4 ms·

I have a lot of respect for those who know iptables well enough to make things like this. It looks so fascinating, but so complex.

by x0 10y ago

peatmoss 10y ago
Me too! As others in the thread have mentioned, OpenBSD and pf make for a (IMHO) much easier configuration. Not sure what kind of difference in performance one might expect. I suspect both Linux and OpenBSD are more than capable of keeping up with any traffic one might throw at such a router.
- wtallis 10y ago
  BSD is at a huge disadvantage in QoS capability, to the point that it really shouldn't be recommended as the OS for the gateway on a typical low-speed bufferbloated residential ADSL or DOCSIS connection.
  - zxv 10y ago
    I don't see any disadvantages of BSD for QoS. I believe the syntax for writing QoS on FreeBSD and OpenBSD provides very good expressive capability [1]. By using tagging [2], one can assign QoS priority to anything that a firewall rule can define. Having used FreeBSD QoS on dial-up, ISDN, DSL and cable over the years, it is this expressiveness that is one of the reasons I prefer the pf packet filter and thus BSD. Here's an example for bandwidth limited wan. Interactive ssh sessions get a queue with a minimum bandwidth; scp and sftp bulk transfers go to a separate queue. queue rootq on em0 bandwidth 100M max 100M queue ssh parent rootq bandwidth 20M queue ssh_interactive parent ssh bandwidth 10M min 5M queue ssh_bulk parent ssh bandwidth 10M queue std parent rootq bandwidth 20M default block return out on em0 inet all set queue std pass out on em0 inet proto tcp from any to any port 22 set queue(ssh_bulk, ssh_interactive) [1] PF - Packet Queueing and Prioritization http://www.openbsd.org/faq/pf/queueing.html http://www.openbsd.org/faq/pf/queueing.html [2] PF - Packet Tagging (Policy Filtering) http://www.openbsd.org/faq/pf/tagging.html http://www.openbsd.org/faq/pf/tagging.html
    - ADSSDA 10y ago
      What's the actual queuing algorithm in use? My experience with BSD QoS has been that it's easy to set up, but far inferior to the more modern QoS options in Linux (fq_codel, etc). I just wish tc had an interface understandable by your average sysadmin. I have to dig into the source to figure out what anything does, but not many users will have the ability/desire to do that.
    - wtallis 10y ago
      OpenBSD doesn't support any form of Active Queue Management or fair queuing. It used to support an old and mostly useless AQM (RED) but dropped support in 5.6. Now there isn't even a way to apply ECN marking. A hierarchy of dumb FIFO queues does not make a real QoS system. It can produce reasonable-looking benchmark numbers when the prioritization rules and benchmark are contrived to match, but in the face of real-world traffic that uses HTTP to carry vastly different kinds of traffic over links that don't have constant bandwidth and latency, OpenBSD is hopeless. Even the rate-limiting capability that OpenBSD has is rudimentary and lacks the ability to account for per-packet overhead and framing overhead, which is necessary for accurate traffic shaping on common service types like ADSL. If you say you don't see any disadvantages for OpenBSD on QoS, then your idea of QoS is twenty years out of date.
      - zxv 10y ago
        FreeBSD and PFSense do currently have ECN. I should have limited my comments to them. You're right, OpenBSD no longer has ECN, and my comments regarding OpenBSD were out of date. And yes, ECN is far more effective because it provides feedback to the sender.
        wtallis 10y ago
        Yes, they've got ECN capability, if you're satisfied with RED as your AQM. pfSense apparently also has an implementation of plain CoDel. Work is also underway to bring fair queuing to the BSD world so that networks with more than one simultaneous traffic flow can get some good QoS: http://caia.swin.edu.au/freebsd/aqm/ http://caia.swin.edu.au/freebsd/aqm/ All of the BSDs are still way behind; the best by only a few years, while others are stuck in the 1990s.

I have a lot of respect for those who know iptables well enough to make things like this. It looks so fascinating, but so complex.

by x0 10y ago

I have a lot of respect for those who know iptables well enough to make things like this. It looks so fascinating, but so complex.

peatmoss 10y ago

Me too! As others in the thread have mentioned, OpenBSD and pf make for a (IMHO) much easier configuration. Not sure what kind of difference in performance one might expect. I suspect both Linux and OpenBSD are more than capable of keeping up with any traffic one might throw at such a router.

wtallis 10y ago
BSD is at a huge disadvantage in QoS capability, to the point that it really shouldn't be recommended as the OS for the gateway on a typical low-speed bufferbloated residential ADSL or DOCSIS connection.
- zxv 10y ago
  I don't see any disadvantages of BSD for QoS. I believe the syntax for writing QoS on FreeBSD and OpenBSD provides very good expressive capability [1]. By using tagging [2], one can assign QoS priority to anything that a firewall rule can define. Having used FreeBSD QoS on dial-up, ISDN, DSL and cable over the years, it is this expressiveness that is one of the reasons I prefer the pf packet filter and thus BSD. Here's an example for bandwidth limited wan. Interactive ssh sessions get a queue with a minimum bandwidth; scp and sftp bulk transfers go to a separate queue. queue rootq on em0 bandwidth 100M max 100M queue ssh parent rootq bandwidth 20M queue ssh_interactive parent ssh bandwidth 10M min 5M queue ssh_bulk parent ssh bandwidth 10M queue std parent rootq bandwidth 20M default block return out on em0 inet all set queue std pass out on em0 inet proto tcp from any to any port 22 set queue(ssh_bulk, ssh_interactive) [1] PF - Packet Queueing and Prioritization http://www.openbsd.org/faq/pf/queueing.html http://www.openbsd.org/faq/pf/queueing.html [2] PF - Packet Tagging (Policy Filtering) http://www.openbsd.org/faq/pf/tagging.html http://www.openbsd.org/faq/pf/tagging.html
  - ADSSDA 10y ago
    What's the actual queuing algorithm in use? My experience with BSD QoS has been that it's easy to set up, but far inferior to the more modern QoS options in Linux (fq_codel, etc). I just wish tc had an interface understandable by your average sysadmin. I have to dig into the source to figure out what anything does, but not many users will have the ability/desire to do that.
  - wtallis 10y ago
    OpenBSD doesn't support any form of Active Queue Management or fair queuing. It used to support an old and mostly useless AQM (RED) but dropped support in 5.6. Now there isn't even a way to apply ECN marking. A hierarchy of dumb FIFO queues does not make a real QoS system. It can produce reasonable-looking benchmark numbers when the prioritization rules and benchmark are contrived to match, but in the face of real-world traffic that uses HTTP to carry vastly different kinds of traffic over links that don't have constant bandwidth and latency, OpenBSD is hopeless. Even the rate-limiting capability that OpenBSD has is rudimentary and lacks the ability to account for per-packet overhead and framing overhead, which is necessary for accurate traffic shaping on common service types like ADSL. If you say you don't see any disadvantages for OpenBSD on QoS, then your idea of QoS is twenty years out of date.
    - zxv 10y ago
      FreeBSD and PFSense do currently have ECN. I should have limited my comments to them. You're right, OpenBSD no longer has ECN, and my comments regarding OpenBSD were out of date. And yes, ECN is far more effective because it provides feedback to the sender.
      - wtallis 10y ago
        Yes, they've got ECN capability, if you're satisfied with RED as your AQM. pfSense apparently also has an implementation of plain CoDel. Work is also underway to bring fair queuing to the BSD world so that networks with more than one simultaneous traffic flow can get some good QoS: http://caia.swin.edu.au/freebsd/aqm/ http://caia.swin.edu.au/freebsd/aqm/ All of the BSDs are still way behind; the best by only a few years, while others are stuck in the 1990s.