OpenVPN SIP traffic for external phones.
-
I hope you guys can give a hand with this scenario:
I have a PBX running on my LAN with a SIP Trunk provided thru a private circuit (ONT) by my ISP.
The remote extensions/phones support OpenVPN, so they reach my internal PBX via the OpenVPN server running on PFSense. The purpose of this OpenVPN tunnel is exclusively for SIP/RTP traffic of external phones, nothing else.
I would like to use Traffic Shaper to allocate 20% of my bandwidth to the OpenVPN/SIP/RTP traffic from my external phones to the PBX.
We are aware the tunnel traffic is encrypted, and as far as I know the Traffic Shapper would not be able to prioritize the traffic of the SIP/RTP protocols.
What options do I have to accomplish this task?
Thank you
-
Just curious what phones you are using which support openvpn?
-
I'm using Yealink SIP-T21P E2
-
I messed around with the various traffic shaper options to provide QOS for my SIP phones but in the end the best one was simply putting CODELQ on the WAN and LAN interfaces.
CODELQ correctly configured removed the so called "buffer bloat" which in my case was causing a fair bit of random jitter on the SIP phones.
-
Thank you for your input pahowart.
Were you phones connected via OpenVPN or directly with SIP?
-
Unless you've changed from the default, OpenVPN uses UDP port 1194.
They traffic shaper needs to be configured to recognize this. It will be blind to actual SIP/RTP packets inside the OpenVPN since that is between the phones and the PBX.
You can use the shaper wizard to create a VoIP queue, and then use the floating rules to match source/dest + port and put it into the VoIP queue.
-
Hi awebster
Have you done this in a real world scenario?
Could you please detail how would this work?
Thank you!
-
What I've done in this case is create an interface and assign the openvpn interface to it. This way you're able to create rules on firewall floating tab which will match traffic inside the tunnel.
-
The easiest thing to do is just prioritize the OpenVPN tunnel itself. As has been said you will already have a rule for UDP/1194 (the default) on WAN so you can just set the queues there.
Keep in mind that you can queue what you send out WAN (uploads). Identifying how you queue out LAN (downloads) is more difficult. Especially with multiple LAN interfaces.
There are probably some magic numbers to get better latency but I haven't had much luck finding them.
Setting queues on an OpenVPN assigned interface to try to queue traffic inside the tunnel has resulted in a couple 100%-CPU-with-no-significant-traffic situations for me. Didn't really investigate very hard. I stopped the practice and just queue the tunnel traffic instead. YMMV.
-
Although this tunnel is for SIP only, I've found myself that you can never queue inbound openvpn traffic, besides its not possible to queue another type of traffic with @Derelict's solution. thats why you need an openvpn interface.
I hasn't experienced 100% cpu problem with my setups, something may be wrong with yours.
-
All I know is the problem started when I added queues to rules on my assigned interface and it stopped when I took them out.
Just throwing it out there.
-
@vianneyjs could you share the firewall rules? I am trying to achieve the same with Snom phones that support OpenVPN, however phones do not register FreePBX running on the LAN.
-
You probably want to start a new thread.
