• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Bufferbloat - Load balancing VPN gateway group

Traffic Shaping
4
21
2.1k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    bobbenheim @discy
    last edited by Apr 14, 2020, 11:38 AM

    @discy If you go to Interfaces > Assignments you get this

    login-to-view

    If the gateway exists on the interface it shouldn't matter, but it is not something i have tested. Using the same limiter is something you want as you only, i assume, have one internet connection and this doesn't change when adding VPN.

    1 Reply Last reply Reply Quote 0
    • B
      bobbenheim @AndyW
      last edited by Apr 14, 2020, 11:40 AM

      @AndyW How does your rules look like?

      1 Reply Last reply Reply Quote 0
      • A
        AndyW
        last edited by Apr 14, 2020, 11:59 AM

        login-to-view login-to-view login-to-view login-to-view

        I have also added another floating rule including the Ipvanish as the gateway however no change.

        B 1 Reply Last reply Apr 14, 2020, 12:26 PM Reply Quote 0
        • A
          AndyW
          last edited by Apr 14, 2020, 12:09 PM

          One thing I did notice was if don't pull routes and don't add/remove routes are checked the problem goes away. This however in my instance causes issues with the vpn not always starting correctly.

          login-to-view

          1 Reply Last reply Reply Quote 0
          • B
            bobbenheim @AndyW
            last edited by Apr 14, 2020, 12:26 PM

            @AndyW one thing that sticks out and i'm not sure it makes a difference is you used "Quick" on a match rule which doesn't have an effect. Could you try and make your floating rules Pass instead. Also do you have separate queues for your WAN and IPVanish?

            1 Reply Last reply Reply Quote 0
            • A
              AndyW
              last edited by Apr 14, 2020, 1:20 PM

              Hi @bobbenheim I tried the settings with pass and "quick" disabled however the issue still persists. I also tried clearing the states to be on the safe side.
              As regards to the floating rules i have created both wan and ipvanish rules however the issue is still persist.

              1 Reply Last reply Reply Quote 0
              • D
                discy
                last edited by discy Apr 26, 2020, 1:00 PM Apr 14, 2020, 1:59 PM

                I ended up with the setup below.
                It solved my throttling and latency issues on full load (down+up) on VPN and WAN combined and seperate. ☺

                • Individual queue and limiter configuration based on this youtube guide.
                • Download limit: 70%
                • Upload: 70%
                • Multiple queues configured like this:
                  login-to-view

                Test results
                WAN Line: 100d/10u
                login-to-view

                • Bufferbloat test: http://www.dslreports.com/speedtest
                • Network-load upload: https://testmy.net/upload (Manual: 100mb)
                • Network-load download: https://speed.hetzner.de/10GB.bin
                1 Reply Last reply Reply Quote 0
                • T
                  TheNarc
                  last edited by Apr 21, 2020, 3:20 PM

                  @discy did you manage to solve your issue with VPN interface gateway monitoring with this configuration? As far as I can tell my configuration is the same as yours, but when I saturate VPN client traffic the gateway monitoring for my VPN interfaces spikes and takes them offline. I've spent several hours trying various things but nothing seems to have an effect, so I'm left wondering if I'm just going to need to disable the monitoring action on the VPN interfaces and consider them always online, which is clearly not desirable. Thanks in advance for any advice.

                  1 Reply Last reply Reply Quote 0
                  • D
                    discy
                    last edited by discy May 2, 2020, 3:02 PM Apr 21, 2020, 5:00 PM

                    Did you try to limit your upload/download speeds some more?

                    Upload bandwidth needed to perform a download within the tunnel isn't taken into account with these limiters.

                    It seems we have to find a balance between available bandwidth from LAN that goes through the tunnel and overhead on the tunnel connection.
                    For me on an TCP OpenVPN tunnel this means 60% upload + 70% download limit within tunnel itself (set-up as above).

                    I added a schedule to the limiter so upload backup during the night can use 80%.

                    1 Reply Last reply Reply Quote 0
                    • T
                      TheNarc
                      last edited by Apr 21, 2020, 5:40 PM

                      @discy Thanks for the information. I wasn't sure if I was missing something fundamental, but it sounds like I just need to lower the bandwidth on my limiters more, which I'll try today. Appreciate the response!

                      1 Reply Last reply Reply Quote 0
                      • T
                        TheNarc
                        last edited by Apr 22, 2020, 4:07 AM

                        Well, I don't know, I took my 100/10 connection all the way down to 50/5 and still a flent rrul_torrent test on the VPN client was taking down its gateway monitoring hard. Maybe this makes sense insofar as a VPN client connection is going to be have highly variable bandwidth (i.e. an unloaded server may give me a full 100Mbps down, but at another time when it's near capacity only give me about 10Mbps). I don't know enough about the subject to determine whether that makes sense.

                        I did try running rrul_torrent after configuring the gateway monitoring to take no action (always consider the gateway to be up) and got rather odd ping results. Not sure how to interpret them frankly.

                                                            avg       median          # data pts
                         Ping (ms) ICMP           :      4353.47      3882.00 ms              320
                         Ping (ms) UDP BE         :         1.56        87.41 ms               41
                         Ping (ms) UDP BK         :         1.61        40.95 ms               21
                         Ping (ms) UDP EF         :         0.13        42.59 ms                1
                         Ping (ms) avg            :      1089.19      3825.35 ms              325
                        
                        
                        D 1 Reply Last reply Apr 22, 2020, 7:15 AM Reply Quote 0
                        • D
                          discy @TheNarc
                          last edited by discy May 2, 2020, 3:02 PM Apr 22, 2020, 7:15 AM

                          @TheNarc definitely not what I'm seeing in my setup. Probably something related to your VPN connection. My latency isn't affected at all.
                          Did you try TCP Tunnel? I'm having latency issues and changes in speed as well when combining torrent with UDP tunnel.

                          I wouldn't disable gateway monitoring, ping should just work and is a usefull quality indicator.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.