Configuring CoDel Limiters for Bufferbloat¶

The FQ_CODEL limiter scheduler can help alleviate the effects of Bufferbloat. The CoDel algorithm and bufferbloat are discussed in the ALTQ chapter at CoDel Active Queue Management and the same concepts apply to FQ_CODEL with limiters as well.

Before starting, use a Bufferbloat Test Site to determine if changes are necessary. If the firewall already receives a high score the circuit may not be prone to bufferbloat and thus may not require these limiters.

This configuration requires a limiter and queue for both download and upload, plus a floating rule to apply the limiters to outgoing traffic.

Create Download Limiter and Queue¶

The first task is to create a download limiter and queue:

Navigate to Firewall > Traffic Shaper, Limiters tab
Click New Limiter
- Configure the limiter with the following settings:
  
  Enable:
  
  Checked
  
  Name:
  
  WANDown
  
  Bandwidth:
  
  Set equal to WAN download bandwidth (confirm via speed test first)
  
  Mask:
  
  None
  
  Description:
  
  WAN Download
  
  Queue Management Algorithm:
  
  Tail Drop
  
  Scheduler:
  
  FQ_CODEL
  
  The page will display FQ_CODEL options and their default values after saving this limiter, but leave them at defaults.
  
  Queue Length:
  
  Can vary depending on the speed of the link, but 1000 should be a safe default for most high speed WANs (100Mbit/s). For very high speed WANs (e.g. 1Gbit/s+), consider increasing further to 3000-5000.
  
  ECN:
  
  Checked
- Click Save
Click Add New Queue under WANDown
- Configure the queue with the following settings:
  
  Enable:
  
  Checked
  
  Name:
  
  WANDownQ
  
  Mask:
  
  None
  
  Description:
  
  WAN Download Queue
  
  Queue Management Algorithm:
  
  Tail Drop
- Leave the other fields at their default values
- Click Save

Create Upload Limiter and Queue¶

Navigate to Firewall > Traffic Shaper, Limiters tab
Click New Limiter
- Configure the limiter with the following settings:
  
  Enable:
  
  Checked
  
  Name:
  
  WANUp
  
  Bandwidth:
  
  Set equal to WAN upload bandwidth (confirm via speed test first)
  
  Mask:
  
  None
  
  Description:
  
  WAN Upload
  
  Queue Management Algorithm:
  
  Tail Drop
  
  Scheduler:
  
  FQ_CODEL
  
  The page will display FQ_CODEL options and their default values after saving this limiter, but leave them at defaults.
  
  Queue Length:
  
  Can vary depending on the speed of the link, but 1000 should be a safe default for most high speed WANs (100Mbit/s). For very high speed WANs (e.g. 1Gbit/s+), consider increasing further to 3000-5000.
  
  ECN:
  
  Checked
- Click Save
Click Add New Queue under WANUp
- Configure the queue with the following settings:
  
  Enable:
  
  Checked
  
  Name:
  
  WANUpQ
  
  Mask:
  
  None
  
  Description:
  
  WAN Upload Queue
  
  Queue Management Algorithm:
  
  Tail Drop
- Leave the other fields at their default values
- Click Save
Click Apply Changes

Create Floating Rule¶

Navigate to Firewall > Rules, Floating tab
Click Add to create a new rule at the bottom of the list
- Configure the rule as follows:
  
  Action:
  
  Pass
  
  Quick:
  
  Checked
  
  Interface:
  
  WAN
  
  Direction:
  
  Out
  
  Address Family:
  
  IPv4
  
  Note
  
  If the WAN can carry both IPv4 and IPv6, make a separate rule for each address family.
  
  Protocol:
  
  Any
  
  Source:
  
  WAN Address
  
  Warning
  
  It is important not to match too loosely on the source, especially when a firewall has multiple WANs. In certain cases with multiple WANs, if traffic meant to exit an alternate non-default WAN matches this kind of floating rule, the traffic will end up dropped as pf may still process that traffic outbound on the default WAN before redirecting out the correct interface.
  
  Destination:
  
  Any
  
  Description:
  
  CoDel Limiters
  
  Gateway:
  
  Must be set to the gateway for this WAN interface
  
  In / Out Pipe:
  
  WANUpQ / WANDownQ
  
  Note
  
  On WAN floating rules in the outbound direction, “in” traffic is upload, and “out” traffic is download, from the perspective of LAN clients.
- Save
Apply Changes
Reset states to force all traffic to use new limiters

Test Again¶

Use a Bufferbloat Test Site again and compare score now to the score before the test was run. In most cases, the new score should be an A or higher.

If the score does not improve, or gets worse, there is likely a problem with the configuration. First, go back and compare all of the settings with the suggested values on this document.

If the configuration matches, the settings may need further adjustment. For example, the bandwidth values may be higher than the circuit is capable of delivering, the queue sizes may need increased, or the CoDel parameters may need changed. Post on the Netgate Forum for assistance with diagnosing the problem.

Notes¶

Certain configurations may require alterations to the suggested procedure above.

Multiple WANs¶

For multiple WANs make a complete set of queues for each WAN and make a separate floating rule for each WAN. Ensure the rules do not match the source IP address(es) of the other WANs.

For example:

Pass quick out WAN1 from WAN1 Address to any, gateway WAN1GW, In/Out Pipe WAN1UpQ/WAN1DownQ
Pass quick out WAN2 from WAN2 Address to any, gateway WAN2GW, In/Out Pipe WAN2UpQ/WAN2DownQ

Multiple Addresses/VIPs¶

If there are multiple IP addresses on a WAN (e.g. VIPs, routed subnets), create an alias with all of the necessary addresses and use it as the source of the floating rule.