QoS on Openvpn Interface not working

RouterOS General
1

I’m trying to setup Qos on an Openvpn Interface, my Queues and Mangle Table are matching but simple Queues are not working.
When I am connected via Openvpn to my router and using ssh, its very slow because of other traffic on this Interface

/interface ovpn-server
add name=ovpn-firma user=firma
/queue simple
add limit-at=256k/256k max-limit=384k/384k name=rest packet-marks=no-mark target=ovpn-firma
add limit-at=1M/1M max-limit=10M/10M name=ssh packet-marks=ssh-pkt priority=2/2 target=ovpn-firma
/ip firewall mangle
add action=mark-connection chain=output new-connection-mark=ssh-con passthrough=yes protocol=tcp src-address=192.168.1.1 src-port=22
add action=mark-packet chain=prerouting connection-mark=ssh-con new-packet-mark=ssh-pkt passthrough=yes

Please help

2

You could try using a Queue Tree.

3

You could indeed setup a tree on the ovpn interface, but remember that this is a virtual interface, and that it will encapsulate every packet into another. This encapsulation doesn’t carry over the initial markings.
So when the traffic is leaving real interface, you have no way to determine what traffic is inside the tunnel, only that it’s traffic related to tunnel.
On the real interface you can only prioritise the ovpn tunnel as a whole (or not).

4

perhaps i should go in more detail.
I am using the integrated web proxy on the router.
Over Openvpn I am using this web proxy for my browser.
If there are many connections to the proxy, the ssh connection to the router itself is very slow.
Therefore I wanted to priorize SSH more than the rest of traffic

5

You should understand that OpenVPN is a VPN over TCP, all of these (including SSTP) share “bad performance under load”.
When you throttle the datarate well under the maximum interface rate (e.g. using Queue Tree) there should be some improvement.
But it will never be completely OK until you use a VPN that can indvidually mark and re-order packets based on priority.
(e.g. GRE over IPsec with dscp=inherit option)

6

If the ssh session does NOT go over VPN, you can indeed prioritise it over vpn traffic. Simply assign a lower priority class to ssh traffic, and the queue tree will do the rest.

BUT remember that this needs to be implemented on the real outgoing interface.
AND
mark in post routing, as prerouting doesn’t apply to traffic leaving RB itself

add action=mark-packet chain=postrouting connection-mark=ssh-con new-packet-mark=ssh-pkt passthrough=yes out-interface=<???>