[Openvpn-users] QoS -- passtos and non-tos packets?

[matt m. <m-...@go...>]

I have recently switched to using passtos, and doing htb traffic control to 
throw bulk (0x8) and interactive (0x10) tos packets into queues that correspond 
to the quality of service I want to achieve.

This works very well at the outer physical interface level - the TOS packets 
and other packet designations get into the right queues based on a number of 
filter matches.  However, when speaking strictly about the VPN, it seems that 
the packets with TOS are prioritized properly at the outer physical layer, but 
there are some additional packets with TOS 0x0 that get dumped into an "all 
other traffic" type of queue.

Using tcpdump on the outer physical interface, I can do interactive ssh and see 
that when I press enter, a number of udp packets hit the VPN server.  Some are 
TOS 0x10 and some are 0x0.  It is these 0x0 packets that concern me.  Since 
they get dumped into an "all other" type of queue, one high rate connection 
through the VPN can degrade the interactivity of other connections through the VPN.

The 0x10 (interactive) packets go through quickly, the 0x8 (bulk) packets get 
available bandwidth only type queuing, but these extra 0x0 packets from *all* 
VPN connections get lumped into a single queue, mixing packets associated with 
the bulk and interactive together into that single bucket.  While interactivity 
is improved over no queueing at all, the interactive sessions are still getting 
hampered by the lumping into a single queue of all the 0x0 packets I have no 
way to classify.

I'm curious if the 0x0 packets that are clearly associated with the 0x8 and 
0x10 packets should have their TOS bits set -- is there some issue with openvpn 
that is causing them not to be?  Are they control information for the 
particular TCP connection being encapsulated in the VPN?  Is there some way to 
better associate all packets related to a single connection on the outer 
physical network interface?  I'm guessing the inability to do so is part of the 
design - otherwise there might be information disclosure about the traffic 
encapsulated in the VPN tunnel.

Currently I am using iptables to set TOS for specific known services that 
people use through the VPN.  I have openvpn configured to pass TOS through, and 
then I perform queue selection with traffic control based on TOS bits.  Is 
there a better way to do QoS?


-matt

-- 
matt mead

http://collectivity.goof.com/