Playing with fq_codel in 2.4



  • @superbree:

    Would love to try this patch out.  This will show fq_codel on the limiter info page?  Is there are kind soul who could explain how to implement this to the lay person?

    You need "System patches" package.
    Create new patch and apply it. See attachment.



  • LAYER 8 Global Moderator

    I got asked in a PM to post some screenshots of my settings.. Figured post it here as reference.

    Just apply the in/out pipe to firewall rule on your interface.. So that these do not effect your intervlan traffic if you have any.  Put a rule above to allow access to your other vlans without the pipe's applied.

    These settings changed my bufferbloat tests on dslreports to A..




  • Why a /32 IPv4 mask?


  • LAYER 8 Global Moderator

    Because that is what comes up in the gui when  this is the rules.limiter

    [2.4.0-RELEASE][root@pfsense.local.lan]/root: cat /tmp/rules.limiter

    pipe 1 config  bw 85Mb
    queue 1 config pipe 1 mask dst-ip6 /128 dst-ip 0xffffffff

    pipe 2 config  bw 11Mb
    queue 2 config pipe 2 mask src-ip6 /128 src-ip 0xffffffff

    Is something wrong there?  It was working great!!!



  • Haha, I don't know to be honest. I had mine set the same way until I noticed that, then set it to /24 to match my network (I'm IPv4 only). I haven't been on that network in awhile now but I don't remember noticing a difference. My config is otherwise pretty much the same as yours.

    Maybe someone can chime in on whether that setting matters or not and exactly what it is doing?

    I know that in some parts of traffic shaping GUI there are options presented that don't apply to all types of shaping.


  • LAYER 8 Global Moderator

    The person that asked for the screenshot says its working great for him as well..

    I just am not knowledgeable enough when it comes to shaping and limiters to know one way or the other either. I understand the basic principles is about all.  I just took the settings as given and applied them to my bandwidth at the time and yeah it drastically reduced the bufferbloat test without noticing any serious hit to the top end numbers on speedtest or during normal use.

    But to be honest I had not really noticed any issues before that ;)  Other than the test showing me my bufferbloat was bad..

    Looking forward to when I can apply it to my new 500/50 line when get new pfsense hardware.  I can tell you for sure that on the usg that currently stuck with that when you turn on their smart queues my download is limited to 80ish down vs the 530 I see on speedtest currently.  Seems to handle the upload ok but the download gets shit on..



  • Yikes, that's pretty limited!


  • LAYER 8 Global Moderator

    Which is why its not on ;)  When you turn on their queues you loose the hardware offload it seems.. So yeah speed takes a hit ;)



  • And that is why I am thankful for pfSense!


  • LAYER 8 Global Moderator

    Oh believe me I will be back to pfsense as soon as get new hardware that can handle the speed.. The usg was a temp solution that was cheap enough to sneak through the budget committee (wife).. its was only a 100$ ;)

    It can handle the speed in hardware offload.. But its feature set is so lacking.. Still running my pfsense vm for dhcp and dns since those features on usg need a huge amount of work to be viable in anything other than the most basic of home user networks.. And really just forget about ipv6 and or openvpn without manipulate of json files and having to reload them any time you reprovision the usg from the controller.. And the firewall rules are just nuts to setup on it as well..  I counting the days til I have pfsense back that is for sure ;)



  • I ran this on my router at my LAN party and it worked out great.  184 people with a 300mbit modem and 2 100mbit modems , made 2 download shapers and 1 upload shaper.

    i made the system patches as well so it would apply after updates.



  • I should skip this since I don't know what I'm doing but still really curious to make it work. I have gigabit service and get D's and F's on buffer bloat.

    I'm sure its in the post and I have indeed read though but still don't understand. What are the steps to enable this? I have 2.4 installed.

    Looks like install patches package, run patch posted on page 8 which I was going to do until it said I could not remove this so I thought I better study a bit before I keep going. If you have the energy, please tell me what are the steps and I will follow them. Thanks.



  • You don't have to install the patch.

    Just set up limiters (look at Johns screenshots a few pages above this) then run the ipfw commands for fq_codel and add them to shellcmd.

    Run a speed test and set your limiters to 95% of the speeds you get.

    Now go to your firewall rules to pass traffic and in the advanced section just select the queues you just made.

    That's it.



  • @belt9:

    You don't have to install the patch.

    Just set up limiters (look at Johns screenshots a few pages above this) then run the ipfw commands for fq_codel and add them to shellcmd.

    Run a speed test and set your limiters to 95% of the speeds you get.

    Now go to your firewall rules to pass traffic and in the advanced section just select the queues you just made.

    That's it.

    I don't think it's that simple. If you don't override rules.limiter with own one like TS suggests by patching php code, then any firewall config or even WAN IP change that wants and would reload this file will destroy your manually configured fq_codel, until you manually run ipfw commands again or restart firewall to let shellcmd to do it. Am I wrong?


  • LAYER 8 Global Moderator

    No sorry it is that simple.. You do not need to make any files changes at all..  Just create the limiters and then put in the commands via shellcmd to put them in every time you reboot, etc.



  • Yeah, I just tried adding and deleting firewall rules then checking ipfw and it still has my fq_codel flows.

    If there's some other action you're worried might remove fq_codel then just try doing that action then check ipfw after to see if fq_codel is still in place.

    ipfw sched show
    


  • OK so may be quick start quide?

    1. RTFM for FQ_CODEL http://caia.swin.edu.au/freebsd/aqm/patches/README-0.2.1.txt
    2. Config limiters (pipes) via GUI.
    3. View /tmp/rules.limiter

    for example it will be

    
    pipe 1 config  bw 280576Kb
    queue 1 config pipe 1 mask src-ip6 /128 src-ip 0xffffffff
    
    pipe 2 config  bw 280576Kb
    queue 2 config pipe 2 mask dst-ip6 /128 dst-ip 0xffffffff
    
    

    4. USE shellcmd package to recreate pipes with commands like

    
    ipfw pipe flush
    
    ipfw pipe 1 config  bw 280576Kb
    ipfw sched 1 config pipe 1 type fq_codel target 7ms quantum 2000 flows 2048
    ipfw queue 1 config pipe 1 mask src-ip6 /128 src-ip 0xffffffff
    
    ipfw pipe 2 config  bw 280576Kb
    ipfw sched 2 config pipe 2 type fq_codel target 7ms quantum 2000 flows 2048
    ipfw queue 2 config pipe 2 mask dst-ip6 /128 dst-ip 0xffffffff
    
    

    5. Add your limiters to firewall rules (IN/OUT pipes), this step can be any after step 2 actually.

    Is it correct?
    Maybe it's better to run script at startup? Just placing it into /usr/local/etc/rc.d? I found that using shellcmd is a little bit uncomfortable with multiple command lines at once, have I missed something?



  • Excuse my ignorance on this. I've just learned about and started using pfSense a couple weeks ago.

    I have my limiters attached to my "Default allow LAN to any rule" in order to evenly split bandwidth to my LAN clients. And then fq_codel applied to those limiters. Seems to be working great for reducing bufferbloat, ensuring low latency for all clients, etc. Thanks for all the guidance in this thread!

    Is there any benefit or harm to doing it that way vs. attaching the limiters to a floating rule as @johnpoz did?

    Also, how does all this apply to OpenVPN clients (with pfSense as the server)? Would either setup also work with the OpenVPN clients, or is one setup better than the other?

    Thanks for all your help!



  • Floating rules vs interface rules won't make a difference. It will also work well on VPN clients. VPN traffic will always have higher latency relative to the same traffic not routed through a VPN. fq_codel can't fix that, but it will still work with fairly queuing the traffic and reducing bufferbloat.



  • I came back here to say thanks because it works well. I completed my setup differently than some of what has just been posted.

    I setup limiters just as seen in the screenshots. (post 121)(upload, download, wan, lan)
    I ran the single command for IPFW pipes. (ipfw sched 1 config pipe 1 type fq_codel && ipfw sched 2 config pipe 2)
    I installed shellcmd and added the single IPFW statement.
    Modified the two stock LAN firewall rules (IPV4 and IPV6 advanced configuration) so that wan and lan would be used just as seen in the screenshots.
    I restarted the firewall.

    That is all I have done. Prior my buffer bloat was a D to F. Post I get an A each time. I may/may not be setup correctly but whatever it is works. I originally used the wizard for setup of traffic shaping which used HFSC and which gave @425 upload on my gigabit connection. This new setup gives @750. So, good for me.



  • Definitely I am blind what screenshots are you all talking about? :D



  • @w0w:

    Definitely I am blind what screenshots are you all talking about? :D

    Reply 121 of this thread.



  • Thanks.  :)



  • @belt9:

    Floating rules vs interface rules won't make a difference. It will also work well on VPN clients. VPN traffic will always have higher latency relative to the same traffic not routed through a VPN. fq_codel can't fix that, but it will still work with fairly queuing the traffic and reducing bufferbloat.

    I tested floating rules vs. lan rules and they both give excellent results. Latency results in bufferbloat tests seemed to be just slightly lower with the lan rules, but that's just splitting hairs.

    I had very poor bufferbloat results when testing through my OpenVPN connection as a client connected to the OpenVPN server in pfSense. Is there any way to fix this? Should I be creating limiters to apply to the OpenVPN interface rules in the firewall and then selecting fq_codel on those limiters, as well?



  • Yes you would need to apply limiters to your openvpn interface in order to queue your clients traffic. However, you can only fix your end, if the client is connecting to you via a poor connection then you can't get any better than the worst link.



  • @belt9:

    Yes you would need to apply limiters to your openvpn interface in order to queue your clients traffic. However, you can only fix your end, if the client is connecting to you via a poor connection then you can't get any better than the worst link.

    Thanks, that makes sense.
    I’ll try it out and see how much it helps.



  • Finally got around to trying this again, and everything worked great!  John's screenshots in reply 121 are spot on and there is no need to edit any files if one uses shellcmd.

    I actually recently changed to a 100/100 Fiber connection - here are results (using the DSL Reports speed test which has a nice Bufferbloat check):

    Before (no shaping):

    Using ALTQ FAIRQ + Codel Active Queue Management; 100Mbit Limit on Both WAN and LAN:

    Using fq_codel and 100Mbit Limit on Both Upload and Download:

    What's interesting to me here is that fq_codel appears to perform a bit better than the ALTQ emulation of fq_codel (using FAIRQ + Codel) - I find this very interesting.  Anyone have any thoughts as to why?

    I also ran a more intense FLENT test on another system with fq_codel enabled and the results looked great as well (stable ping and stable download/upload over the course of the test).

    Given the relatively little effort required to get this to work on pfSense, it's a fantastic way to improve the stability of a connection.



  • @tman222:

    Finally got around to trying this again, and everything worked great!  John's screenshots in reply 121 are spot on and there is no need to edit any files if one uses shellcmd.

    I actually recently changed to a 100/100 Fiber connection - here are results (using the DSL Reports speed test which has a nice Bufferbloat check):

    Before (no shaping):

    Using ALTQ FAIRQ + Codel Active Queue Management; 100Mbit Limit on Both WAN and LAN:

    Using fq_codel and 100Mbit Limit on Both Upload and Download:

    What's interesting to me here is that fq_codel appears to perform a bit better than the ALTQ emulation of fq_codel (using FAIRQ + Codel) - I find this very interesting.  Anyone have any thoughts as to why?

    I also ran a more intense FLENT test on another system with fq_codel enabled and the results looked great as well (stable ping and stable download/upload over the course of the test).

    Given the relatively little effort required to get this to work on pfSense, it's a fantastic way to improve the stability of a connection.

    As I understand it, the biggest difference between FAIRQ + CoDel and fq_codel is that fq_codel individually applies codel to each per-flow pseudo-queue while FAIRQ + CoDel applies codel to the entire queue. There are also other subtle differences between codel and fq_codel, like the "fq" in fq_codel being a bit smarter than standard "fair queueing".

    Either way, the 4ms difference you observed in best-case latency could just be a fluke.

    Thanks for sharing the comparisons, btw.



  • I really don't get much difference. I was using OPNSense and fq_codel prior as it seemed to just work better for me.

    With the new release, I changed back and just use HFSC queues with codel checked and some very basic rules to make sure my gaming traffic is first and my non important (downloads for media and other odd plex related download stuff) is limited. Works like a champ.

    Only thing for me always comes back to making sure my upload and download limits match close to reality what I expect out of my link so I use 940 down and 880 on Verizon's Gigabit FIOS with 1000 queue. No drops and no bufferbloat that I've been able to make happen.



  • Thanks all for the feedback.  i do have a quick follow up question as I think that I may have misconfigured something:

    I actually ended up creating two limiters, one at 100Mbit up/down, the other at 25Mbit up/down to use on a guest network.  Went through the same process and enabled fq_codel on the second set of limiters.  Applied the limiters inside the firewall rules on the guest network, but for some reason when I try to test out the configuration with a machine on the guest network I'm able to go faster than the limited speed of 25Mbit.  However, the interesting thing is that does not seem to be consistent - for instance:

    1. When running a speedtest on speedtest.net I'm limited to just 25Mbit (as expected)
    2. When running a speedtest on DSLReports I'm able to go well beyond 25Mbit (almost to full speed).

    I haven't been able to try an iperf3 test yet unfortunately.  Could it be that something is misconfigured and that the 25Mbit limit is applied per flow vs. the queue as a whole?

    Thanks in advance for any insight you might have.

    P.S. Some thoughts regarding fq_codel vs. FAIRQ + Codel:  At least in my case, using fq_codel consistently results in a bufferbloat average (for both upload/download) under 10ms.  Using FAIRQ + Codel it often goes beyond that, but never higher than 15-20ms.  Ultimately, I suppose it's not really a big deal, but I found it interesting nonetheless.



  • @tman222:

    Thanks all for the feedback.  i do have a quick follow up question as I think that I may have misconfigured something:

    I actually ended up creating two limiters, one at 100Mbit up/down, the other at 25Mbit up/down to use on a guest network.  Went through the same process and enabled fq_codel on the second set of limiters.  Applied the limiters inside the firewall rules on the guest network, but for some reason when I try to test out the configuration with a machine on the guest network I'm able to go faster than the limited speed of 25Mbit.  However, the interesting thing is that does not seem to be consistent - for instance:

    1. When running a speedtest on speedtest.net I'm limited to just 25Mbit (as expected)
    2. When running a speedtest on DSLReports I'm able to go well beyond 25Mbit (almost to full speed).

    I haven't been able to try an iperf3 test yet unfortunately.  Could it be that something is misconfigured and that the 25Mbit limit is applied per flow vs. the queue as a whole?

    Thanks in advance for any insight you might have.

    P.S. Some thoughts regarding fq_codel vs. FAIRQ + Codel:  At least in my case, using fq_codel consistently results in a bufferbloat average (for both upload/download) under 10ms.  Using FAIRQ + Codel it often goes beyond that, but never higher than 15-20ms.  Ultimately, I suppose it's not really a big deal, but I found it interesting nonetheless.

    Looks like the issue I was experiencing has to do with the Squid Proxy running on the guest network.  Similar to what was described here:

    https://forum.pfsense.org/index.php?topic=132960.0

    I'll go ahead and start a separate thread as I may need some help  configuring the proper rules to get this work.



  • Implementing fq_codel improved the dsl reports TO A AND B  but USING hfsc and CODEL I get better results  ALL A+, I tried a linux distro with fq_codel got same A,B and sometime C  but again with Pfsense HFSC and codel I get all A+, so for me I am getting better results with HFSC and Codel



  • @Chrismallia:

    Implementing fq_codel improved the dsl reports TO A AND B  but USING hfsc and CODEL I get better results  ALL A+, I tried a linux distro with fq_codel got same A,B and sometime C  but again with Pfsense HFSC and codel I get all A+, so for me I am getting better results with HFSC and Codel

    Did you configure manually or use the wizard? I used the wizard with HFSC selected and received better grades on dslreports but speed was much lower overall. The scores were better because the throttle was more aggressive. Would you be willing to share your config? Screenshots maybe. I would like to compare what I get using fq_codel as described in this thread.



  • It's possible that HFSC+ALTQ gives better rate limiting characteristics compared to IPFW.



  • @gsmornot:

    @Chrismallia:

    Implementing fq_codel improved the dsl reports TO A AND B  but USING hfsc and CODEL I get better results  ALL A+, I tried a linux distro with fq_codel got same A,B and sometime C  but again with Pfsense HFSC and codel I get all A+, so for me I am getting better results with HFSC and Codel

    Did you configure manually or use the wizard? I used the wizard with HFSC selected and received better grades on dslreports but speed was much lower overall. The scores were better because the throttle was more aggressive. Would you be willing to share your config? Screenshots maybe. I would like to compare what I get using fq_codel as described in this thread.

    Sure in dsl buffer bloat test I get half the speed but thats cos if it goes over that speed I get buffer bloat , but running a  normal speed test with same setup I get my full speed, so I only get half with dsl reports so for me HFSC and codel are  doing a fine Job but I am sure many more experts here can correct me. A other thing using ipfw limiters when using  the full upload speed it does not give example enough bandwidth plex remote users need, in hfsc it takes bandwidth from example the upload backup to the cloud and gives plex itS full 5mbps it needs






  • I have fq_codel working on my system without issue.  I followed the screenshots from post #121.

    Question:

    If I apply the same lan / wan queues to the In / Out on my IPsec interface rule will bandwidth then be shared evenly between multiple IPsec clients?

    I have several people that access server resources and it would be great if the bandwidth was shared evenly when everyone was trying to perform a get operation.

    Thanks



  • to the guys saying they only had to enable in cli and "nothing" else.

    You didnt do this step?

    Start with a recent 2.4 snapshot. Create two root limiters, Download and Upload, and put 95% your maximum values in bandwidth. Create two queues under each, say LAN and WAN. For LAN, selection destination addresses for mask and source addresses for WAN. Modify the default outgoing firewall rule to use WAN under "in" pipe and LAN under "out" pipe.

    Also the limiter is surviving all filter reload's?



  • @chrcoluk:

    to the guys saying they only had to enable in cli and "nothing" else.

    You didnt do this step?

    Start with a recent 2.4 snapshot. Create two root limiters, Download and Upload, and put 95% your maximum values in bandwidth. Create two queues under each, say LAN and WAN. For LAN, selection destination addresses for mask and source addresses for WAN. Modify the default outgoing firewall rule to use WAN under "in" pipe and LAN under "out" pipe.

    Also the limiter is surviving all filter reload's?

    Yes I did that step. When I say I only used the command line I mean I did not install a patch of any kind. I use Shellcmd package to run the command line again each time my system boots.



  • Part of the challenge is trying to figure out what gives better performance is your ISP and what may or may not be going on with your local network.

    I've got a 1Gb FIOS line and a pretty 'quiet' neighborhood so I tend to get a very consistent speed for up and download when I'm testing. Since it's not a pure 'lab' scenario, you can't really be sure of the variables in your testing.

    I've noticed:

    • FQ_Codel seems to have a bit less overhead than HFCS/Codel
    • If I get my upload and download speeds set properly, I can straight A+s on any buffer bloat tests
    • If I have multiple things going on or something not configured correctly, I tend to get problems
    • If you are using a straight up limiter and equally sharing bandwidth across all LAN connections for an example, you won't see your max upload/download as you have it shared equally. To that point, in OPNSense, you would configure a limiter and "weight" your FW rules to prioritize what you wanted.

    My rules would look like something like:

    
    Limiters:
    10000: 940.000 Mbit/s    0 ms burst 0 
    q75536  50 sl. 0 flows (1 buckets) sched 10000 weight 0 lmax 0 pri 0 droptail
     sched 75536 type FIFO flags 0x0 0 buckets 0 active
    10001: 880.000 Mbit/s    0 ms burst 0 
    q75537  50 sl. 0 flows (1 buckets) sched 10001 weight 0 lmax 0 pri 0 droptail
     sched 75537 type FIFO flags 0x0 0 buckets 0 active
    
    Queues:
    q10002  50 sl. 0 flows (1 buckets) sched 10001 weight 100 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms NoECN
    q10003  50 sl. 0 flows (1 buckets) sched 10001 weight 10 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms NoECN
    q10000  50 sl. 0 flows (1 buckets) sched 10000 weight 100 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms NoECN
    q10001  50 sl. 0 flows (1 buckets) sched 10000 weight 10 lmax 0 pri 0  AQM CoDel target 5ms interval 100ms NoECN
    
    

    Which created some buckets and than weighted by my firewall rules.

    I try to use the concept simple is better as I have very limited rules and only really lower my plex download traffic and prioritize my gaming traffic. Everything else just falls into the defaults.



  • @Animosity022:

    To that point, in OPNSense, you would configure a limiter and "weight" your FW rules to prioritize what you wanted.

    It works the same way in pfSense. I weight my guest Network to 10% of my bandwidth.
    So if there is no lan traffic then guest can use all the bandwidth. When someone on lan starts using bandwidth then it will throttle guest all the way until they get down to 10% as necessary.
    It's great, limits without wasting bandwidth. Of course you can set hard limits as well if you need to.


Log in to reply