Unifi Edgerouter QoS

By steve, 8 February, 2019

I had a look at replacing a Mikrotik with a Unifi Edgerouter, specificaly looking at QoS and whether one was easier to understand than the other. My conclusion was that the Mikrotik has better visibility with its queue trees, however the process for setting up QoS on the edgerouter is as follows:

One note is that the edgerouter implementation is better at guaranteeing that all traffic will hit the QoS queues, compared to a Mikrotik where packets marked with a new packet mark will go direct to the interface until they are explicitly put into a queue.


1: Create any queue types
set traffic-control advanced-queue queue-type pfifo PFIFO_100 limit 100

2: Set a root queue attached to each interface with the total bandwidth. The default option is a leaf queue for all unclassified traffic to be put into (leaf node does not exists yet)
set traffic-control advanced-queue root queue 100 attach-to eth0
set traffic-control advanced-queue root queue 100 bandwidth 40mbit
set traffic-control advanced-queue root queue 100 default 199
set traffic-control advanced-queue root queue 100 description DEV-UPLOAD
set traffic-control advanced-queue root queue 200 attach-to eth1
set traffic-control advanced-queue root queue 200 bandwidth 40mbit
set traffic-control advanced-queue root queue 200 default 299
set traffic-control advanced-queue root queue 200 description BREMMAR-UP

3: Create leaf queues with guranateed and max bandwidths (leaf queues can have a root or anothe leaf queue as a parent)
set traffic-control advanced-queue leaf queue 101 bandwidth 10mbit
set traffic-control advanced-queue leaf queue 101 ceiling 20mbit
set traffic-control advanced-queue leaf queue 101 description 'High Prio'
set traffic-control advanced-queue leaf queue 101 parent 100
set traffic-control advanced-queue leaf queue 101 priority 0
set traffic-control advanced-queue leaf queue 101 queue-type PFIFO_100
set traffic-control advanced-queue leaf queue 199 bandwidth 1mbit
set traffic-control advanced-queue leaf queue 199 ceiling 40mbit
set traffic-control advanced-queue leaf queue 199 parent 100
set traffic-control advanced-queue leaf queue 199 priority 7
set traffic-control advanced-queue leaf queue 199 queue-type PFIFO_100
set traffic-control advanced-queue leaf queue 201 bandwidth 10mbit
set traffic-control advanced-queue leaf queue 201 ceiling 20mbit
set traffic-control advanced-queue leaf queue 201 description 'High Prio'
set traffic-control advanced-queue leaf queue 201 parent 200
set traffic-control advanced-queue leaf queue 201 priority 0
set traffic-control advanced-queue leaf queue 201 queue-type PFIFO_100
set traffic-control advanced-queue leaf queue 299 bandwidth 1mbit
set traffic-control advanced-queue leaf queue 299 ceiling 40mbit
set traffic-control advanced-queue leaf queue 299 parent 200
set traffic-control advanced-queue leaf queue 299 priority 7
set traffic-control advanced-queue leaf queue 299 queue-type PFIFO_100

4: Create rules that attach to a root (or leaf) queue to place packets in a particular queue
-- Example with filter rules (less powerful, but easier to set up)
set traffic-control advanced-queue filters match 1010 attach-to 100
set traffic-control advanced-queue filters match 1010 ip destination port 8080
set traffic-control advanced-queue filters match 1010 target 101
set traffic-control advanced-queue filters match 2010 attach-to 200
set traffic-control advanced-queue filters match 2010 ip destination port 8080
set traffic-control advanced-queue filters match 2010 target 201

-- Example with firewall marking (requires step 5 below)
set traffic-control advanced-queue filters match 1011 attach-to 100
set traffic-control advanced-queue filters match 1011 mark 1
set traffic-control advanced-queue filters match 1011 target 101
set traffic-control advanced-queue filters match 2011 attach-to 200
set traffic-control advanced-queue filters match 2011 mark 1
set traffic-control advanced-queue filters match 2011 target 201

5: Create any firewall marking rules (make sure you modify the ruleset if there is already a modify ruleset attached)
- First we want to short-cut the rules for any marked connections. This is no different in complexity to the Mikrotik rules
set firewall modify rule 10 action modify
set firewall modify rule 10 modify connmark restore-mark
set firewall modify rule 11 action accept
set firewall modify rule 11 mark '!0'

- Second we want to create a bunch of rules that mark the packets based on criteria. The use of numbers here is probably less helpful than a Mikrotik
set firewall modify rule 20 action modify
set firewall modify rule 20 destination port 80
set firewall modify rule 20 modify mark 1
set firewall modify rule 20 protocol tcp

- Finally, we save the packet mark to the connection (so the shortcut at the top works)
set firewall modify rule 50 action modify
set firewall modify rule 50 modify connmark save-mark

6: Attach the appropriate firewall marking ruleset to the appropriate interface
set interfaces switch switch0 firewall in modify

Tags

Comments