I’m trying to limit bandwidth download and upload on WAN for every VLAN. WAN speed is 1gbps/1gbps and I want each VLAN to have 50mbps/50mbps only when using the WAN. Not when traffic stay in the VLAN.
I tried traffic shaper but it’s only for outbound traffic. But I think it applies on VLAN internal traffic too.
I think in your case will be enough only for WAN interface, if you don’t have VLANs on WAN.
To clearly understand your topology will be better to draw it.
set traffic-policy shaper OUT bandwidth '1gbit'
set traffic-policy shaper OUT default bandwidth '500mbit'
set traffic-policy shaper OUT class 10 bandwidth '200mbit'
set traffic-policy shaper OUT class 10 match VLAN10 ip source address '192.168.10.1/24'
set traffic-policy shaper OUT class 11 bandwidth '200mbit'
set traffic-policy shaper OUT class 11 match VLAN11 ip source address '192.168.11.1/24'
set traffic-policy shaper OUT class 12 bandwidth '200mbit'
set traffic-policy shaper OUT class 12 match VLAN12 ip source address '192.168.12.1/24'
set traffic-policy limiter IN default bandwidth '1gbit'
set traffic-policy limiter IN class 10 bandwidth '200mbit'
set traffic-policy limiter IN class 10 match VLAN10 ip destination address '192.168.10.1/24'
set traffic-policy limiter IN class 11 bandwidth '200mbit'
set traffic-policy limiter IN class 11 match VLAN11 ip destination address '192.168.11.1/24'
set traffic-policy limiter IN class 12 bandwidth '200mbit'
set traffic-policy limiter IN class 12 match VLAN12 ip destination address '192.168.12.1/24'
set interfaces ethernet eth0 pppoe 0 traffic-policy in 'IN'
set interfaces ethernet eth0 pppoe 0 traffic-policy out 'OUT'
I try from my cellphone who is connected on the VLAN10 (192.168.10.10)
sudo tc -s -d class show dev pppoe0
returns nothing.
I have this when I run “show configuration commands”
set traffic-policy limiter IN class 10 bandwidth '25mbit'
set traffic-policy limiter IN class 10 match VLAN10 ip destination address '192.168.10.1/24'
set traffic-policy limiter IN class 11 bandwidth '25mbit'
set traffic-policy limiter IN class 11 match VLAN11 ip destination address '192.168.11.1/24'
set traffic-policy limiter IN default bandwidth '500mbit'
set traffic-policy shaper OUT bandwidth '500mbit'
set traffic-policy shaper OUT class 10 bandwidth '50mbit'
set traffic-policy shaper OUT class 10 match VLAN10 ip source address '192.168.10.1/24'
set traffic-policy shaper OUT class 11 bandwidth '50mbit'
set traffic-policy shaper OUT class 11 match VLAN11 ip source address '192.168.11.1/24'
set traffic-policy shaper OUT default bandwidth '500mbit'
set interfaces ethernet eth2 vif 35 pppoe 0 traffic-policy in 'IN'
set interfaces ethernet eth2 vif 35 pppoe 0 traffic-policy out 'OUT'
set traffic-policy shaper OUT bandwidth '1gbit'
set traffic-policy shaper OUT class 10 bandwidth '200mbit'
set traffic-policy shaper OUT class 10 match VLAN10 ip source address '192.168.10.0/24'
set traffic-policy shaper OUT class 11 bandwidth '200mbit'
set traffic-policy shaper OUT class 11 match VLAN11 ip source address '192.168.11.0/24'
set traffic-policy shaper OUT class 12 bandwidth '200mbit'
set traffic-policy shaper OUT class 12 match VLAN12 ip source address '192.168.12.0/24'
set traffic-policy shaper OUT default bandwidth '1kbit'
set traffic-policy shaper OUT default ceiling 100%
set traffic-policy shaper IN bandwidth '1gbit'
set traffic-policy shaper IN class 10 bandwidth '200mbit'
set traffic-policy shaper IN class 10 match VLAN10 ip destination address '192.168.10.0/24'
set traffic-policy shaper IN class 11 bandwidth '200mbit'
set traffic-policy shaper IN class 11 match VLAN11 ip destination address '192.168.11.0/24'
set traffic-policy shaper IN class 12 bandwidth '200mbit'
set traffic-policy shaper IN class 12 match VLAN12 ip destination address '192.168.12.0/24'
set traffic-policy shaper IN default bandwidth '1kbit'
set traffic-policy shaper IN default ceiling 100%
set interfaces <YOUR-WAN-INTERFACE-TYPE> <YOUR-WAN-INTERFACE-NAME> redirect ifb0
set interfaces input ifb0 traffic-policy out IN
set interfaces <YOUR-WAN-INTERFACE-TYPE> <YOUR-WAN-INTERFACE-NAME> traffic-policy out OUT
There is the result of show configuration commands
set firewall all-ping 'enable'
set firewall broadcast-ping 'enable'
set firewall config-trap 'disable'
set firewall ipv6-receive-redirects 'disable'
set firewall ipv6-src-route 'disable'
set firewall ip-src-route 'disable'
set firewall log-martians 'enable'
set firewall name LAN_IN default-action 'drop'
set firewall name LAN_IN rule 10 action 'accept'
set firewall name LAN_IN rule 10 state established 'enable'
set firewall name LAN_IN rule 10 state related 'enable'
set firewall name WAN_IN default-action 'drop'
set firewall name WAN_IN rule 10 action 'accept'
set firewall name WAN_IN rule 10 state established 'enable'
set firewall name WAN_IN rule 10 state related 'enable'
set firewall name WAN_IN rule 11 action 'accept'
set firewall name WAN_IN rule 11 description 'Allow HTTPS'
set firewall name WAN_IN rule 11 destination address '172.16.12.5'
set firewall name WAN_IN rule 11 destination port '443'
set firewall name WAN_IN rule 11 log 'disable'
set firewall name WAN_IN rule 11 protocol 'tcp'
set firewall name WAN_IN rule 11 state new 'enable'
set firewall name WAN_LOCAL default-action 'drop'
set firewall name WAN_LOCAL rule 10 action 'accept'
set firewall name WAN_LOCAL rule 10 state established 'enable'
set firewall name WAN_LOCAL rule 10 state related 'enable'
set firewall name WAN_LOCAL rule 20 action 'accept'
set firewall name WAN_LOCAL rule 20 icmp type-name 'echo-request'
set firewall name WAN_LOCAL rule 20 protocol 'icmp'
set firewall name WAN_LOCAL rule 20 state new 'enable'
set firewall name WAN_LOCAL rule 30 action 'drop'
set firewall name WAN_LOCAL rule 30 destination port '22'
set firewall name WAN_LOCAL rule 30 protocol 'tcp'
set firewall name WAN_LOCAL rule 30 recent count '4'
set firewall name WAN_LOCAL rule 30 recent time '60'
set firewall name WAN_LOCAL rule 30 state new 'enable'
set firewall name WAN_LOCAL rule 31 action 'accept'
set firewall name WAN_LOCAL rule 31 destination port '22'
set firewall name WAN_LOCAL rule 31 protocol 'tcp'
set firewall name WAN_LOCAL rule 31 state new 'enable'
set firewall name WAN_LOCAL rule 32 action 'accept'
set firewall name WAN_LOCAL rule 32 destination port '443'
set firewall name WAN_LOCAL rule 32 protocol 'tcp'
set firewall name WAN_LOCAL rule 32 state new 'enable'
set firewall receive-redirects 'disable'
set firewall send-redirects 'enable'
set firewall source-validation 'disable'
set firewall syn-cookies 'enable'
set firewall twa-hazards-protection 'disable'
set interfaces ethernet eth0 duplex 'auto'
set interfaces ethernet eth0 hw-id 'f4:e9:d4:84:52:50'
set interfaces ethernet eth0 smp-affinity 'auto'
set interfaces ethernet eth0 speed 'auto'
set interfaces ethernet eth1 duplex 'auto'
set interfaces ethernet eth1 hw-id 'f4:e9:d4:84:52:52'
set interfaces ethernet eth1 smp-affinity 'auto'
set interfaces ethernet eth1 speed 'auto'
set interfaces ethernet eth2 description 'BELL_FIBER'
set interfaces ethernet eth2 duplex 'auto'
set interfaces ethernet eth2 hw-id 'b4:2e:99:84:b6:21'
set interfaces ethernet eth2 mtu '1508'
set interfaces ethernet eth2 smp-affinity 'auto'
set interfaces ethernet eth2 speed 'auto'
set interfaces ethernet eth2 vif 35 description 'BELL_VLAN'
set interfaces ethernet eth2 vif 35 mtu '1508'
set interfaces ethernet eth2 vif 35 pppoe 0 default-route 'force'
set interfaces ethernet eth2 vif 35 pppoe 0 firewall in name 'WAN_IN'
set interfaces ethernet eth2 vif 35 pppoe 0 firewall local name 'WAN_LOCAL'
set interfaces ethernet eth2 vif 35 pppoe 0 mtu '1500'
set interfaces ethernet eth2 vif 35 pppoe 0 name-server 'auto'
set interfaces ethernet eth2 vif 35 pppoe 0 password 'MYPASSWORD'
set interfaces ethernet eth2 vif 35 pppoe 0 redirect 'ifb0'
set interfaces ethernet eth2 vif 35 pppoe 0 traffic-policy out 'OUT'
set interfaces ethernet eth2 vif 35 pppoe 0 user-id 'MYUSER'
set interfaces ethernet eth3 address '172.16.10.1/24'
set interfaces ethernet eth3 description 'LAN'
set interfaces ethernet eth3 duplex 'auto'
set interfaces ethernet eth3 firewall in
set interfaces ethernet eth3 hw-id '68:1c:a2:13:48:c5'
set interfaces ethernet eth3 smp-affinity 'auto'
set interfaces ethernet eth3 speed 'auto'
set interfaces ethernet eth4 address '172.16.11.1/24'
set interfaces ethernet eth4 description 'WLAN'
set interfaces ethernet eth4 duplex 'auto'
set interfaces ethernet eth4 firewall in
set interfaces ethernet eth4 hw-id '68:1c:a2:13:48:c6'
set interfaces ethernet eth4 smp-affinity 'auto'
set interfaces ethernet eth4 speed 'auto'
set interfaces ethernet eth4 vif 10 address '192.168.10.1/24'
set interfaces ethernet eth4 vif 10 description 'VLAN10'
set interfaces ethernet eth4 vif 11 address '192.168.11.1/24'
set interfaces ethernet eth4 vif 11 description 'VLAN11'
set interfaces ethernet eth5 address '172.16.12.1/24'
set interfaces ethernet eth5 description 'SERVER'
set interfaces ethernet eth5 duplex 'auto'
set interfaces ethernet eth5 firewall in
set interfaces ethernet eth5 hw-id '68:1c:a2:13:48:c7'
set interfaces ethernet eth5 smp-affinity 'auto'
set interfaces ethernet eth5 speed 'auto'
set interfaces ethernet eth6 duplex 'auto'
set interfaces ethernet eth6 hw-id '68:1c:a2:13:48:c8'
set interfaces ethernet eth6 smp-affinity 'auto'
set interfaces ethernet eth6 speed 'auto'
set interfaces input ifb0 traffic-policy out 'IN'
set interfaces loopback lo
set nat destination rule 10 description 'Port Forward HTTPS'
set nat destination rule 10 destination port '443'
set nat destination rule 10 inbound-interface 'pppoe0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '172.16.12.5'
set nat source rule 100 outbound-interface 'pppoe0'
set nat source rule 100 translation address 'masquerade'
set service dhcp-server shared-network-name LAN subnet 172.16.10.0/24 default-router '172.16.10.1'
set service dhcp-server shared-network-name LAN subnet 172.16.10.0/24 dns-server '1.1.1.1'
set service dhcp-server shared-network-name LAN subnet 172.16.10.0/24 dns-server '8.8.8.8'
set service dhcp-server shared-network-name LAN subnet 172.16.10.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 172.16.10.0/24 range 0 start '172.16.10.10'
set service dhcp-server shared-network-name LAN subnet 172.16.10.0/24 range 0 stop '172.16.10.254'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 default-router '172.16.12.1'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 dns-server '1.1.1.1'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 dns-server '8.8.8.8'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 lease '86400'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 range 0 start '172.16.12.10'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 range 0 stop '172.16.12.254'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN ip-address '172.16.12.4'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN mac-address '32:08:c6:1b:fe:4e'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN ip-address '172.16.12.3'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN mac-address '36:38:9e:c2:6c:34'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN ip-address '172.16.12.10'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN mac-address 'e2:f7:fa:62:2c:6c'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN ip-address '172.16.12.5'
set service dhcp-server shared-network-name SERVER subnet 172.16.12.0/24 static-mapping HIDDEN mac-address '66:16:fc:66:06:c7'
set service dhcp-server shared-network-name VLAN10 subnet 192.168.10.0/24 default-router '192.168.10.1'
set service dhcp-server shared-network-name VLAN10 subnet 192.168.10.0/24 dns-server '1.1.1.1'
set service dhcp-server shared-network-name VLAN10 subnet 192.168.10.0/24 dns-server '8.8.8.8'
set service dhcp-server shared-network-name VLAN10 subnet 192.168.10.0/24 lease '86400'
set service dhcp-server shared-network-name VLAN10 subnet 192.168.10.0/24 range 0 start '192.168.10.10'
set service dhcp-server shared-network-name VLAN10 subnet 192.168.10.0/24 range 0 stop '192.168.10.254'
set service dhcp-server shared-network-name VLAN11 subnet 192.168.11.0/24 default-router '192.168.11.1'
set service dhcp-server shared-network-name VLAN11 subnet 192.168.11.0/24 dns-server '1.1.1.1'
set service dhcp-server shared-network-name VLAN11 subnet 192.168.11.0/24 dns-server '8.8.8.8'
set service dhcp-server shared-network-name VLAN11 subnet 192.168.11.0/24 lease '86400'
set service dhcp-server shared-network-name VLAN11 subnet 192.168.11.0/24 range 0 start '192.168.11.10'
set service dhcp-server shared-network-name VLAN11 subnet 192.168.11.0/24 range 0 stop '192.168.11.254'
set service dhcp-server shared-network-name WLAN subnet 172.16.11.0/24 default-router '172.16.11.1'
set service dhcp-server shared-network-name WLAN subnet 172.16.11.0/24 dns-server '1.1.1.1'
set service dhcp-server shared-network-name WLAN subnet 172.16.11.0/24 dns-server '8.8.8.8'
set service dhcp-server shared-network-name WLAN subnet 172.16.11.0/24 lease '86400'
set service dhcp-server shared-network-name WLAN subnet 172.16.11.0/24 range 0 start '172.16.11.10'
set service dhcp-server shared-network-name WLAN subnet 172.16.11.0/24 range 0 stop '172.16.11.254'
set service ssh port '22'
set system config-management commit-revisions '100'
set system console device ttyS0 speed '9600'
set system host-name 'vyos'
set system login user vyos authentication encrypted-password 'PASSWORD'
set system login user vyos authentication plaintext-password ''
set system login user vyos level 'admin'
set system ntp server 0.pool.ntp.org
set system ntp server 1.pool.ntp.org
set system ntp server 2.pool.ntp.org
set system syslog global facility all level 'info'
set system syslog global facility protocols level 'debug'
set system task-scheduler
set system time-zone 'UTC'
set traffic-policy shaper IN bandwidth '500mbit'
set traffic-policy shaper IN class 10 bandwidth '25mbit'
set traffic-policy shaper IN class 10 match VLAN10 ip destination address '192.168.10.0/24'
set traffic-policy shaper IN class 11 bandwidth '25mbit'
set traffic-policy shaper IN class 11 match VLAN11 ip destination address '192.168.11.0/24'
set traffic-policy shaper IN default bandwidth '500mbit'
set traffic-policy shaper IN default ceiling '100%'
set traffic-policy shaper OUT bandwidth '500mbit'
set traffic-policy shaper OUT class 10 bandwidth '50mbit'
set traffic-policy shaper OUT class 10 match VLAN10 ip source address '192.168.10.0/24'
set traffic-policy shaper OUT class 11 bandwidth '50mbit'
set traffic-policy shaper OUT class 11 match VLAN11 ip source address '192.168.11.0/24'
set traffic-policy shaper OUT default bandwidth '500mbit'
set traffic-policy shaper OUT default ceiling '100%'
It doesn’t limit at all… Speedtest show me full speed.
You are allocating the whole bandwidth to the default class on both policies. The total sum of every class bandwidth should be equal or less than the bandwidth of the link, as shown in my suggested configuration.
Anyway, if you see no shape at all, I’m afraid there must be some other problem there…
For the time being please fix the bandwidth issue (ask us if you have doubts) and let us know. If things don’t work, tomorrow I can have a look in the lab.
So, you see no shape at all in your tests. I understand you mean you can see your class traffic can actually flow constantly at more speed than the bandwidth value you set for that class, and no ceiling was set for that class. If that is the case, maybe your QoS configuration is not being applied.
When you commit your configuration, do you get any error message?
set traffic-policy shaper OUT bandwidth '500mbit'
set traffic-policy shaper OUT class 10 bandwidth '50mbit'
set traffic-policy shaper OUT class 10 match VLAN10 ip source address '192.168.10.0/24'
set traffic-policy shaper OUT class 11 bandwidth '50mbit'
set traffic-policy shaper OUT class 11 match VLAN11 ip source address '192.168.11.0/24'
set traffic-policy shaper OUT default bandwidth '1kbit'
set traffic-policy shaper OUT default ceiling 100%
set traffic-policy shaper IN bandwidth '500mbit'
set traffic-policy shaper IN class 10 bandwidth '25mbit'
set traffic-policy shaper IN class 10 match VLAN10 ip destination address '192.168.10.0/24'
set traffic-policy shaper IN class 11 bandwidth '25mbit'
set traffic-policy shaper IN class 11 match VLAN11 ip destination address '192.168.11.0/24'
set traffic-policy shaper IN default bandwidth '1kbit'
set traffic-policy shaper IN default ceiling 100%
set interfaces ethernet eth2 vif 35 pppoe 0 redirect ifb0
set interfaces input ifb0 traffic-policy out IN
set interfaces ethernet eth2 vif 35 pppoe 0 traffic-policy out OUT
I got the following message
[ interfaces ethernet eth2 vif 35 pppoe 0 redirect ifb0 ]
Exiting subroutine via next at /opt/vyatta/sbin/vyatta-qos.pl line 315.
show queueing pppoe 0 returns
Cannot find device "0"
0 Queueing:
Class Policy Sent Dropped Overlimit Backlog