Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Shaping within an OpenVPN tunnel

    Traffic Shaping
    2
    3
    1094
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netsysadmin last edited by

      Hello all,

      I am using pfSense 2.3.1-RELEASE-p1.
      I have a few IPsec and OpenVPN tunnels with other remote appliances.

      I have configured traffic shaping using HFSC.
      My objective is two-fold:

      • to reserve a minimum bandwidth for the VPN traffic relative to non-VPN traffic, or else, at least give higher priority to VPN traffic, and

      • to reserve a minimum bandwidth for a particular intra-VPN traffic, which I read may or may not work.

      So, I have tried to implement that.

      I have created a queue called qVPN-P15-PREM for the whole OpenVPN tunnel.
      I have created queues on the OPENVPN_FR_PARIS15 "virtual" interface, in order to reserve bandwidth for the particular traffic (my 2nd objective).
      See attached screenshots for better understanding.

      The reason I have created the queues to differentiate intra-VPN traffic on the OPENVPN_FR_PARIS15 "virtual" interface is because, in the logs I saw that I can "match" them there.
      On the WAN interface (WAN_MT_PREMIUM), I did not include the queues to differentiate intra-VPN traffic, as I'm already doing that on the OpenVPN virtual interface.

      What I can say is that, based on the floating rules I'm using, traffic seems to be going in the correct queues inside the VPN tunnel.

      My questions are:
      1. Even if the intra-VPN traffic seems to be going in the correct queues, given that the interface is not physical, at egress, will the WAN interface eventually "respect" the already-queued packets?
      2. Should I also include the child queues created on the OPENVPN_FR_PARIS15 "virtual" interface, on the WAN (WAN_MT_PREMIUM) interface as well?

      Any help is welcome.





      1 Reply Last reply Reply Quote 0
      • N
        netsysadmin last edited by

        Any help please?

        1 Reply Last reply Reply Quote 0
        • H
          Harvy66 last edited by

          1. The WAN knows nothing about the packets inside of the VPN tunnel. All it knows is the tunnel traffic goes into the VPN queue. As long as that queue has enough bandwidth assigned, all is well.
          2. The WAN knows nothing about the packets inside of the VPN tunnel. It won't be able to differentiate traffic for the different queues inside the tunnel.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy