/kernel/* /boot/kernel/
# cp -p /boot/loader.conf /boot/loader.conf.orig
# cp /bootpool/boot/loader.conf /boot/loader.confThen rebooted and the system was able to load the dummynet kernel module - resolved.
-
This post is deleted! -
Hi @uptownVagrant - I have a quick question regarding your quick pass floating rule for echo-request and echo-reply from your configuration in post 815:
2.) Add quick pass floating rule to handle ICMP echo-request and echo-reply. This rule matches ping packets so that they are not matched by the limiter rules. See bug 9024 for more info.
Action: Pass
Quick: Tick Apply the action immediately on match.
Interface: WAN
Direction: any
Address Family: IPv4
Protocol: ICMP
ICMP subtypes: Echo reply, Echo Request
Source: any
Destination: any
Description: limiter drop echo-reply under load workaround
Click Save
I see that this rules also allows the firewall (WAN IP) to respond to pings from the internet. How would you change this rule to avoid that (i.e. only allow outgoing ping but not incoming)? Would it just be as simple as changing the Source from "any" to e.g. "WAN Address"?
Thanks in advance.
-
@tman222 setting direction to "out" and choose your gateway in advanced should give the result you want.
-
@bobbenheim said in Playing with fq_codel in 2.4:
@tman222 setting direction to "out" and choose your gateway in advanced should give the result you want.
Thanks @bobbenheim - that worked! I actually did try setting the direction on the rule to "Out" at first, but then outbound pings from LAN interfaces stopped working. Now I see why - I didn't realize I needed to set the gateway in advanced settings. Thanks again.
-
@gsakes @uptownVagrant etc. I've been looking for some coherent recommendations for zoom, especially, as to how to improve your videoconferencing experience. Also curious as to how just generic fq_codel is treating that for y'all?
Oy, what a long thread this has been!
-
Hi, I have a problem, if after enabling the limiter I start to download a game that saturates the band and in the meantime I perform a ping, the ping increases from 10 ms to 50 ms.
Here are the screenshots of the settings, my bandwidth is 120/20.
Should I change something?
spoiler
spoiler
-
@mikekoke Sorry my English, I play without problems with these settings, stable ping + or - 2ms of variation.
-
@mikekoke My result
-
Hi, thanks for the reply, but i have already tried to enable those two settings and the result does not change.
By doing the test on dslreports with the configuration shown in the screenshots i get three A + but if i download a game and at the same time i ping 8.8.8.8 the latency increases from 10 to 50 ms. -
@mikekoke I did the download test and I didn't have this problem.
-
When I did my tests I ran multiple downloads simultaneously to saturate the band.
-
@mikekoke Mystery.
-
when you say "downloading a game" do you mean, steam? Steam really abuses the network, opening 10 or more full rate flows, and even with cake, it's hard to beat them down.
-
Yes, Steam.
I'll try doing normal downloads.
Would the best settings be Tail Drop, FQ_Codel, Queue length at 10000 and ECN both on download and on upload or only on download? I read that the ECN annoys the upload.
The Queues of both on Tail Drop but without ECN and Queue length?
Sorry for the questions but I have read the discussion and there are many opinions on the matter. -
Does it still give the same issue when you reduce the headline bandwidth you have set in the limiters?
-
Yes, even if the bandwidth is reduced, the ping increases the same.
-
This post is deleted! -
@mikekoke Follow this tutorial that works great!
-
Have you tried changing the quantum to < 536 or 300?, I have had better success at these packet size quantums.
Albeit TCP suffers a bit with a 300 quantum.Also had more success with fq_pie with 300 quantum.
@ dev - fq_pie needs an area in the gui to change the quantum ,pls .
I also run fq_pie lan parents for voip and gaming with greater weights given to the udp in addition to the wan
pipes.I still cant figure out why pfsense wont perform as well with udp packets as a linux router does with QOS/cake on
without quantum changes ?.Edit ;
In testing I have found layer 3 tunnel,gre or openvpn works much better and avoids the tcp overhead,you wont notice as much fluctuation,even with the wan pipes setup as standard for voip and udp games.During full saturation of the pipe the voip and game jitter hardly varies from a no tcp load scenario. This shoudlnt have to be done but works better than cake,pie or fq_codel.Note ;If you try the openvpn method you will need to change the nat and firewall rules for udp to point through the vpn gateway.