cake-qos-simple sets up instances of cake based on wan egress and ingress and provides a simple means to leverage the diffserv functionality in cake using DSCPs, which is useful when bandwidth is constrained.
- DSCPs can be set either by LAN clients and/or by the router on upload and are restored from conntracks on download; and
- cake is set up on upload (wan egress) and download (ifb based on wan) and packets are tinned according to their DSCPs
The principle of operation of cake-qos-simple is as follows:
- set up an intermediate functional block for use with wan ingress (ifb-wan); and
- mirror packets from wan ingress to ifb-wan having restored DSCPs from the conntracks
- optionally overwrite ECN bits on upload and/or download
- set up cake on wan egress (for upload) and on ifb-wan (for download)
- set up appropriate nftables rules
This facilitates the optional use of the diffserv functionality in cake for improving qos when bandwidth is constrained by leveraging connection tracking (conntrack) in Linux.
To make use of this optional diffserv functionality, DSCPs must be: a) written to packets on upload by LAN clients or route; and b) written to conntracks on upload for restoration on download
This service script:
- writes out a default customizable config file
- writes out a default customizable nftables file
- creates necessary interfaces/tc calls on start/stop
- loads/unloads the nftables rules on start/stop
- checks the nftables rules before loading
cake-qos-simple is configured using a simple configuraiton file kept in /root/cake-qos-simple/
cake-qos-simple generated an initial default nftables script nft.rules , which provides a template for classifying DSCPs in the router and storing DSCPs set on upload (wan egress) in the router of by LAN clients in conntracks for restoration on download (wan ingress). This diagram is useful to understand the nftables script:
Source: https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks
This script requires at least the following packages:
- tc-tiny
- kmod-ifb
- kmod-sched
- kmod-sched-core
- kmod-sched-cake
- kmod-sched-ctinfo
To install:
- install requisite packages as required
- place cake-qos-simple in /etc/init.d
- chmod +x cake-qos-simple
- place 11-cake-qos-simple in /etc/hotplug.d/iface/
- chmod +x 11-cake-qos-simple
- generate default config in /root/cake-qos-simple/config using:
service cake-qos-simple gen_config
- edit default configuration lines in config to set interface(s), CAKE parameters and nftables variables (will be imported to auto-generated nft.rules file)
- generate default nftables rules based on config in /root/cake-qos-simple/nft.rules using:
service cake-qos-simple gen_nft_rules
- optionally edit the default nftables rules in nft.rules as desired
- if using an OpenWrt version earlier than 23.05, edit nft.rules to replace the lines underneath 'chain store-dscp-in-conntrack' as directed in the comments
- service cake-qos-simple enable
- service cake-qos-simple start
- verify correct operation by running
service cake-qos-simple status
,service cake-qos-simple download
andservice cake-qos-simple upload
and optionally by running tcpdump with the -v switch to inspect TOS values in packets
Here is a guide to completing the above steps in your SSH client.
Firstly, install the requisite packages:
opkg update && opkg install tc-tiny kmod-ifb kmod-sched kmod-sched-core kmod-sched-cake kmod-sched-ctinfo
Next, obtain the service script 'cake-qos-simple' and set the executable bit:
wget -O /etc/init.d/cake-qos-simple "https://raw.githubusercontent.com/lynxthecat/cake-qos-simple/master/cake-qos-simple"
chmod +x /etc/init.d/cake-qos-simple
Next, generate a default config file in /root/cake-qos-simple/:
service cake-qos-simple gen_config
Next, edit the cake-qos-simple service script to set interface(s), CAKE parameters and nftables variables:
vi /root/cake-qos-simple/config
Next, generate a default nft.rules file in /root/cake-qos-simple/:
service cake-qos-simple gen_nft_rules
Next, optionally edit the nftables rules and/or if using an OpenWrt version earlier than 23.05, edit nft.rules to replace the lines underneath 'chain store-dscp-in-conntrack' as directed in the comments:
vi /root/cake-qos-simple/nft.rules
Next, install the hotplug script and set the exectuable bit:
wget -O /etc/hotplug.d/iface/11-cake-qos-simple "https://raw.githubusercontent.com/lynxthecat/cake-qos-simple/master/11-cake-qos-simple"
chmod +x /etc/hotplug.d/iface/11-cake-qos-simple
And to use cake-qos-simple - see
root@OpenWrt-1:/# service cake-qos-simple
Syntax: /etc/init.d/cake-qos-simple [command]
Available commands:
start Start the service
stop Stop the service
restart Restart the service
reload Reload configuration files (or restart if service does not implement reload)
enable Enable service autostart
disable Disable service autostart
enabled Check if service is started on boot
cake-qos-simple custom commands:
status show status summary
upload show stats for upload interface
download show stats for download interface
gen_config generate default config
gen_nft_rules generate default nftables rules based on config
So e.g.:
# Start cake-qos-simple
service cake-qos-simple start
# Stop cake-qos-simple
service cake-qos-simple stop
# Check download stats
service cake-qos-simple download
# Check upload stats
service cake-qos-simple upload
# Check status
service cake-qos-simple status
# Generate default config
service cake-qos-simple gen_config
# Generate default nft.rules based on config
service cake-qos-simple gen_nft_rules
There are situations in which it is desirable to prevent cake from marking rather than dropping packets.
Firstly, see discussion on OpenWrt forums around here.
Secondly, whenever an ISP bleaches ECN bits (which is common for mobile operators), the bleaching occurs prior to cake on download, but after cake on upload - thus cake is blind to the bleaching in the upload direction, and this means that by default cake will mark packets on upload in response to saturation, which is futile because the ISP ultimately bleaches those markings anyway. So in this situation it strikes me as better to proactively scrub the ECN bits on upload before cake sees the packets to prevent cake form ineffectively marking the ECN bits.
cake-qos-simple facilitates overwriting ECN bits before the cake instances see the packets on upload and/or download.
This is controlled by setting appropriate values for:
overwrite_ecn_val_ul=0 # overwrite existing ecn bits with decimal value (e.g. 0, 1, 2, 3), else "" to disable
overwrite_ecn_val_dl=0 # overwirte existing ecn bits with decimal value (e.g. 0, 1, 2, 3), else "" to disable
- amend the PROTO_DPORT_DSCP_MAP variable in the config:
# correspondence between protocol, destination port and DSCPs
define PROTO_DPORT_DSCP_MAP = {
tcp . 53 : goto dscp_set_voice, # DNS
udp . 53 : goto dscp_set_voice, # DNS
tcp . 853 : goto dscp_set_voice, # DNS-over-TLS
udp . 853 : goto dscp_set_voice, # DNS-over-TLS
udp . 123 : goto dscp_set_voice # NTP
}
as required to assign DSCPs out of bulk, besteffort, video and voice in dependence of protocol 'tcp' or 'udp' and destination port.
- amend nft.rules with any further desired nftables rules.
This can optionally override anything set by the LAN clients.
If using Microsoft Windows, DSCPs can be set at the application level by creating the registry key 'QoS' (it not present) as in:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\QoS\
And then creating the string "Do not use NLA" inside the QoS key with value "1"
And then by creating appropriate QoS policies in the Local Group Policy Editor:
Verify correct operation and DSCP handling using tcpdump:
opkg update; opkg install tcpdump
# First check correct flows and DSCPs correctly set by your LAN client on upload
tcpdump -i wan -vv
# Second check correct flows and corresponding DSCPs are getting set by router on download
tcpdump -i ifb-wan -vv
If using a VPN then cake-qos-simple is not appropriate because cake will not see all the flows and so flow fairness will not work properly. Instead check out the following alternatives to deal with mixture of encrypted and unencrypted flows: