Community discussions

MikroTik App
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

VPN and QOS Queue Tree

Sat Feb 24, 2018 11:37 pm

I have 192.168.2.0/24 set up to go through a vpn(pptp client) and would like for it to go through the queue tree.

Does anyone have any ideas on how to mangle the packet marks for qos?
Last edited by HzMeister on Mon Feb 26, 2018 6:34 am, edited 4 times in total.
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 12:18 am

Your post does not fully explain your end goal, but maybe this will help.

more defined mangle rules, I.e.
1. Src address = pptp address, dst address = local subnet, mark pkt = X
2. Src address = pptp address, dst address = Internet, mark pkt = y
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 1:28 am

I'm trying to get all 192.168.2.0/24 traffic to go through the vpn and the queue tree. If you mangle the routing marks before the packet marks, the packet marks aren't utilized in the queue tree. If the routing marks are after the packet marks, the vpn doesn't work.

Here is the relevant part of my config to get a better idea of what I'm trying to do:
(I've simplified it and cleaned it up a bit so it's easier to read)

/interface pptp-client
add connect-to=(vpn ip address) disabled=no name=vpnservice password=pass user=username

/queue tree
add max-limit=50M name=download parent=bridge queue=default
add max-limit=10M name=upload parent=ether1 queue=default
add name=lan-down packet-mark=lan-pk parent=download priority=1 queue=pcq-download-default
add name=lan-up packet-mark=lan-pk parent=upload priority=1 queue=pcq-upload-default
add name=vpn-down packet-mark=vpn-pk parent=download priority=2 queue=default
add name=vpn-up packet-mark=vpn-pk parent=upload priority=2 queue=default

/ip firewall mangle
add action=mark-connection chain=prerouting new-connection-mark=lan-con passthrough=yes src-address=192.168.1.0/24
add action=mark-packet chain=prerouting connection-mark=lan-con new-packet-mark=lan-pk passthrough=no
add action=mark-connection chain=prerouting new-connection-mark=vpn-con passthrough=yes src-address=192.168.2.0/24
add action=mark-packet chain=prerouting connection-mark=vpn-con new-packet-mark=vpn-pk passthrough=yes
add action=mark-routing chain=prerouting new-routing-mark=vpn passthrough=no src-address=192.168.2.0/24

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=vpn out-interface=vpnservice
/ip route
add distance=1 gateway=vpnservice routing-mark=vpn
Last edited by HzMeister on Mon Feb 26, 2018 1:13 am, edited 1 time in total.
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 1:43 am

Evening

You can combine action if previous actions are "passthrough", meaning they will not terminate traversal of the rules.
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 2:02 am

Thanks for the replies so far. I've disabled all other mangle rules and have distilled it down to two rules which I thought should logically work.

add action=mark-routing chain=prerouting new-routing-mark=vpn passthrough=yes src-address=192.168.2.0/24
add action=mark-packet chain=prerouting new-packet-mark=vpn-pk passthrough=no routing-mark=vpn

Unfortunately packets aren't showing up in the queue tree... It seems like the routing mark sends the packets towards the vpn before it hits the queue tree even though they have a packet mark.
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 2:06 am

The regular route and the route to vpn send the packets over same outgoing interface = ether1?

That is what the upload queue assumes, as it is linked to ether1.
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 2:35 am

yes all upload goes through ether1
(download through bridge on ether2)
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 2:46 am

And no vlans involved either? That would also invalidate current queue tree def.

Another thing to try:
* connection/route mark in prerouting
* packet mark in postrouting

Only one choice for first, multiple for last.
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 3:15 am

There are no vlans.
If I set a connection mark before the routing mark, the vpn doesn't work.
If I set the packet mark to postrouting with respect to the routing mark as shown:

add action=mark-routing chain=prerouting new-routing-mark=vpn passthrough=yes src-address=192.168.2.0/24
add action=mark-packet chain=postrouting new-packet-mark=vpn-pk passthrough=no routing-mark=vpn

...the queue tree doesn't register the packet marks

I also attached a screenshot of a simplified routes/addresses to give you a better picture of what it looks like. Maybe it's possible to mark the packet after they get routed through the vpn but before they go to the queue tree?

Image
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 12:15 pm

I may be missing something, but:
  • when the packet towards the destinations routed via VPN comes from LAN, it has the original source and destination sockets and passes through firewall tables with them, and is routed via the virtual pptp-client interface
  • as it passes through the virtual interface, it is encapsulated into a brand new packet with new source and destination socket, which passes again through the firewall tables with the new source and destination, and is routed via the physical interface
Now do you want to prioritize various kinds of packets among all those routed via VPN, or do you want to prioritize the VPN packets among all those routed via ether1?
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 12:39 pm

Hi HzMeister

You omitted the crucial part that the vpn is actually a virtual interface on the router itself. Any packet sent to it, will be encapsulated and any tags defined on it will not propagate to the retransmitted wrapping packet.

If you want to prioritise outgoing/upload traffic within the vpn tunnel, you should attach a separate queue tree to vpn interface.
If you want to prioritise outgoing/upload traffic of the vpn as a whole, you'll need to mark the vpn tunnel traffic.

I'm guessing the latter one, and in that case, the packets will be originating from router on the output and will be routed to ether1. You'll need to adjust the packet marks accordingly.
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 7:07 pm

Thanks for your suggestions. I didn't realize the packet marks were dropped when they went through the vpn. Here are all the mangle rules for the vpn:

add action=mark-routing chain=prerouting comment=vpn new-routing-mark=vpn-rt passthrough=no src-address=192.168.2.0/24
add action=mark-packet chain=prerouting in-interface=vpn new-packet-mark=vpn-dn passthrough=no
add action=mark-packet chain=output new-packet-mark=vpn-up out-interface=ether1 passthrough=no

I had to mark the packet in both directions to get it to work, but I'm not sure if this is the best way of doing it. Is there a better/more efficient way, or is this it?
 
sindy
Forum Guru
Forum Guru
Posts: 10205
Joined: Mon Dec 04, 2017 9:19 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 7:39 pm

Thanks for your suggestions. I didn't realize the packet marks were dropped when they went through the vpn. Here are all the mangle rules for the vpn:

add action=mark-routing chain=prerouting comment=vpn new-routing-mark=vpn-rt passthrough=no src-address=192.168.2.0/24
add action=mark-packet chain=prerouting in-interface=vpn new-packet-mark=vpn-dn passthrough=no
add action=mark-packet chain=output new-packet-mark=vpn-up out-interface=ether1 passthrough=no

I had to mark the packet in both directions to get it to work, but I'm not sure if this is the best way of doing it. Is there a better/more efficient way, or is this it?
It is still not completely clear to me what is the goal.
  • The first rule marks packets from 192.168.2.0/24 for routing via VPN, fine.
  • The last rule marks for queueing any packet leaving through ether1 from local interfaces of the router, which means encapsulated VPN traffic as well as anything the router may eventually want to send itself (like DNS queries if it acts as a DNS proxy), fine.
  • But why the second rule should be necessary for it to work is not clear to me - are you throttling packets which come via VPN to leave more bandwidth for other download traffic? Because if you want to prioritize them instead, it cannot work as priority depends on the sending remote side.
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 7:42 pm

The last one
add action=mark-packet chain=output new-packet-mark=vpn-up out-interface=ether1 passthrough=no
will mark any packet from router itself to eth1 as from vpn. This might not be a big issue, but just saying...

If you look at https://en.wikipedia.org/wiki/Point-to- ... escription, you'll notice that data is actually carried over GRE (protocol 47).

So if you adjust the rule above to only match protocol 47 (+ maybe also tcp to port 1723), you'll be golden.

this is as efficient as it gets, as all packets needs marking.
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS - routing mark and packet mark at the same time?

Sun Feb 25, 2018 7:47 pm

[*]But why the second rule should be necessary for it to work is not clear to me - are you throttling packets which come via VPN to leave more bandwidth for other download traffic? Because if you want to prioritize them instead, it cannot work as priority depends on the sending remote side.
To be able to control bandwidth, one have to account for it all. That's what that rule is for: all packets with that tag will be accounted for under the right leaf of queue tree.
 
HzMeister
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 73
Joined: Sun Jan 28, 2018 9:48 pm

Re: VPN and QOS - routing mark and packet mark at the same time?

Mon Feb 26, 2018 12:31 am

These are the mangle rules that I ended up with for qos and vpn:

add action=mark-routing chain=prerouting comment=vpn-rt new-routing-mark=vpn-rt passthrough=no src-address=192.168.2.0/24
add action=mark-connection chain=prerouting comment=vpn-con-dwn connection-mark=no-mark in-interface=vpn new-connection-mark=vpn-con-dwn passthrough=yes
add action=mark-packet chain=prerouting comment=vpn-pk-dwn connection-mark=vpn-con-dwn new-packet-mark=vpn-pk-dwn passthrough=no
add action=mark-packet chain=output comment=vpn-pk-up new-packet-mark=vpn-pk-up out-interface=ether1 passthrough=no protocol=gre

I also found that hotspot-default(sfq) to work better for me than the pcq queue type I was using before.
Last edited by HzMeister on Tue Apr 03, 2018 6:12 am, edited 1 time in total.
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: VPN and QOS Queue Tree

Mon Feb 26, 2018 10:09 am

I've a different experience with QoS. I think it's time to do: /export hide-sensitive

Who is online

Users browsing this forum: CGGXANNX, stanisljevic and 84 guests