Upgrade 3CX to v18 and get it hosted free!
Home | Asterisk | Asterisk QoS

Asterisk QoS

Author image
Posted by , on July 19, 2005

Quality of Service

Asterisk changes the IP header to include a request for Type Of Service (TOS). As long as all the routers along the path understand and respect the request to prioritize the traffic it should work out ok. On a private network, this is usually the case. On the internet, especially with some of the cheap and small firewalls and NATs, this may or may not be the case. Some of the newer ones have TOS and QOS (Ethernet) as an option.
See: VOIP Routers

Example 1: QoS using sveasoft

Jacob Hunter, Aug 4, 2004
This works very well… It does NOT work with stable 4.0! sveasoft will be issuing a bug fix for this (4.1) in the near future.

Final Rev of working script w/ asterisk support

I’m not going to run alchemy on production machines until it is established. Remember to set your uplink properly and to set your proper wan port. I use pppoe for mine.

This must be used with pre 3.11

I used that same script but did some final tweaks to make it work perfectly for Asterisk using IAX and SIP!

Code: (watch out, some of the line wraps might have been messed up!)

IPT=/usr/sbin/iptables
IP=/usr/sbin/ip
TC=/usr/sbin/tc

  1. Specify ethernet device, Queue length, and MTU size
  2. ((qlen * mtu) / rate) / 1024 = time

DEV=ppp0
OUT_QLEN=30
MTU=1492

  1. Set to ~80% of tested maximum bandwidth

UPLINK=495

  1. specify class rates – We grant each class at LEAST its “fair share” of
  2. bandwidth. this way no class will ever be starved by another class.

UPLINK_1_R=200 # VOIP only
UPLINK_2_R=64 # Interactive (low port) traffic and ICMP/ACK
UPLINK_3_R=16 # Everything else (ssh)
UPLINK_4_R=16 # P2P

  1. Each class is also permitted to consume all of the available bandwidth
  2. if no other classes are in use.

UPLINK_1_C=${UPLINK}
UPLINK_2_C=${UPLINK}
UPLINK_3_C=${UPLINK}
UPLINK_4_C=${UPLINK}

  1. remove old qdiscs

$TC qdisc del dev $DEV root 2> /dev/null > /dev/null
$TC qdisc del dev $DEV ingress 2> /dev/null > /dev/null

  1. reset iptables rules

$IPT -t mangle -D POSTROUTING -o $DEV -j MYOUT
$IPT -t mangle -F MYOUT
$IPT -t mangle -X MYOUT

  1. set outgoing queue length

$IP link set dev $DEV qlen ${OUT_QLEN}

  1. lower the MTU to decrease latency
  2. $IP link set dev $DEV mtu $MTU

 

  1. Create HTB root qdisc with an htb default of 30

$TC qdisc add dev $DEV root handle 1: htb default 40

  1. create main rate limit class

$TC class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit

  1. create leaf rate limit classes

$TC class add dev $DEV parent 1:1 classid 1:10 htb rate
${UPLINK_1_R}kbit ceil ${UPLINK_1_C}kbit prio 0
$TC class add dev $DEV parent 1:1 classid 1:20 htb rate
${UPLINK_2_R}kbit ceil ${UPLINK_2_C}kbit prio 1
$TC class add dev $DEV parent 1:1 classid 1:30 htb rate
${UPLINK_3_R}kbit ceil ${UPLINK_3_C}kbit prio 2
$TC class add dev $DEV parent 1:1 classid 1:40 htb rate
${UPLINK_4_R}kbit ceil ${UPLINK_4_C}kbit prio 3

  1. attach qdisc to leaf classes – here we at SFQ to each priority class. SFQ
  2. insures that within each class connections will be treated (almost) fairly.

$TC qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
$TC qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
$TC qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
$TC qdisc add dev $DEV parent 1:40 handle 40: sfq perturb 10

  1. add MYOUT chain to the mangle table in $IPT – this sets up the table
  2. we use to filter and mark packets.

$IPT -t mangle -N MYOUT
$IPT -t mangle -I POSTROUTING -o $DEV -j MYOUT

  1. add fwmark entries to classify different types of traffic – Set fwmark from
  2. 10-40 according to desired class. 10 is highest prio.

 

  1. outgoing VOIP rules – trumps everything else

$IPT -t mangle -A MYOUT -p udp –sport 5060:5063 -j CLASSIFY –set-class 1:10
$IPT -t mangle -A MYOUT -p udp –dport 5060:5063 -j CLASSIFY –set-class 1:10
$IPT -t mangle -A MYOUT -p udp –sport 4569:4569 -j CLASSIFY –set-class 1:10
$IPT -t mangle -A MYOUT -p udp –dport 4569:4569 -j CLASSIFY –set-class 1:10
$IPT -t mangle -A MYOUT -p udp –sport 5036:5036 -j CLASSIFY –set-class 1:10
$IPT -t mangle -A MYOUT -p udp –dport 5036:5036 -j CLASSIFY –set-class 1:10

  1. default for outgoing interactive ports rules

$IPT -t mangle -A MYOUT -p tcp –sport 0:1024 -j CLASSIFY –set-class 1:20
$IPT -t mangle -A MYOUT -p tcp –dport 0:1024 -j CLASSIFY –set-class 1:20

  1. the ack rule — for ack packets smaller than 64 bytes –it must be

added using

  1. tc filter instead of iptables for now because the length module appears to be
  2. broken and/or missing from the wrt54g iptables

$TC filter add dev $DEV parent 1:0 prio 1 protocol ip u32 match ip
protocol 6 0xff match u16 0x0000 0xffc0 at 2 match u8 0x10 0xff at 33
flowid 1:10
$TC filter add dev $DEV parent 1:0 prio 1 protocol ip u32 match ip
protocol 6 0xff match u16 0x0000 0xffc0 at 2 match u8 0x60 0xff at 33
flowid 1:10
$TC filter add dev $DEV parent 1:0 prio 1 protocol ip u32 match ip
protocol 6 0xff match u16 0x0000 0xffc0 at 2 match u8 0xb8 0xff at 33
flowid 1:10

  1. outgoing DNS rule

$IPT -t mangle -A MYOUT -p udp –dport domain -j CLASSIFY –set-class 1:20

  1. cheap outgoing ping rule

$IPT -t mangle -A MYOUT -p icmp -j CLASSIFY –set-class 1:20

  1. outgoing ssh connection rule

$IPT -t mangle -A MYOUT -p tcp –sport ssh -j CLASSIFY –set-class 1:20
$IPT -t mangle -A MYOUT -p tcp –dport ssh -j CLASSIFY –set-class 1:20

  1. outgoing P2P rules — these are close to last b/c they use relatively costly layer 7 matching

$IPT -t mangle -A MYOUT -m layer7 –l7dir /etc/l7-protocols/protocols
–l7proto directconnect -j CLASSIFY –set-class 1:40
$IPT -t mangle -A MYOUT -m layer7 –l7dir /etc/l7-protocols/protocols
–l7proto fasttrack -j CLASSIFY –set-class 1:40

  1. outgoing default rule – unmarked packets get schleped into lowest prio

$IPT -t mangle -A MYOUT -m mark –mark 0 -j CLASSIFY –set-class 1:30

  1. All done, exit ok

exit 0
‘

Example 2 with Sangoma S518

I’ve been using the following script on my 4032/800kbps ADSL connection for over three weeks now — note I am using a Sangoma S518 ADSL PCI card so I do not have to rate limit my uplink lower than my line rate — if you are using a craptastic Speedstream DSL modem (the kind Bell Canada gives you) or really any external ADSL modem connected via ethernet or USB you will need to rate limit your uplink by adjusting the UPRATE variable.

What it does:

  1. short queue lengths to prevent backlog of time-sensitive packets
  2. prioritize outgoing traffic on the DSL side, keeping the total outgoing rate to my line speed
  3. prioritize outgoing traffic on the ethernet side (just a priomap) so that any incoming VOIP traffic gets spat out the ethernet interface first
  4. P2P traffic is marked using ipt_p2p and given lowest priority

This is on a router serving a small network of local businesses so SFQ is used everywhere and I can guarantee minimum rates by adjusting the limiter. I think they only thing I’d change in the next iteration is to add another htb leaf and have p2p bumped down one class lower than SMTP traffic.

I can saturate the link in both directions (a dozen or so separate bittorrent transfers, some freetracker stuff and a couple big FTPs in both directions) and VOIP traffic doesn’t seem to suffer at all.

-A.

 

  1. !/bin/bash

DSLDEV=wp1adsl
LANDEV=eth0
UPRATE=800
DOWNRATE=4032

if [ “$1” = “upstatus” ]
then
tc -s qdisc ls dev $DSLDEV
echo
tc -s class ls dev $DSLDEV
exit
fi

if [ “$1” = “downstatus” ]
then
tc -s qdisc ls dev $LANDEV
echo
tc -s class ls dev $LANDEV
exit
fi

  1. clean existing down- and uplink qdiscs, hide errors

tc qdisc del dev $DSLDEV root 2> /dev/null > /dev/null
tc qdisc del dev $DSLDEV ingress 2> /dev/null > /dev/null

tc qdisc del dev $LANDEV root 2> /dev/null > /dev/null
tc qdisc del dev $LANDEV ingress 2> /dev/null > /dev/null

iptables -t mangle -D PREROUTING -m p2p -j CONNMARK –set-mark 1 2> /dev/null

>> /dev/null

iptables -t mangle -D PREROUTING -m connmark –mark 1 -j CONNMARK
–restore-mark 2> /dev/null > /dev/null

if [ “$1” = “stop” ]
then
exit
fi

  1. *** UPSTREAM (SENDING) CONFIG ***

CEIL=$[100*$UPRATE/100]
VOIPRATE=$[50*$CEIL/100]
MISCRATE=$[50*$CEIL/100]

  1. set packet queue much smaller than default (100):

ip link set dev $DSLDEV qlen 10

  1. install root HTB, point default traffic to 1:30:

tc qdisc add dev $DSLDEV root handle 1: htb r2q 1 default 30

  1. shape everything at $CEIL speed – this prevents huge queues in the DSL modem

which destroy latency:
tc class add dev $DSLDEV parent 1: classid 1:1 htb rate ${CEIL}kbit

  1. 1:10 – VOIP traffic
  2. 1:20 – high priority (interactive) traffic
  3. 1:30 – default (bulk) traffic
  4. 1:40 – lowest priority traffic

tc class add dev $DSLDEV parent 1:1 classid 1:10 htb rate ${VOIPRATE}kbit ceil
${CEIL}kbit prio 1
tc class add dev $DSLDEV parent 1:1 classid 1:20 htb rate
$[50*$MISCRATE/100]kbit ceil ${CEIL}kbit prio 2
tc class add dev $DSLDEV parent 1:1 classid 1:30 htb rate
$[30*$MISCRATE/100]kbit ceil ${CEIL}kbit prio 3
tc class add dev $DSLDEV parent 1:1 classid 1:40 htb rate
$[20*$MISCRATE/100]kbit ceil ${CEIL}kbit prio 4

  1. VOIP gets FIFO with a (very) short queue, the rest get Stochastic Fairness:

tc qdisc add dev $DSLDEV parent 1:10 handle 10: pfifo limit 5
tc qdisc add dev $DSLDEV parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev $DSLDEV parent 1:30 handle 30: sfq perturb 10
tc qdisc add dev $DSLDEV parent 1:40 handle 40: sfq perturb 10

  1. VOIP traffic in 1:10
  2. TOS min delay, ICMP, DNS and TCP ACKs in 1:20
  3. bulk traffic is already thrown in to 1:30 by “default” in root qdisc
  4. all SMTP and P2P traffic and anything to/from Rosu’s or Bakelaar’s IPs go

into 1:40

tc filter add dev $DSLDEV parent 1: protocol ip prio 10 u32 match ip dport
4569 0xffff match ip protocol 17 0xff flowid 1:10
tc filter add dev $DSLDEV parent 1: protocol ip prio 11 u32 match ip sport
4569 0xffff match ip protocol 17 0xff flowid 1:10
tc filter add dev $DSLDEV parent 1: protocol ip prio 12 u32 match ip dst
66.225.202.72 flowid 1:10

tc filter add dev $DSLDEV parent 1:0 protocol ip prio 21 u32 match ip protocol
1 0xff flowid 1:20
tc filter add dev $DSLDEV parent 1:0 protocol ip prio 22 u32 match ip protocol
47 0xff flowid 1:20
tc filter add dev $DSLDEV parent 1:0 protocol ip prio 23 u32 match ip protocol
50 0xff flowid 1:20
tc filter add dev $DSLDEV parent 1:0 protocol ip prio 24 u32 match ip sport 53
0xffff flowid 1:20
tc filter add dev $DSLDEV parent 1:0 protocol ip prio 25 u32 match ip dport 53
0xffff flowid 1:20
tc filter add dev $DSLDEV parent 1:0 protocol ip prio 26 u32 \
match ip protocol 6 0xff \
match u8 0x05 0x0f at 0 \
match u16 0x0000 0xffc0 at 2 \
match u8 0x10 0xff at 33 \
flowid 1:20

  1. low-priority src/dest ports

tc filter add dev $DSLDEV parent 1: protocol ip prio 40 u32 match ip dport 25
0xffff flowid 1:40
tc filter add dev $DSLDEV parent 1: protocol ip prio 41 u32 match ip sport 25
0xffff flowid 1:40
tc filter add dev $DSLDEV parent 1: protocol ip prio 42 u32 match ip sport 110
0xffff flowid 1:40
tc filter add dev $DSLDEV parent 1: protocol ip prio 43 u32 match ip sport 143
0xffff flowid 1:40

  1. low-priority specific src/dest *hosts*

tc filter add dev $DSLDEV parent 1: protocol ip prio 44 u32 match ip src
a.b.c.d flowid 1:40
tc filter add dev $DSLDEV parent 1: protocol ip prio 45 u32 match ip src
a.b.c.d flowid 1:40

  1. any traffic that the p2p match module for iptables finds (it marks with

–set-mark 1):
tc filter add dev $DSLDEV parent 1: protocol ip prio 46 handle 1 fw flowid
1:40

  1. LAN ingress handler; drop any NON-VOIP traffic > rate
  2. note the weird match to anything on eth1’s network (the /25) — I don’t want

to limit anything that is just passing

  1. through the router and back out the same interface.

tc qdisc add dev $DSLDEV handle ffff: ingress
tc filter add dev $DSLDEV parent ffff: protocol ip prio 50 u32 match ip dport
4569 0xffff match ip protocol 17 0xff flowid :1
tc filter add dev $DSLDEV parent ffff: protocol ip prio 51 u32 match ip sport
4569 0xffff match ip protocol 17 0xff flowid :1
tc filter add dev $DSLDEV parent ffff: protocol ip prio 52 u32 match ip dst
66.225.202.72 flowid :1
tc filter add dev $DSLDEV parent ffff: protocol ip prio 54 u32 match ip dst
0.0.0.0/0 \
police rate $[90*$DOWNRATE/100]kbit burst 10k drop flowid :1

  1. *** DOWNSTREAM (RECEIVING) CONFIG ***
  2. You don’t want to police incoming traffic, so we instead limit the rate at

which we send packets out to the LAN side
CEIL=$[100*$DOWNRATE/100]

  1. Leave $VOIPRATE the same as before since it’ll always be symmetrical (or at

least it should be)
MISCRATE=$[$[90*$CEIL/100]-$VOIPRATE]

  1. echo CEIL is $CEIL, VOIPRATE is $VOIPRATE, MISCRATE is $MISCRATE

 

  1. set packet queue much smaller than default (100):

ip link set dev $LANDEV qlen 10

  1. default priomap —————————————–> 1 2 1 1 2 2 2 2 0

0 0 0 1 1 1 1
tc qdisc add dev $LANDEV root handle 1: prio bands 5 priomap 2 2 2 2 2 2 2 2 1
1 1 1 2 2 2 2

  1. 1:1 – VOIP
  2. 1:2 – interactive traffic
  3. 1:3 – bulk traffic
  4. 1:4 – low-priority traffic
  5. 1:5 – P2P traffic

tc qdisc add dev $LANDEV parent 1:1 handle 10: sfq
tc qdisc add dev $LANDEV parent 1:2 handle 20: sfq
tc qdisc add dev $LANDEV parent 1:3 handle 30: sfq
tc qdisc add dev $LANDEV parent 1:4 handle 40: sfq
tc qdisc add dev $LANDEV parent 1:5 handle 50: sfq

tc filter add dev $LANDEV parent 1: protocol ip prio 11 u32 match ip dport
4569 0xffff match ip protocol 17 0xff flowid 1:1
tc filter add dev $LANDEV parent 1: protocol ip prio 12 u32 match ip sport
4569 0xffff match ip protocol 17 0xff flowid 1:1

tc filter add dev $LANDEV parent 1:0 protocol ip prio 21 u32 \
match ip protocol 6 0xff \
match u8 0x05 0x0f at 0 \
match u16 0x0000 0xffc0 at 2 \
match u8 0x10 0xff at 33 \
flowid 1:2

tc filter add dev $LANDEV parent 1: protocol ip prio 41 u32 match ip dport 25
0xffff flowid 1:4

tc filter add dev $LANDEV parent 1: protocol ip prio 42 u32 match ip sport 25
0xffff flowid 1:4
tc filter add dev $LANDEV parent 1: protocol ip prio 43 u32 match ip src
a.b.c.d flowid 1:4
tc filter add dev $LANDEV parent 1: protocol ip prio 44 u32 match ip src
a.b.c.d flowid 1:4

tc filter add dev $LANDEV parent 1: protocol ip prio 51 handle 1 fw flowid 1:5

  1. p2p detection

iptables -t mangle -A PREROUTING -m p2p -j CONNMARK –set-mark 1
iptables -t mangle -A PREROUTING -m connmark –mark 1 -j CONNMARK
–restore-mark

Example 3 similar to above, only different

I (Kristian Kielhofner) have created a QoS script based off of WonderShaper from LARTC for use with my AstLinux project. It seems to do better than the script above (for me, at least). It works very well for my uses because I have IAX2 trunks that always use a consistent port, and all of my remote SIP devices are Sipura’s that let me modify the IP TOS field. This allows me to prioritize traffic some-what sanely. I currently use IP TOS 0x10 for SIP messaging and 0x18 for RTP traffic. Remember to set tos=0x18 in iax and sip.conf (184 would not work for me)…

See also

Related Posts:

Asterisk func strreplace
July 26, 2017
Synopsis Replace instances of a substring within a string with another string. Description Searches for all instances of the <find-string> in provided var...
asterisk cli command queue show
January 18, 2016
Synopsis show the queue current status Syntax: Asterisk 1.4 or later: queue show [<queue name>] Note: the queue name is not necessary. If queue name is nu...
Asterisk RealTime PostgreSQL
December 26, 2005
So, rather than have this stuff all over the place, I thought it would be easier if I just made a page that would handle all things RealTime and PostgreSQL. Whi...
Asterisk MulticastRTP channels
September 17, 2011
MulticastRTP Asterisk 1.8: A new RTP engine and channel driver have been added which supports Multicast RTP. The channel driver can be used with the Page applic...
Asterisk festival installation
August 21, 2005
How to install Festival for Asterisk usage Festival is a text-to-speech application that is callable from within Asterisk. Voice is rather rough, but usable. Th...
Asterisk func FILE
September 21, 2011
Synopsis Read or write text file. Description Read and write text file in character and line mode. Examples: Read mode (byte): ;reads the entire content of the ...
Asterisk security through geographic IP address restriction
July 8, 2010
Page Contents Available Software and Scripts See also There are many approaches to implementing security in Asterisk (see Asterisk security ), but for some syst...
Asterisk Manager API
September 23, 2005
The Asterisk Manager Interface (AMI) allows a client program to connect to an Asterisk instance and issue commands or read events over a TCP/IP stream. Integrat...
Asterisk Presence for Cisco 79×1 Phones
March 4, 2007
Newer Cisco IP Phones such as the 7941, 7961, and 7971 now support BLF or presence information for speed dial numbers. Unfortunately, configuring the phones for...
Asterisk SIP trustrpid
September 3, 2004
trustrpid This defines whether or not Remote-Party-ID is trusted. It’s defined in http://tools.ietf.org/id/draft-ietf-sip-privacy-04.txt Usage The followi...
Get 3CX - Absolutely Free!
Link up your team and customers Phone System Live Chat Video Conferencing

Hosted or Self-managed. Up to 10 users free forever. No credit card. Try risk free.

3CX
A 3CX Account with that email already exists. You will be redirected to the Customer Portal to sign in or reset your password if you've forgotten it.
Verify your Email

Check your inbox!

We’ve sent you an email. Click on the button in the email body to verify your email address – (if you can not find it, check your spam folder).

Upon verification you will be directed to the 3CX setup wizard.