Difference between revisions of "QoS"

From VyOS Wiki
Jump to: navigation, search
m (Table formatting)
(Added migrated note)
 
(9 intermediate revisions by one other user not shown)
Line 1: Line 1:
 +
{{Migrated | url = https://vyos.readthedocs.io/en/latest/qos.html }}
 +
 
{{Asbox}}
 
{{Asbox}}
 
{{TOC right}}
 
{{TOC right}}
Line 41: Line 43:
 
  # set interfaces etherhet eth0 traffic-policy out WAN-OUT
 
  # set interfaces etherhet eth0 traffic-policy out WAN-OUT
  
 
== The case of ingress shaping ==
 
 
Only a '''limiter''' policy can be applied directly for ingress traffic on an interface.
 
 
It is possible though to use what is called an [http://www.linuxfoundation.org/collaborate/workgroups/networking/ifb Intermediate Functional Block] to allow the usage of any policy on the ingress traffic.
 
 
Let's assume eth0 is your WAN link. You created two traffic-policies : ''WAN-IN'' and ''WAN-OUT''.
 
 
First, create the IFB :
 
 
# set interfaces input ifb0 description "WAN Input"
 
 
Apply the ''WAN-OUT'' traffic-policy to ifb0 input.
 
 
# set interfaces input ifb0 traffic-policy in WAN-IN
 
 
Redirect traffic from eth0 to ifb0
 
 
# set interfaces ethernet eth0 redirect ifb0
 
  
 
= Traffic policies in VyOS =
 
= Traffic policies in VyOS =
 
An overview of QoS traffic policies supported by VyOS.  
 
An overview of QoS traffic policies supported by VyOS.  
  
== Drop-tail ==
+
== Drop-tail (FIFO) ==
 
A packet queuing mechanism on a FIFO (First In, First Out) basis; packets are sent out in the same order as they arrive. The queue has a defined length, packets arriving after the queue is filled up will be dropped (hence the name 'drop tail', the 'tail' of the queue will be dropped). With this policy in place, all traffic is treated equally and put into a single queue. Applicable to outbound traffic only.
 
A packet queuing mechanism on a FIFO (First In, First Out) basis; packets are sent out in the same order as they arrive. The queue has a defined length, packets arriving after the queue is filled up will be dropped (hence the name 'drop tail', the 'tail' of the queue will be dropped). With this policy in place, all traffic is treated equally and put into a single queue. Applicable to outbound traffic only.
  
Line 74: Line 56:
 
* Add a description:
 
* Add a description:
 
  # set traffic-policy drop-tail <policy name> description <description>
 
  # set traffic-policy drop-tail <policy name> description <description>
* Set the queue-limit (max. number of packets in queue), range 0...4294967295 packets:
+
* Set the queue length limit (max. number of packets in queue), range 0...4294967295 packets:
 
  # set traffic-policy drop-tail <policy name> queue-limit <limit>   
 
  # set traffic-policy drop-tail <policy name> queue-limit <limit>   
  
== Fair queue ==
+
== Fair queue (SFQ) ==
A packet queuing mechanism that separates traffic flows based on their source/destination IP addresses and/or source port and places them into buckets. Bandwidth is allocated fairly between buckets based on the Stochastic Fairness Queuing algorithm. Applicable to outbound traffic only.   
+
Fair queue is a packet queuing mechanism that separates traffic flows based on their source/destination IP addresses and/or source port and places them into buckets. Bandwidth is allocated fairly between buckets based on the Stochastic Fairness Queuing algorithm. Applicable to outbound traffic only.   
  
 
Available commands:
 
Available commands:
Line 104: Line 86:
 
* Define a traffic class for a limiter policy, range for class ID is 1...4095:  
 
* Define a traffic class for a limiter policy, range for class ID is 1...4095:  
 
  # set traffic-policy limiter <policy-name> class <class ID>
 
  # set traffic-policy limiter <policy-name> class <class ID>
* Specify a bandwidth limit for a class, <code>rate</code> in kbit/s:
+
* Add a class description:
 +
# set traffic-policy limiter <policy-name> class <class ID> description <description>
 +
* Specify a bandwidth limit for a class, in kbit/s:
 
  # set traffic-policy limiter <policy-name> class <class ID> bandwidth <rate>
 
  # set traffic-policy limiter <policy-name> class <class ID> bandwidth <rate>
* Set a bandwidth limit for a class with a suffix other than the default kbit/s, available suffixes:  
+
: <u>Available suffixes:</u>
*:- kbit (kilobits per second)
+
: kbit (kilobits per second, default)
*:- mbit (megabits per second)
+
: mbit (megabits per second)
*:- gbit (gigabits per second)
+
: gbit (gigabits per second)
*:- kbps (kilobytes per second)
+
: kbps (kilobytes per second)
*:- mbps (megabytes per second)
+
: mbps (megabytes per second)
*:- gbps (gigabytes per second)
+
: gbps (gigabytes per second)
 +
 
  
Example:
 
# set traffic-policy limiter <policy-name> class <class ID> bandwidth 100mbit
 
 
* Set a burst size for a class, the maximum amount of traffic that can be sent, in bytes:
 
* Set a burst size for a class, the maximum amount of traffic that can be sent, in bytes:
  # set traffic-policy limiter <policy-name> class <class ID> burst <burst size>
+
  # set traffic-policy limiter <policy-name> class <class ID> burst <burst-size>
* Set a burst size for a class with a suffix other than the default bytes, available suffixes:
+
: <u>Available suffixes:</u>
*:- kb (kilobytes)
+
: kb (kilobytes)
*:- mb (megabytes)
+
: mb (megabytes)
*:- gb (gigabytes)
+
: gb (gigabytes)
  
Example:
 
# set traffic-policy limiter <policy-name> class <class ID> burst 100kb
 
  
 +
'''Default class'''
 
* Define a default class for a limiter policy that applies to traffic not matching any other classes for this policy:
 
* Define a default class for a limiter policy that applies to traffic not matching any other classes for this policy:
 
  # set traffic-policy limiter <policy name> default
 
  # set traffic-policy limiter <policy name> default
* Specify a bandwidth limit for the default class, <code>rate</code> in kbit/s:
+
* Specify a bandwidth limit for the default class, in kbit/s:
 
  # set traffic-policy limiter <policy name> default bandwidth <rate>
 
  # set traffic-policy limiter <policy name> default bandwidth <rate>
* Specify a bandwidth limit for the default class with a suffix other than the default kbit/s, available suffixes:  
+
: <u>Available suffixes:</u>
*:- kbit (kilobits per second)
+
: kbit (kilobits per second, default)
*:- mbit (megabits per second)
+
: mbit (megabits per second)
*:- gbit (gigabits per second)
+
: gbit (gigabits per second)
*:- kbps (kilobytes per second)
+
: kbps (kilobytes per second)
*:- mbps (megabytes per second)
+
: mbps (megabytes per second)
*:- gbps (gigabytes per second)
+
: gbps (gigabytes per second)
  
Example:
 
# set traffic-policy limiter <policy name> default bandwidth 100mbit
 
  
* Set a burst size for a class, the maximum amount of traffic that can be sent, in bytes:
+
* Set a burst size for the default class, the maximum amount of traffic that can be sent, in bytes:
  # set traffic-policy limiter <policy-name> default burst <burst size>
+
  # set traffic-policy limiter <policy-name> default burst <burst-size>
* Set a burst size for a class with a suffix other than the default bytes, available suffixes:
+
: <u>Available suffixes:</u>
*:- kb (kilobytes)
+
: kb (kilobytes)
*:- mb (megabytes)
+
: mb (megabytes)
*:- gb (gigabytes)
+
: gb (gigabytes)
  
Example:
 
# set traffic-policy limiter <policy-name> default burst 100kb
 
  
 
* Specify the priority of the default class to set the order in which the rules are evaluated, the higher the number the lower the priority, range 0...20 (default 20):   
 
* Specify the priority of the default class to set the order in which the rules are evaluated, the higher the number the lower the priority, range 0...20 (default 20):   
 
  # set traffic-policy limiter <policy name> default priority <priority>
 
  # set traffic-policy limiter <policy name> default priority <priority>
 
  
 
=== Matching rules ===
 
=== Matching rules ===
Line 161: Line 138:
 
* Add a description:
 
* Add a description:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> description <description>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> description <description>
* Specify a match criterion based on a destination MAC address (format: xx:xx:xx:xx:xx:xx):
+
* Specify the priority of a matching rule to set the order in which the rules are evaluated, the higher the number the lower the priority, range 0...20 (default 20): 
 +
# set traffic-policy limiter <policy name> class <class ID> priority <priority>
 +
* Specify a match criterion based on a '''destination MAC address''' (format: xx:xx:xx:xx:xx:xx):
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ether destination <MAC address>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ether destination <MAC address>
* Specify a match criterion based on a source MAC address (format: xx:xx:xx:xx:xx:xx):
+
* Specify a match criterion based on a '''source MAC address''' (format: xx:xx:xx:xx:xx:xx):
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ether source <MAC address>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ether source <MAC address>
* Specify a match criterion based on packet type/protocol, range 0...65535:
+
* Specify a match criterion based on '''packet type/protocol''', range 0...65535:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ether protocol <number>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ether protocol <number>
* Specify a match criterion based on the fwmark field, range 0....4294967295:
+
* Specify a match criterion based on the '''fwmark field''', range 0....4294967295:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> mark <fwmark>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> mark <fwmark>
* Specify a match criterion based on VLAN ID, range 1...4096:
+
* Specify a match criterion based on '''VLAN ID''', range 1...4096:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> vif <VLAN ID>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> vif <VLAN ID>
* Specify the priority of a matching rule to set the order in which the rules are evaluated, the higher the number the lower the priority, Range 0...20 (default 20): 
 
# set traffic-policy limiter <policy name> class <class ID> priority <priority>
 
  
==== IPv4 ====
+
'''IPv4'''
* Specify a match criterion based on destination IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''destination IPv4 address''' and/or port, port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
* Specify a match criterion based on source IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''source IPv4 address''' and/or port, port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
* Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
+
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip dscp <DSCP value>  
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip dscp <DSCP value>  
* Specify a match criterion based on IPv4 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
+
* Specify a match criterion based on '''IPv4 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip protocol <proto>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ip protocol <proto>
  
==== IPv6 ====
+
'''IPv6'''
* Specify a match criterion based on destination IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''destination IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
* Specify a match criterion based on source IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''source IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
* Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
+
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
* Specify a match criterion based on IPv6 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
+
* Specify a match criterion based on '''IPv6 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 protocol <proto>
 
  # set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 protocol <proto>
  
Line 205: Line 182:
 
* Specify a bandwidth limit in kbit/s:
 
* Specify a bandwidth limit in kbit/s:
 
  # set traffic-policy network-emulator <policy name> bandwidth <rate>
 
  # set traffic-policy network-emulator <policy name> bandwidth <rate>
* Specify a bandwidth limit with a suffix other than the default kbit/s, available suffixes:  
+
: <u>Available suffixes:</u>
*:- kbit (kilobits per second)
+
: kbit (kilobits per second, default)
*:- mbit (megabits per second)
+
: mbit (megabits per second)
*:- gbit (gigabits per second)
+
: gbit (gigabits per second)
*:- kbps (kilobytes per second)
+
: kbps (kilobytes per second)
*:- mbps (megabytes per second)
+
: mbps (megabytes per second)
*:- gbps (gigabytes per second)
+
: gbps (gigabytes per second)
  
Example:
 
# set traffic-policy network-emulator <policy name> bandwidth 100mbit
 
  
 
* Set a burst size, the maximum amount of traffic that can be sent, in bytes:
 
* Set a burst size, the maximum amount of traffic that can be sent, in bytes:
 
  # set traffic-policy network-emulator <policy name> burst <burst size>
 
  # set traffic-policy network-emulator <policy name> burst <burst size>
* Set a burst size with a suffix other than the default bytes, available suffixes:
+
: <u>Available suffixes:</u>
*:- kb (kilobytes)
+
: kb (kilobytes)
*:- mb (megabytes)
+
: mb (megabytes)
*:- gb (gigabytes)
+
: gb (gigabytes)
  
Example:
 
# set traffic-policy network-emulator <policy name> burst 100kb
 
  
* Define a delay between packets in milliseconds:
+
* Define a delay between packets:
 
  # set traffic-policy network-emulator <policy name> network-delay <delay>
 
  # set traffic-policy network-emulator <policy name> network-delay <delay>
* Define a delay between packets with a suffix other than the default milliseconds, available suffixes:
+
: <u>Available suffixes:</u>
*:- secs (seconds)
+
: secs (seconds)
*:- ms (milliseconds)
+
: ms (milliseconds, default)
*:- us (microseconds)
+
: us (microseconds)
  
Example:
 
# set traffic-policy network-emulator <policy name> network-delay 10us
 
  
 
* Set a percentage of corrupted of packets (one bit flip, unchanged checksum):
 
* Set a percentage of corrupted of packets (one bit flip, unchanged checksum):
Line 242: Line 213:
 
* Set a percentage of packets for random reordering:
 
* Set a percentage of packets for random reordering:
 
  # set traffic-policy network-emulator <policy name> packet-reordering <percent>
 
  # set traffic-policy network-emulator <policy name> packet-reordering <percent>
* Set a queue limit, Range 0...4294967295 (default 127):
+
* Set a queue length limit in packets, range 0...4294967295, default 127:
 
  # set traffic-policy network-emulator <policy name> queue-limit <limit>
 
  # set traffic-policy network-emulator <policy name> queue-limit <limit>
  
Line 254: Line 225:
 
* Add a description:
 
* Add a description:
 
  # set traffic-policy priority-queue <policy name> description <description>
 
  # set traffic-policy priority-queue <policy name> description <description>
 +
 +
=== Traffic classes ===
 
* Define a traffic class, each class is a separate queue, range for class ID is 1...7, while 1 being the lowest priority:
 
* Define a traffic class, each class is a separate queue, range for class ID is 1...7, while 1 being the lowest priority:
 
  # set traffic-policy priority-queue <policy name> class <class ID>
 
  # set traffic-policy priority-queue <policy name> class <class ID>
 
* Add a class description:
 
* Add a class description:
 
  # set traffic-policy priority-queue <policy name> class <class ID> description <description>
 
  # set traffic-policy priority-queue <policy name> class <class ID> description <description>
* Set a queue limit (default 1000):
+
* Set a queue length limit in packets, default 1000:
 
  # set traffic-policy priority-queue <policy name> class <class ID> queue-limit <limit>
 
  # set traffic-policy priority-queue <policy name> class <class ID> queue-limit <limit>
 
* Specify a queue type for a traffic class, available queue types:
 
* Specify a queue type for a traffic class, available queue types:
Line 266: Line 239:
  
 
  # set traffic-policy priority-queue <policy name> class <class ID> queue-type <type>
 
  # set traffic-policy priority-queue <policy name> class <class ID> queue-type <type>
 +
 +
'''Default class'''
 
* Define a default priority queue:
 
* Define a default priority queue:
 
  # set traffic-policy priority-queue <policy name> default
 
  # set traffic-policy priority-queue <policy name> default
* Define a maximum queue size for the default traffic class (in packets):
+
* Define a maximum queue length for the default traffic class in packets:
 
  # set traffic-policy priority-queue <policy name> default queue-limit <limit>
 
  # set traffic-policy priority-queue <policy name> default queue-limit <limit>
 
* Specify the queuing type for the default traffic class, available queue types:
 
* Specify the queuing type for the default traffic class, available queue types:
Line 282: Line 257:
 
* Add a match rule description:  
 
* Add a match rule description:  
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> description <description>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> description <description>
* Specify a match criterion based on a destination MAC address (format: xx:xx:xx:xx:xx:xx):
+
* Specify a match criterion based on a '''destination MAC address''' (format: xx:xx:xx:xx:xx:xx):
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether destination <MAC address>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether destination <MAC address>
* Specify a match criterion based on a source MAC address (format: xx:xx:xx:xx:xx:xx):
+
* Specify a match criterion based on a '''source MAC address''' (format: xx:xx:xx:xx:xx:xx):
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether source <MAC address>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether source <MAC address>
* Specify a match criterion based on packet type/protocol, range 0...65535:
+
* Specify a match criterion based on '''packet type/protocol''', range 0...65535:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether protocol <number>  
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether protocol <number>  
* Specify a match criterion based on ingress interface:
+
* Specify a match criterion based on '''ingress interface''':
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> interface <interface>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> interface <interface>
* Specify a match criterion based on the fwmark field, range 0....4294967295:
+
* Specify a match criterion based on the '''fwmark field''', range 0....4294967295:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> mark <fwmark>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> mark <fwmark>
* Specify a match criterion based on VLAN ID, range 1...4096:
+
* Specify a match criterion based on '''VLAN ID''', range 1...4096:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> vif <VLAN ID>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> vif <VLAN ID>
  
==== IPv4 ====
+
'''IPv4'''
* Specify a match criterion based on destination IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''destination IPv4 address and/or port''', port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
* Specify a match criterion based on source IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''source IPv4 address and/or port''', port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
* Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
+
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip dscp <DSCP value>  
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip dscp <DSCP value>  
* Specify a match criterion based on IPv4 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
+
* Specify a match criterion based on '''IPv4 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip protocol <proto>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip protocol <proto>
  
==== IPv6 ====
+
'''IPv6'''
* Specify a match criterion based on destination IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''destination IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
* Specify a match criterion based on source IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
+
* Specify a match criterion based on '''source IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
* Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
+
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
* Specify a match criterion based on IPv6 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
+
* Specify a match criterion based on '''IPv6 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 protocol <proto>
 
  # set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 protocol <proto>
  
Line 325: Line 300:
 
* Add a description:
 
* Add a description:
 
  # set traffic-policy random-detect <policy name> description <description>
 
  # set traffic-policy random-detect <policy name> description <description>
* Set a bandwidth limit, in kbit/s;
+
* Set a bandwidth limit, default auto:
 
  # set traffic-policy random-detect <policy name> bandwidth <rate>
 
  # set traffic-policy random-detect <policy name> bandwidth <rate>
* Set a bandwidth limit with a different suffix than the default kbit/s or automatic assignment, available options:
+
: <u>Available suffixes:</u>
:- auto (bandwidth limit based on interface speed, default)
+
: auto (bandwidth limit based on interface speed, default)
:- kbit (kilobits per second)
+
: kbit (kilobits per second)
:- mbit (megabits per second)  
+
: mbit (megabits per second)  
:- gbit (gigabits per second)
+
: gbit (gigabits per second)
:- kbps (kilobytes per second)
+
: kbps (kilobytes per second)
:- mbps (megabytes per second)
+
: mbps (megabytes per second)
:- gbps (gigabytes per second)
+
: gbps (gigabytes per second)
 +
 
  
 
==== WRED ====
 
==== WRED ====
Line 353: Line 329:
 
* precedence
 
* precedence
 
:- IP precedence, first three bits of the ToS field as defined in [https://tools.ietf.org/html/rfc791 RFC791]:
 
:- IP precedence, first three bits of the ToS field as defined in [https://tools.ietf.org/html/rfc791 RFC791]:
{| class="wikitable" style="margin-left: 15px;"
+
{| class="wikitable" style="margin-left: 15px; text-align: center;"
 
|-
 
|-
 
! scope="col"| Precedence
 
! scope="col"| Precedence
Line 383: Line 359:
 
|}
 
|}
 
* min-threshold
 
* min-threshold
:- Min value for the average queue length, packets are dropped if the average queue length reaches this threshold. Range 0...4096, default is dependent on <code>precedence</code>:
+
:- Min value for the average queue length, packets are dropped if the average queue length reaches this threshold. Range 0...4096, default is dependent on precedence:
{| class="wikitable" style="margin-left: 15px;"
+
{| class="wikitable" style="margin-left: 15px; text-align: center;"
 
|-
 
|-
 
! scope="col"| Precedence
 
! scope="col"| Precedence
! scope="col"| min-threshold
+
! scope="col"| default min-threshold
 
|-
 
|-
 
|7
 
|7
Line 416: Line 392:
 
:- Max value for the average queue length, packets are dropped if this value is exceeded. Range 0...4096 packets, default 18.
 
:- Max value for the average queue length, packets are dropped if this value is exceeded. Range 0...4096 packets, default 18.
 
* average-packet
 
* average-packet
:- Average packet size in bytes, default 1024  
+
:- Average packet size in bytes, default 1024.
 
* mark-probability
 
* mark-probability
:- The fraction of packets (n / probability) when the average queue length reaches <code>max-threshold</code>, default 10.
+
:- The fraction of packets (n/probability) dropped from the queue when the average queue length reaches <code>max-threshold</code>, default 10.
 
* queue-limit  
 
* queue-limit  
:- Packets are dropped when the current queue length reaches this value, default 4 * <code>max-threshold</code>.
+
:- Packets are dropped when the current queue length reaches this value, default 4*<code>max-threshold</code>.
  
 
Usage:
 
Usage:
  # set traffic-policy random-detect <policy name> precedence <precedence> [average-packet <bytes> | mark-probability <probability> | max-threshold <max> | min-threshold <min> | queue-limit <packets>]
+
  # set traffic-policy random-detect <policy-name> precedence <precedence> [average-packet <bytes> | mark-probability <probability> | max-threshold <max> | min-threshold <min> | queue-limit <packets>]
 +
 
 +
== Rate control (TBF) ==
 +
The rate control policy uses the [https://en.wikipedia.org/wiki/Token_bucket Token Bucket Filter (TBF)] algorithm to limit the packet flow to a set rate. Short bursts can be allowed to exceed the limit. Applicable to outbound traffic only.
 +
 
 +
Available commands: 
 +
 
 +
* Define a rate control policy:
 +
# set traffic-policy rate-control <policy-name>
 +
* Add a description:
 +
# set traffic-policy rate-control <policy-name> description <description>
 +
* Specify a bandwidth limit in kbits/s:
 +
# set traffic-policy rate-control <policy-name> bandwidth <rate>
 +
: <u>Available suffixes:</u>
 +
: kbit (kilobits per second, default)
 +
: mbit (megabits per second)
 +
: gbit (gigabits per second)
 +
: kbps (kilobytes per second)
 +
: mbps (megabytes per second)
 +
: gbps (gigabytes per second)
 +
 
 +
 
 +
* Specify a burst size in bytes, default 15 kilobytes:
 +
# set traffic-policy rate-control <policy-name> burst <burst-size>
 +
: <u>Available suffixes:</u>
 +
: kb (kilobytes)
 +
: mb (megabytes)
 +
: gb (gigabytes)
 +
 
 +
 
 +
* Specify a latency in milliseconds; the maximum amount of time packets are allowed to wait in the queue, default 50 milliseconds:
 +
# set traffic-policy rate-control <policy-name> latency
 +
: <u>Available suffixes:</u>
 +
: secs (seconds)
 +
: ms (milliseconds, default)
 +
: us (microseconds)
 +
 
 +
== Round robin (DRR) ==
 +
The round robin policy divides available bandwidth between all defined traffic classes.
 +
 
 +
Available commands:
 +
 
 +
* Define a round robin policy:
 +
# set traffic-policy round-robin <policy-name>
 +
* Add a description:
 +
# set traffic-policy round-robin <policy-name> description <description>
 +
* Define a traffic class ID, range 2...4095:
 +
# set traffic-policy round-robin <policy-name> class <class>
 +
 
 +
'''Default policy'''
 +
* Define a default priority queue:
 +
# set traffic-policy round-robin <policy name> default
 +
* Set the number of packets that can be sent per scheduling quantum:
 +
# set traffic-policy round-robin <policy name> default quantum <packets>
 +
* Define a maximum queue lenght for the default policy in packets:
 +
# set traffic-policy round-robin <policy name> default queue-limit <limit>
 +
* Specify the queuing type for the default policy, available queue types:
 +
*:- drop-tail 
 +
*:- fair-queue
 +
*:- priority (based on the DSCP values in the ToS byte)
 +
 
 +
# set traffic-policy round-robin <policy name> default queue-type <type>
 +
 
 +
=== Matching rules ===
 +
* Define a class matching rule:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name>
 +
* Add a match rule description:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> description <description>
 +
* Specify a match criterion based on a '''destination MAC address''' (format: xx:xx:xx:xx:xx:xx):
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ether destination <MAC address>
 +
* Specify a match criterion based on a '''source MAC address''' (format: xx:xx:xx:xx:xx:xx):
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ether source <MAC address>
 +
* Specify a match criterion based on '''packet type/protocol''', range 0...65535:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ether protocol <number>
 +
* Specify a match criterion based on '''ingress interface''':
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> interface <interface>
 +
* Specify a match criterion based on the '''fwmark field''', range 0....4294967295:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> mark <fwmark>
 +
* Specify a match criterion based on '''VLAN ID''', range 1...4096:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> vif <VLAN ID>
 +
 
 +
'''IPv4'''
 +
* Specify a match criterion based on '''destination IPv4 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
 +
* Specify a match criterion based on '''source IPv4 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
 +
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip dscp <DSCP value>
 +
* Specify a match criterion based on '''IPv4 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip protocol <proto>
 +
'''IPv6'''
 +
* Specify a match criterion based on '''destination IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
 +
* Specify a match criterion based on '''source IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
 +
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
 +
* Specify a match criterion based on '''IPv6 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 protocol <proto>
 +
 
 +
 
 +
== Traffic shaper ==
 +
The shaper policy uses the Hierarchical Token Bucket algorithm to allocate different amounts of bandwidth to different traffic classes. In contrast to round robin, shaper limits bandwidth allocation by traffic class whereas round robin divides the total available bandwidth between classes. 
 +
 
 +
Avialable commands:
 +
 
 +
* Define a shaper policy:
 +
# set traffic-policy shaper <policy-name>
 +
* Add a description:
 +
# set traffic-policy shaper <policy-name> description <description>
 +
* Set the available bandwidth for all combined traffic of this policy in kbit/s, default 100%:
 +
# set traffic-policy shaper <policy-name> bandwidth <rate>
 +
: <u>Available suffixes:</u>
 +
: %    (percentage of total bandwidth)
 +
: kbit (kilobits per second)
 +
: mbit (megabits per second)
 +
: gbit (gigabits per second)
 +
: kbps (kilobytes per second)
 +
: mbps (megabytes per second)
 +
: gbps (gigabytes per second) 
 +
 
 +
 
 +
=== Traffic classes ===
 +
* Define a traffic class for a shaper policy, range for class ID is 2...4095:
 +
# set traffic-policy shaper <policy-name> class <class ID>
 +
* Add a class description:
 +
# set traffic-policy shaper <policy name> class <class ID> description <description>
 +
* Specify a bandwidth limit for a class, in kbit/s:
 +
# set traffic-policy shaper <policy-name> class <class ID> bandwidth <rate>
 +
: <u>Available suffixes:</u>
 +
: kbit (kilobits per second, default)
 +
: mbit (megabits per second)
 +
: gbit (gigabits per second)
 +
: kbps (kilobytes per second)
 +
: mbps (megabytes per second)
 +
: gbps (gigabytes per second)
 +
 
 +
 
 +
* Set a burst size for a class, the maximum amount of traffic that can be sent, in bytes:
 +
# set traffic-policy shaper <policy-name> class <class ID> burst <burst-size>
 +
: <u>Available suffixes:</u>
 +
: kb (kilobytes)
 +
: mb (megabytes)
 +
: gb (gigabytes)
 +
 
 +
 
 +
* Set a bandwidth ceiling for a class in kbit/s:
 +
# set traffic-policy shaper <policy-name> class <class ID> ceiling <rate>
 +
: <u>Available suffixes:</u>
 +
: %    (percentage of total bandwidth)
 +
: kbit (kilobits per second)
 +
: mbit (megabits per second)
 +
: gbit (gigabits per second)
 +
 
 +
 
 +
* Set the priority of a class for allocation of additional bandwidth, if unused bandwidth is available. Range 0...7, lowest number has lowest priority, default 0:
 +
# set traffic-policy shaper <policy-name> class <class ID> priority <priority>
 +
* Set a queue length limit in packets:
 +
# set traffic-policy shaper <policy name> class <class ID> queue-limit <limit>
 +
* Specify a queue type for a traffic class, default fair-queue. Available queue types:
 +
*:- drop-tail 
 +
*:- fair-queue
 +
*:- random-detect
 +
*:- priority
 +
 
 +
# set traffic-policy shaper <policy name> class <class ID> queue-type <type>
 +
 
 +
* Modify the DSCP field; the DSCP field value of packets in a class can be rewritten to change the forwarding behaviour and allow for traffic conditioning:
 +
# set traffic-policy shaper <policy name> class <class ID> set-dscp <value>
 +
: <u>DSCP values:</u> (as per [https://tools.ietf.org/html/rfc2474#page-7 RFC2474] and [https://tools.ietf.org/html/rfc4594#page-19 RFC4595])
 +
{| class="wikitable" style="margin-left: 15px; text-align: center;"
 +
|-
 +
! scope="col"| Binary<br>value
 +
! scope="col"| Configured<br>value
 +
! scope="col"| Drop<br>rate
 +
! scope="col"| Description
 +
|-
 +
|101110
 +
|46
 +
| -
 +
|Expedited forwarding (EF)
 +
|-
 +
|000000
 +
|0
 +
| -
 +
|Best effort traffic, default
 +
|-
 +
|001010
 +
|10
 +
|Low
 +
|Assured Forwarding(AF) 11
 +
|-
 +
|001100
 +
|12
 +
|Medium
 +
|Assured Forwarding(AF) 12
 +
|-
 +
|001110
 +
|14
 +
|High
 +
|Assured Forwarding(AF) 13
 +
|-
 +
|010010
 +
|18
 +
|Low
 +
|Assured Forwarding(AF) 21
 +
|-
 +
|010100
 +
|20
 +
|Medium
 +
|Assured Forwarding(AF) 22
 +
|-
 +
|010110
 +
|22
 +
|High
 +
|Assured Forwarding(AF) 23
 +
|-
 +
|011010
 +
|26
 +
|Low
 +
|Assured Forwarding(AF) 31
 +
|-
 +
|011100
 +
|28
 +
|Medium
 +
|Assured Forwarding(AF) 32
 +
|-
 +
|011110
 +
|30
 +
|High
 +
|Assured Forwarding(AF) 33
 +
|-
 +
|100010
 +
|34
 +
|Low
 +
|Assured Forwarding(AF) 41
 +
|-
 +
|100100
 +
|36
 +
|Medium
 +
|Assured Forwarding(AF) 42
 +
|-
 +
|100110
 +
|38
 +
|High
 +
|Assured Forwarding(AF) 43
 +
|}
 +
 
 +
'''Default shaper policy'''
 +
 
 +
''to be filled''
 +
 
 +
 
 +
=== Matching rules ===
 +
* Define a class matching rule:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name>
 +
* Add a match rule description:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> description <description>
 +
* Specify a match criterion based on a '''destination MAC address''' (format: xx:xx:xx:xx:xx:xx):
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ether destination <MAC address>
 +
* Specify a match criterion based on a '''source MAC address''' (format: xx:xx:xx:xx:xx:xx):
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ether source <MAC address>
 +
* Specify a match criterion based on '''packet type/protocol''', range 0...65535:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ether protocol <number>
 +
* Specify a match criterion based on '''ingress interface''':
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> interface <interface>
 +
* Specify a match criterion based on the '''fwmark field''', range 0....4294967295:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> mark <fwmark>
 +
* Specify a match criterion based on '''VLAN ID''', range 1...4096:
 +
# set traffic-policy round-robin <policy name> class <class ID> match <match name> vif <VLAN ID>
 +
 
 +
'''IPv4'''
 +
* Specify a match criterion based on '''destination IPv4 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
 +
* Specify a match criterion based on '''source IPv4 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
 +
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip dscp <DSCP value>
 +
* Specify a match criterion based on '''IPv4 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip protocol <proto>
 +
'''IPv6'''
 +
* Specify a match criterion based on '''destination IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
 +
* Specify a match criterion based on '''source IPv6 address and/or port''', port may be specified as number or service name (i.e. ssh):
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
 +
* Specify a match criterion based on '''DSCP (Differentiated Services Code Point) value''', DSCP value may be specified as decimal or hexadecimal number:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
 +
* Specify a match criterion based on '''IPv6 protocol''', protocol may be specified by name (i.e. icmp) or IANA-assigned number:
 +
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 protocol <proto>
 +
 
 +
 
  
== Rate control ==
 
tbf
 
== Round robin ==
 
drr
 
== Shaper ==
 
HTB + sfq (fair-queue), HTB + pfifo (drop-tail), HTB + prio (priority), HTB + red (random-detect)
 
 
== shaper-hfsc ==
 
== shaper-hfsc ==
 
HFSC + sfq
 
HFSC + sfq
 +
 +
 +
= The case of ingress shaping =
 +
 +
Only a '''limiter''' policy can be applied directly for ingress traffic on an interface.
 +
 +
It is possible though to use what is called an [http://www.linuxfoundation.org/collaborate/workgroups/networking/ifb Intermediate Functional Block] to allow the usage of any policy on the ingress traffic.
 +
 +
Let's assume eth0 is your WAN link. You created two traffic-policies : ''WAN-IN'' and ''WAN-OUT''.
 +
 +
First, create the IFB :
 +
 +
# set interfaces input ifb0 description "WAN Input"
 +
 +
Apply the ''WAN-OUT'' traffic-policy to ifb0 input.
 +
 +
# set interfaces input ifb0 traffic-policy in WAN-IN
 +
 +
Redirect traffic from eth0 to ifb0
 +
 +
# set interfaces ethernet eth0 redirect ifb0
  
 
= Classful policies and traffic matching =
 
= Classful policies and traffic matching =

Latest revision as of 21:49, 26 June 2019

Warning sign.png This page is migrated to Readthedocs .
Information found on this page is migrated to readthedocs and information found here could be outdated or misleading. https://vyos.readthedocs.io/en/latest/qos.html
For a complete status of all migrations, see Project:Migration


Introduction

VyOS uses tc as a backend for QoS. VyOS provides its users with configuration nodes for the following shaping/queueing/policing disciplines :

  • HTB
  • HFSC
  • SFQ
  • pfifo
  • network-emulator
  • PRIO
  • GRED
  • TBF
  • DRR

Configuration nodes in VyOS

VyOS QoS configuration is done in two steps. The first one consists in setting up your classes/queues and traffic filters to distribute traffic amongst them. The second step is to apply such traffic policy to an interface ingress or egress.

Creating a traffic policy

Such configuration takes place under the traffic-policy tree.

Available subtrees :

# set traffic-policy drop-tail NAME
# set traffic-policy fair-queue NAME
# set traffic-policy limiter NAME
# set traffic-policy network-emulator NAME
# set traffic-policy priority-queue NAME
# set traffic-policy random-detect NAME
# set traffic-policy rate-control NAME
# set traffic-policy round-robin NAME
# set traffic-policy shaper NAME
# set traffic-policy shaper-hfsc NAME

Applying a traffic policy to an interface

Once a traffic-policy is created, you can apply it to an interface :

# set interfaces ethernet eth0 traffic-policy in WAN-IN
# set interfaces etherhet eth0 traffic-policy out WAN-OUT


Traffic policies in VyOS

An overview of QoS traffic policies supported by VyOS.

Drop-tail (FIFO)

A packet queuing mechanism on a FIFO (First In, First Out) basis; packets are sent out in the same order as they arrive. The queue has a defined length, packets arriving after the queue is filled up will be dropped (hence the name 'drop tail', the 'tail' of the queue will be dropped). With this policy in place, all traffic is treated equally and put into a single queue. Applicable to outbound traffic only.

Available commands:

  • Define a drop-tail policy (unique name, exclusive to this policy):
# set traffic-policy drop-tail <policy name>
  • Add a description:
# set traffic-policy drop-tail <policy name> description <description>
  • Set the queue length limit (max. number of packets in queue), range 0...4294967295 packets:
# set traffic-policy drop-tail <policy name> queue-limit <limit>  

Fair queue (SFQ)

Fair queue is a packet queuing mechanism that separates traffic flows based on their source/destination IP addresses and/or source port and places them into buckets. Bandwidth is allocated fairly between buckets based on the Stochastic Fairness Queuing algorithm. Applicable to outbound traffic only.

Available commands:

  • Define a fair queue policy:
# set traffic-policy fair-queue <policy name>
  • Add a description:
# set traffic-policy fair-queue <policy name> description <description>
  • Set a hash update interval; the algorithm used is stochastic and thus not 'truly' fair, hash collisions can occur, in which case traffic flows may be put into the same bucket. To mitigate this, the hashes can be updated at a set interval, Range 0...4294967295 seconds:
# set traffic-policy fair-queue <policy name> hash-interval <seconds>
  • Set the queue-limit (max. number of packets in queue), range 0...4294967295 packets, default 127:
# set traffic-policy fair-queue <policy name> queue-limit <limit>

Limiter

The limiter performs ingress policing of traffic flows. Multiple classes of traffic can be defined and traffic limits can be applied to each class. Traffic exceeding the defined bandwidth limits is dropped. Applicable to inbound traffic only.

Available commands:

  • Define a traffic limiter policy:
# set traffic-policy limiter <policy-name>
  • Add a description:
# set traffic-policy limiter <policy-name> description <description> 

Traffic classes

  • Define a traffic class for a limiter policy, range for class ID is 1...4095:
# set traffic-policy limiter <policy-name> class <class ID>
  • Add a class description:
# set traffic-policy limiter <policy-name> class <class ID> description <description>
  • Specify a bandwidth limit for a class, in kbit/s:
# set traffic-policy limiter <policy-name> class <class ID> bandwidth <rate>
Available suffixes:
kbit (kilobits per second, default)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


  • Set a burst size for a class, the maximum amount of traffic that can be sent, in bytes:
# set traffic-policy limiter <policy-name> class <class ID> burst <burst-size>
Available suffixes:
kb (kilobytes)
mb (megabytes)
gb (gigabytes)


Default class

  • Define a default class for a limiter policy that applies to traffic not matching any other classes for this policy:
# set traffic-policy limiter <policy name> default
  • Specify a bandwidth limit for the default class, in kbit/s:
# set traffic-policy limiter <policy name> default bandwidth <rate>
Available suffixes:
kbit (kilobits per second, default)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


  • Set a burst size for the default class, the maximum amount of traffic that can be sent, in bytes:
# set traffic-policy limiter <policy-name> default burst <burst-size>
Available suffixes:
kb (kilobytes)
mb (megabytes)
gb (gigabytes)


  • Specify the priority of the default class to set the order in which the rules are evaluated, the higher the number the lower the priority, range 0...20 (default 20):
# set traffic-policy limiter <policy name> default priority <priority>

Matching rules

  • Define a traffic class matching rule:
# set traffic-policy limiter <policy name> class <class ID> match <match name>
  • Add a description:
# set traffic-policy limiter <policy name> class <class ID> match <match name> description <description>
  • Specify the priority of a matching rule to set the order in which the rules are evaluated, the higher the number the lower the priority, range 0...20 (default 20):
# set traffic-policy limiter <policy name> class <class ID> priority <priority>
  • Specify a match criterion based on a destination MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy limiter <policy name> class <class ID> match <match name> ether destination <MAC address>
  • Specify a match criterion based on a source MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy limiter <policy name> class <class ID> match <match name> ether source <MAC address>
  • Specify a match criterion based on packet type/protocol, range 0...65535:
# set traffic-policy limiter <policy name> class <class ID> match <match name> ether protocol <number>
  • Specify a match criterion based on the fwmark field, range 0....4294967295:
# set traffic-policy limiter <policy name> class <class ID> match <match name> mark <fwmark>
  • Specify a match criterion based on VLAN ID, range 1...4096:
# set traffic-policy limiter <policy name> class <class ID> match <match name> vif <VLAN ID>

IPv4

  • Specify a match criterion based on destination IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy limiter <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
  • Specify a match criterion based on source IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy limiter <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy limiter <policy name> class <class ID> match <match name> ip dscp <DSCP value> 
  • Specify a match criterion based on IPv4 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy limiter <policy name> class <class ID> match <match name> ip protocol <proto>

IPv6

  • Specify a match criterion based on destination IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
  • Specify a match criterion based on source IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
  • Specify a match criterion based on IPv6 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy limiter <policy name> class <class ID> match <match name> ipv6 protocol <proto>

Network emulator

The network emulator policy emulates WAN traffic, which is useful for testing purposes. Applicable to outbound traffic only.

Available commands:

  • Define a network emulator policy:
# set traffic-policy network-emulator <policy name>
  • Add a description:
# set traffic-policy network-emulator <policy name> description <description>
  • Specify a bandwidth limit in kbit/s:
# set traffic-policy network-emulator <policy name> bandwidth <rate>
Available suffixes:
kbit (kilobits per second, default)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


  • Set a burst size, the maximum amount of traffic that can be sent, in bytes:
# set traffic-policy network-emulator <policy name> burst <burst size>
Available suffixes:
kb (kilobytes)
mb (megabytes)
gb (gigabytes)


  • Define a delay between packets:
# set traffic-policy network-emulator <policy name> network-delay <delay>
Available suffixes:
secs (seconds)
ms (milliseconds, default)
us (microseconds)


  • Set a percentage of corrupted of packets (one bit flip, unchanged checksum):
# set traffic-policy network-emulator <policy name> packet-corruption <percent>
  • Set a percentage of random packet loss:
# set traffic-policy network-emulator <policy name> packet-loss <percent>
  • Set a percentage of packets for random reordering:
# set traffic-policy network-emulator <policy name> packet-reordering <percent>
  • Set a queue length limit in packets, range 0...4294967295, default 127:
# set traffic-policy network-emulator <policy name> queue-limit <limit>

Priority queue

Up to seven queues with differing priorities can be defined, packets are placed into queues based on associated match criteria. Packets are transmitted from the queues in priority order. If queues with a higher order are being filled with packets continuously, packets from lower priority queues will only be transmitted after traffic volume from higher priority queues decreases.

Available commands:

  • Define a priority queue:
# set traffic-policy priority-queue <policy name>
  • Add a description:
# set traffic-policy priority-queue <policy name> description <description>

Traffic classes

  • Define a traffic class, each class is a separate queue, range for class ID is 1...7, while 1 being the lowest priority:
# set traffic-policy priority-queue <policy name> class <class ID>
  • Add a class description:
# set traffic-policy priority-queue <policy name> class <class ID> description <description>
  • Set a queue length limit in packets, default 1000:
# set traffic-policy priority-queue <policy name> class <class ID> queue-limit <limit>
  • Specify a queue type for a traffic class, available queue types:
    - drop-tail
    - fair-queue
    - random-detect
# set traffic-policy priority-queue <policy name> class <class ID> queue-type <type>

Default class

  • Define a default priority queue:
# set traffic-policy priority-queue <policy name> default
  • Define a maximum queue length for the default traffic class in packets:
# set traffic-policy priority-queue <policy name> default queue-limit <limit>
  • Specify the queuing type for the default traffic class, available queue types:
    - drop-tail
    - fair-queue
    - random-detect
# set traffic-policy priority-queue <policy name> default queue-type <type>

Matching rules

  • Define a class matching rule:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name>
  • Add a match rule description:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> description <description>
  • Specify a match criterion based on a destination MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether destination <MAC address>
  • Specify a match criterion based on a source MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether source <MAC address>
  • Specify a match criterion based on packet type/protocol, range 0...65535:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ether protocol <number> 
  • Specify a match criterion based on ingress interface:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> interface <interface>
  • Specify a match criterion based on the fwmark field, range 0....4294967295:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> mark <fwmark>
  • Specify a match criterion based on VLAN ID, range 1...4096:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> vif <VLAN ID>

IPv4

  • Specify a match criterion based on destination IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
  • Specify a match criterion based on source IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip dscp <DSCP value> 
  • Specify a match criterion based on IPv4 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ip protocol <proto>

IPv6

  • Specify a match criterion based on destination IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
  • Specify a match criterion based on source IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
  • Specify a match criterion based on IPv6 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy priority-queue <policy name> class <class ID> match <match name> ipv6 protocol <proto>

Random Early Detection (RED/WRED)

RED

A Random Early Detection (RED) policy starts randomly dropping packets from a queue before it reaches its queue limit thus avoiding congestion. It is also beneficial for TCP connections as the gradual dropping of packets acts as a signal for the sender to decrease its transmission rate, avoiding global TCP synchronisation. Applicable to outbound traffic only.

Available commands:

  • Define a RED policy:
# set traffic-policy random-detect <policy name>
  • Add a description:
# set traffic-policy random-detect <policy name> description <description>
  • Set a bandwidth limit, default auto:
# set traffic-policy random-detect <policy name> bandwidth <rate>
Available suffixes:
auto (bandwidth limit based on interface speed, default)
kbit (kilobits per second)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


WRED

In contrast to RED, Weighted Random Early Detection (WRED) differentiates between classes of traffic in a single queue and assigns different precedence to traffic flows accordingly; low priority packets are dropped from a queue earlier than high priority packets. This is achieved by using the first three bits of the ToS (Type of Service) field to categorise data streams and in accordance with the defined precedence parameters a decision is made. A WRED policy is defined with the following parameters:

  • precedence
  • min-threshold
  • max-threshold
  • average-packet
  • mark-probability
  • queue-limit

If the average queue size is lower than the min-threshold, an arriving packet is placed in the queue. If the average queue size is between min-threshold and max-threshold an arriving packet is either dropped or placed in the queue depending on the defined mark-probability. In case the average queue size is larger than max-threshold, packets are dropped. If the current queue size is larger than queue-limit, packets are dropped. The average queue size depends on its former average size and its current size. If max-threshold is set but min-threshold is not, then min-threshold is scaled to 50% of max-threshold. In principle, values must be min-threshold < max-threshold < queue-limit. Applicable to outbound traffic only.

Possible values for WRED parameters:

  • precedence
- IP precedence, first three bits of the ToS field as defined in RFC791:
Precedence Priority
7 Network Control
6 Internetwork Control
5 CRITIC/ECP
4 Flash Override
3 Flash
2 Immediate
1 Priority
0 Routine
  • min-threshold
- Min value for the average queue length, packets are dropped if the average queue length reaches this threshold. Range 0...4096, default is dependent on precedence:
Precedence default min-threshold
7 16
6 15
5 14
4 13
3 12
2 11
1 10
0 9
  • max-threshold
- Max value for the average queue length, packets are dropped if this value is exceeded. Range 0...4096 packets, default 18.
  • average-packet
- Average packet size in bytes, default 1024.
  • mark-probability
- The fraction of packets (n/probability) dropped from the queue when the average queue length reaches max-threshold, default 10.
  • queue-limit
- Packets are dropped when the current queue length reaches this value, default 4*max-threshold.

Usage:

# set traffic-policy random-detect <policy-name> precedence <precedence> [average-packet <bytes> | mark-probability <probability> | max-threshold <max> | min-threshold <min> | queue-limit <packets>]

Rate control (TBF)

The rate control policy uses the Token Bucket Filter (TBF) algorithm to limit the packet flow to a set rate. Short bursts can be allowed to exceed the limit. Applicable to outbound traffic only.

Available commands:

  • Define a rate control policy:
# set traffic-policy rate-control <policy-name>
  • Add a description:
# set traffic-policy rate-control <policy-name> description <description>
  • Specify a bandwidth limit in kbits/s:
# set traffic-policy rate-control <policy-name> bandwidth <rate>
Available suffixes:
kbit (kilobits per second, default)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


  • Specify a burst size in bytes, default 15 kilobytes:
# set traffic-policy rate-control <policy-name> burst <burst-size>
Available suffixes:
kb (kilobytes)
mb (megabytes)
gb (gigabytes)


  • Specify a latency in milliseconds; the maximum amount of time packets are allowed to wait in the queue, default 50 milliseconds:
# set traffic-policy rate-control <policy-name> latency
Available suffixes:
secs (seconds)
ms (milliseconds, default)
us (microseconds)

Round robin (DRR)

The round robin policy divides available bandwidth between all defined traffic classes.

Available commands:

  • Define a round robin policy:
# set traffic-policy round-robin <policy-name>
  • Add a description:
# set traffic-policy round-robin <policy-name> description <description>
  • Define a traffic class ID, range 2...4095:
# set traffic-policy round-robin <policy-name> class <class>

Default policy

  • Define a default priority queue:
# set traffic-policy round-robin <policy name> default
  • Set the number of packets that can be sent per scheduling quantum:
# set traffic-policy round-robin <policy name> default quantum <packets>
  • Define a maximum queue lenght for the default policy in packets:
# set traffic-policy round-robin <policy name> default queue-limit <limit>
  • Specify the queuing type for the default policy, available queue types:
    - drop-tail
    - fair-queue
    - priority (based on the DSCP values in the ToS byte)
# set traffic-policy round-robin <policy name> default queue-type <type>

Matching rules

  • Define a class matching rule:
# set traffic-policy round-robin <policy name> class <class ID> match <match name>
  • Add a match rule description:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> description <description>
  • Specify a match criterion based on a destination MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ether destination <MAC address>
  • Specify a match criterion based on a source MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ether source <MAC address>
  • Specify a match criterion based on packet type/protocol, range 0...65535:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ether protocol <number> 
  • Specify a match criterion based on ingress interface:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> interface <interface>
  • Specify a match criterion based on the fwmark field, range 0....4294967295:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> mark <fwmark>
  • Specify a match criterion based on VLAN ID, range 1...4096:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> vif <VLAN ID>

IPv4

  • Specify a match criterion based on destination IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
  • Specify a match criterion based on source IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip dscp <DSCP value> 
  • Specify a match criterion based on IPv4 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ip protocol <proto>

IPv6

  • Specify a match criterion based on destination IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
  • Specify a match criterion based on source IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
  • Specify a match criterion based on IPv6 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> ipv6 protocol <proto>


Traffic shaper

The shaper policy uses the Hierarchical Token Bucket algorithm to allocate different amounts of bandwidth to different traffic classes. In contrast to round robin, shaper limits bandwidth allocation by traffic class whereas round robin divides the total available bandwidth between classes.

Avialable commands:

  • Define a shaper policy:
# set traffic-policy shaper <policy-name>
  • Add a description:
# set traffic-policy shaper <policy-name> description <description>
  • Set the available bandwidth for all combined traffic of this policy in kbit/s, default 100%:
# set traffic-policy shaper <policy-name> bandwidth <rate>
Available suffixes:
 % (percentage of total bandwidth)
kbit (kilobits per second)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


Traffic classes

  • Define a traffic class for a shaper policy, range for class ID is 2...4095:
# set traffic-policy shaper <policy-name> class <class ID>
  • Add a class description:
# set traffic-policy shaper <policy name> class <class ID> description <description>
  • Specify a bandwidth limit for a class, in kbit/s:
# set traffic-policy shaper <policy-name> class <class ID> bandwidth <rate>
Available suffixes:
kbit (kilobits per second, default)
mbit (megabits per second)
gbit (gigabits per second)
kbps (kilobytes per second)
mbps (megabytes per second)
gbps (gigabytes per second)


  • Set a burst size for a class, the maximum amount of traffic that can be sent, in bytes:
# set traffic-policy shaper <policy-name> class <class ID> burst <burst-size>
Available suffixes:
kb (kilobytes)
mb (megabytes)
gb (gigabytes)


  • Set a bandwidth ceiling for a class in kbit/s:
# set traffic-policy shaper <policy-name> class <class ID> ceiling <rate>
Available suffixes:
 % (percentage of total bandwidth)
kbit (kilobits per second)
mbit (megabits per second)
gbit (gigabits per second)


  • Set the priority of a class for allocation of additional bandwidth, if unused bandwidth is available. Range 0...7, lowest number has lowest priority, default 0:
# set traffic-policy shaper <policy-name> class <class ID> priority <priority>
  • Set a queue length limit in packets:
# set traffic-policy shaper <policy name> class <class ID> queue-limit <limit>
  • Specify a queue type for a traffic class, default fair-queue. Available queue types:
    - drop-tail
    - fair-queue
    - random-detect
    - priority
# set traffic-policy shaper <policy name> class <class ID> queue-type <type>
  • Modify the DSCP field; the DSCP field value of packets in a class can be rewritten to change the forwarding behaviour and allow for traffic conditioning:
# set traffic-policy shaper <policy name> class <class ID> set-dscp <value>
DSCP values: (as per RFC2474 and RFC4595)
Binary
value
Configured
value
Drop
rate
Description
101110 46 - Expedited forwarding (EF)
000000 0 - Best effort traffic, default
001010 10 Low Assured Forwarding(AF) 11
001100 12 Medium Assured Forwarding(AF) 12
001110 14 High Assured Forwarding(AF) 13
010010 18 Low Assured Forwarding(AF) 21
010100 20 Medium Assured Forwarding(AF) 22
010110 22 High Assured Forwarding(AF) 23
011010 26 Low Assured Forwarding(AF) 31
011100 28 Medium Assured Forwarding(AF) 32
011110 30 High Assured Forwarding(AF) 33
100010 34 Low Assured Forwarding(AF) 41
100100 36 Medium Assured Forwarding(AF) 42
100110 38 High Assured Forwarding(AF) 43

Default shaper policy

to be filled


Matching rules

  • Define a class matching rule:
# set traffic-policy shaper <policy name> class <class ID> match <match name>
  • Add a match rule description:
# set traffic-policy shaper <policy name> class <class ID> match <match name> description <description>
  • Specify a match criterion based on a destination MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy shaper <policy name> class <class ID> match <match name> ether destination <MAC address>
  • Specify a match criterion based on a source MAC address (format: xx:xx:xx:xx:xx:xx):
# set traffic-policy shaper <policy name> class <class ID> match <match name> ether source <MAC address>
  • Specify a match criterion based on packet type/protocol, range 0...65535:
# set traffic-policy shaper <policy name> class <class ID> match <match name> ether protocol <number> 
  • Specify a match criterion based on ingress interface:
# set traffic-policy shaper <policy name> class <class ID> match <match name> interface <interface>
  • Specify a match criterion based on the fwmark field, range 0....4294967295:
# set traffic-policy shaper <policy name> class <class ID> match <match name> mark <fwmark>
  • Specify a match criterion based on VLAN ID, range 1...4096:
# set traffic-policy round-robin <policy name> class <class ID> match <match name> vif <VLAN ID>

IPv4

  • Specify a match criterion based on destination IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip destination <IPv4 address|port>
  • Specify a match criterion based on source IPv4 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip source <IPv4 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip dscp <DSCP value> 
  • Specify a match criterion based on IPv4 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy shaper <policy name> class <class ID> match <match name> ip protocol <proto>

IPv6

  • Specify a match criterion based on destination IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 destination <IPv6 address|port>
  • Specify a match criterion based on source IPv6 address and/or port, port may be specified as number or service name (i.e. ssh):
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 source <IPv6 address|port>
  • Specify a match criterion based on DSCP (Differentiated Services Code Point) value, DSCP value may be specified as decimal or hexadecimal number:
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 dscp <DSCP value>
  • Specify a match criterion based on IPv6 protocol, protocol may be specified by name (i.e. icmp) or IANA-assigned number:
# set traffic-policy shaper <policy name> class <class ID> match <match name> ipv6 protocol <proto>


shaper-hfsc

HFSC + sfq


The case of ingress shaping

Only a limiter policy can be applied directly for ingress traffic on an interface.

It is possible though to use what is called an Intermediate Functional Block to allow the usage of any policy on the ingress traffic.

Let's assume eth0 is your WAN link. You created two traffic-policies : WAN-IN and WAN-OUT.

First, create the IFB :

# set interfaces input ifb0 description "WAN Input"

Apply the WAN-OUT traffic-policy to ifb0 input.

# set interfaces input ifb0 traffic-policy in WAN-IN

Redirect traffic from eth0 to ifb0

# set interfaces ethernet eth0 redirect ifb0

Classful policies and traffic matching

limiter, round-robin, priority-queue, shaper and shaper-hfsc distribute traffic into different classes with different options. In VyOS, classes are numbered and work like firewall rules. e.g :

# set traffic-policy shaper SHAPER class 30

Matching traffic

A class can have multiple match filters :

# set traffic-policy POLICY POLICY-NAME class N match MATCH-FILTER-NAME

Example :

# set traffic-policy shaper SHAPER class 30 match HTTP
# set traffic-policy shaper SHAPER class 30 match HTTPs

A match filter contains multiple criteria and will match traffic if all those criteria are true.

For example :

# set traffic-policy shaper SHAPER class 30 match HTTP ip protocol tcp
# set traffic-policy shaper SHAPER class 30 match HTTP ip source port 80

This will match tcp traffic with source port 80.

description

# set traffic-policy shaper SHAPER class 30 match MATCH description "match filter description"

ether

# edit traffic-policy shaper SHAPER class 30 match MATCH ether

destination

protocol

source

interface

# edit traffic-policy shaper SHAPER class 30 match MATCH interface interface-name

ip

# edit traffic-policy shaper SHAPER class 30 match MATCH ip

destination

# set destination address IPv4-SUBNET
# set destination port U32-PORT

dscp

# set dscp DSCPVALUE

max-length

# set max-length U32-MAXLEN

Will match ipv4 packets with a total length lesser than set value.

protocol

# set protocol IPPROTOCOL

source

# set source address IPv4-SUBNET
# set source port U32-PORT

tcp

Note : you must set ip protocol to TCP to use the TCP filters. Note 2 : This filter will only match packets with an IPv4 header length of 20 bytes (which is the majority of IPv4 packets anyway).

# set tcp ack

Will match tcp packets with ACK flag set.

# set tcp syn

Will match tcp packets with SYN flag set.

ipv6

# edit traffic-policy shaper SHAPER class 30 match MATCH ipv6

destination

# set destination address IPv6-SUBNET
# set destination port U32-PORT

dscp

# set dscp DSCPVALUE

max-length

# set max-length U32-MAXLEN

Will match ipv6 packets with a payload length lesser than set value.

protocol

# set protocol IPPROTOCOL

source

# set source address IPv6-SUBNET
# set source port U32-PORT

tcp

Note : you must set ipv6 protocol to TCP to use the TCP filters. Note 2 : This filter will only match IPv6 packets with no header extension.

# set tcp ack

Will match tcp packets with ACK flag set.

# set tcp syn

Will match tcp packets with SYN flag set.

mark

# set traffic-policy shaper SHAPER class 30 match MATCH mark firewall-mark

vif

# set traffic-policy shaper SHAPER class 30 match MATCH vif vlan-tag