Playing with fq_codel in 2.4

provels

@daemonix I don't really know but I tried both and neither helped me any so I gave up. So just try and test and try again.

daemonix

@provels for me tail drop seems to give me stable low RRT.... CoDel is a bit erratic... this is weird as reading this paper makes me think different. Evaluation of the Impact of Packet Drops due to AQM over Capacity Limited Paths

Any ideas from the experts?

bobbenheim

@daemonix that paper has no relation to queue management with fq-codel in Pfsense, it compares different algorithms.
I have no clue what codel does if chosen as queue management under fq-codel, but i would just use drop tail as that is how fq-codel should react when latency increases, i.e. it should drop packets in large queues to keep latency low.

daemonix

@bobbenheim fair enough :) that indeed keeps the RRT from moving... so Im happy :)

daemonix

is there a reason why a basic fq_codel is behaving perfect with 20 parallel iperf uploads another 20 down (all together)... but then a "speedtest.net" test or google test sends the RTT up?!
Or a full torrent ubuntu alternative. Full download... no problem.

Is like some packets dont follow the rules...

daemonix

Hi, I have the floating rule and quick but Im getting problems with traceroute from Lan (not from the pfsense box). Am I missing something in my rules?!

5f123352-ab82-41cc-89ba-561290f487e1-Screenshot 2020-06-13 09.27.31.png

traceroute www.ntua.gr
traceroute to www.ntua.gr (147.102.224.101), 64 hops max, 52 byte packets
 1  XX (X)  4.054 ms  1.243 ms  1.275 ms
 2  www.ntua.gr (147.102.224.101)  8.807 ms  9.811 ms  10.076 ms
 3  www.ntua.gr (147.102.224.101)  15.286 ms  9.946 ms  9.692 ms
 4  * * *
 5  www.ntua.gr (147.102.224.101)  14.548 ms  13.996 ms  13.006 ms
 6  www.ntua.gr (147.102.224.101)  13.220 ms  15.703 ms  13.044 ms
 7  * www.ntua.gr (147.102.224.101)  45.182 ms  43.441 ms
 8  www.ntua.gr (147.102.224.101)  44.675 ms  44.498 ms  47.619 ms

bobbenheim

@daemonix what settings have you made within the floating rule?

uptownVagrant

@daemonix keep in mind that the traceroute program is likely using UDP unless you are instructing it to use ICMP.

daemonix

@bobbenheim @uptownVagrant

I updated the rule to take all ICMP. I dont have any block rule for UDP or TCP from LAN.
One thing I see in my WAN CODEL IN/OUT rule is that is "matching" very little numbers of packages or data. On the LAN site the main pass rule has gigabytes.
Maybe my problems start elsewhere?

Are floating matching rules for CODEL mirroring the LAN stats?

Screenshot 2020-06-15 10.21.47.png

bobbenheim

@daemonix have you set anything under in/out pipe in advanced options within your ICMP rule?

daemonix

@bobbenheim no no, only the gateway as I have a VPN out for some clients.

sikita

I read this thread and still I am not sure if floating rule for limiters shoud be "quick pass" or "match". Could someone explain which one is correct or if there is difference in use? Thanks

bobbenheim

@sikita pass rule is first match wins, match rules is last match wins, other than that you get the same result with both if setup correctly :)

daemonix

the weird thing is that with huge uploads or download (and torrents, iperf, rsync... for example) everything seems ok. RTT etc.

When Mac/Apple processes try to upload photos for example... then RTT goes way up. As if some packets dont go through the pipe.

How can I debug it better?

fabrizior

Just getting started with implementing an fq_codel limiter... could use some advise on how to interpret what's going on and how to tune if necessary please.

What might cause Ookla SpeedTest to only get 159 Mbps download when other speed tests are resulting in 320Mbps? Limiter info shows only one bucket, so why limited to ~<50% bandwidth in this particular app but not the web-based speed test?

When running the Ookla SpeedTest app from the same host (with 2x1gbps bonded eth, 24-core, 64GB RAM) as the dslreports web-based test, I'm only getting ~160/20Mbps results.

Limiter Info while running Ookla speedtest download:

Limiters:
00001: 350.000 Mbit/s    0 ms burst 0 
q131073 1000 sl. 0 flows (1 buckets) sched 65537 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN
 sched 65537 type FIFO flags 0x0 0 buckets 0 active
00002:  25.000 Mbit/s    0 ms burst 0 
q131074 1000 sl. 0 flows (1 buckets) sched 65538 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN
 sched 65538 type FIFO flags 0x0 0 buckets 0 active


Schedulers:
00001: 350.000 Mbit/s    0 ms burst 0 
q65537  50 sl. 0 flows (1 buckets) sched 1 weight 0 lmax 0 pri 0 droptail
 sched 1 type FQ_CODEL flags 0x0 0 buckets 1 active
 FQ_CODEL target 5ms interval 100ms quantum 1514 limit 10240 flows 1024 ECN
   Children flowsets: 1 
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 ip           0.0.0.0/0             0.0.0.0/0      101   151500  0    0   0
00002:  25.000 Mbit/s    0 ms burst 0 
q65538  50 sl. 0 flows (1 buckets) sched 2 weight 0 lmax 0 pri 0 droptail
 sched 2 type FQ_CODEL flags 0x0 0 buckets 1 active
 FQ_CODEL target 5ms interval 100ms quantum 1514 limit 10240 flows 1024 ECN
   Children flowsets: 2 
  0 ip           0.0.0.0/0             0.0.0.0/0       65     3380  0    0   0


Queues:
q00001 1000 sl. 0 flows (1 buckets) sched 1 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN
q00002 1000 sl. 0 flows (1 buckets) sched 2 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN

Limiter Info while running dslreports speedtest download:

Limiters:
00001: 350.000 Mbit/s    0 ms burst 0 
q131073 1000 sl. 0 flows (1 buckets) sched 65537 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN
 sched 65537 type FIFO flags 0x0 0 buckets 0 active
00002:  25.000 Mbit/s    0 ms burst 0 
q131074 1000 sl. 0 flows (1 buckets) sched 65538 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN
 sched 65538 type FIFO flags 0x0 0 buckets 0 active


Schedulers:
00001: 350.000 Mbit/s    0 ms burst 0 
q65537  50 sl. 0 flows (1 buckets) sched 1 weight 0 lmax 0 pri 0 droptail
 sched 1 type FQ_CODEL flags 0x0 0 buckets 1 active
 FQ_CODEL target 5ms interval 100ms quantum 1514 limit 10240 flows 1024 ECN
   Children flowsets: 1 
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 ip           0.0.0.0/0             0.0.0.0/0     16992 25461976 201 301500   2
00002:  25.000 Mbit/s    0 ms burst 0 
q65538  50 sl. 0 flows (1 buckets) sched 2 weight 0 lmax 0 pri 0 droptail
 sched 2 type FQ_CODEL flags 0x0 0 buckets 1 active
 FQ_CODEL target 5ms interval 100ms quantum 1514 limit 10240 flows 1024 ECN
   Children flowsets: 2 
  0 ip           0.0.0.0/0             0.0.0.0/0       57     2983  0    0   0


Queues:
q00001 1000 sl. 0 flows (1 buckets) sched 1 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN
q00002 1000 sl. 0 flows (1 buckets) sched 2 weight 0 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms ECN

Have followed these slides/video advise. Set queue length to 10000 rather than default. No other additional configuration of limiters/queues, etc...

Setup Slides: https://www.slideshare.net/NetgateUSA/pfsense-244-short-topic-miscellany-pfsense-hangout-august-2018
Setup Walkthrough: https://www.youtube.com/watch?v=o8nL81DzTlU&feature=youtu.be&t=377

Limits set up for 350/25 Mbps for starters with a single WAN to a Comcast Arris TG1682G in bridge mode.

When running https://dslreports.com/speedtest, I'm seeing the following:

Before configuration:

After configuration:

Floating Rules:

HW:
pfSense 2.4.5-RELEASE-p1 (amd64)
ProtectLI FW6 Vault, i5-7200U CPU @ 2.50GHz, 8GB , AES-NI CPU Crypto: Yes (active)
Packages Installed: pfBlockerNG-devel, ntopng, telegraf
Packages To-Do: suricata (not yet configured)
Outbound IPSec VPN (Oracle private cloud VCN interconnect configured, disabled)
OpenVPN inbound clients: no-connections

Ricardox

fabrizior

@Ricardox Not sure I understand the details in your post... the slide deck clearly says floating rule on WAN, not LAN.

What details / instructions am I missing?

Any ideas about the bandwidth limit difference between a web-based dslreports speedtest versus the Ookla speed test app?

Ricardox

This post is deleted!

Ricardox

Ookla without problems, but in Wan we will have loss of icmp packages.

Larrikin

Hi all. I'm looking for help.

I am in Australia and we have a National Broadband Network (NBN) that everyone connects to. I have a fibre connection which has 1000mbits down and 400mbits up.

The problem I have is that the NBN have a very strict policy enforcer on uploads that aggressively drops packets and the effective upload speed I get is 250mbps (because it bursts initially and them immediately drops way back). This happens on all devices I've tried - my environment is largely macOS.

So I tried two things:

I borrowed a network switch that had packet shaping enabled for upstream and I easily got 360+mbps when using it. So that proves with packet shaping, I can get ahead of the NBN policer and stopping it from ever impacting me by setting my shaping to kick in at 380mbps. Note that the NBN has 5ms before it kicks in.

I have since removed the network switch and have been playing with pfsense using CODEL and FQ_CODEL. I run a very decently spec'd PC that would in no way bottle neck. The CPU goes to around 4% max.

With CODEL and FQ_CODEL I am getting 300mbps upload. Never higher.

Without CODEL and FQ_CODEL I get 250mbps.

Why can't I get 360+mbps like I did with the network switch? Have I missed something in my config?

Here are my screenshots:

Parent upload shaper (note I don't need a download one as those speeds are fine):
https://imgur.com/a/xFkUVLd
https://imgur.com/a/Xi5g5m0
https://imgur.com/a/00FireZ

Child upload shaper:
https://imgur.com/a/rSzhiN6
https://imgur.com/a/0aysaXQ