IPSec Tunnel Crippled by QoS


I have an IPSec tunnel that I have been using iperf3 to test speed. I’m on a 50/12mbits link.

I was getting only 25mbits maximum when doing iperf across the IPSec tunnel. If I bypassed the tunnel to the same iperf server, I would get 47mbits which is pretty well bang on what I’d expect.

Looking further into it, I found that after disabling QoS, I could get 47mbits through.

So it became evident to me that QoS is doing something to cripple my IPSec tunnel.

Having a look I could see my correctly categorised VPN traffic, and also some default traffic (which was iperf). I guess in theory the iperf traffic and the VPN traffic could be competing with each other?

So what I have done is I have put iperf in the VPN category, and so now all traffic is green, the VPN category, there are no categories competing against each other and so I would expect VPN traffic to run at the maximum rate that I assign to the VPN category:

See all the nice green VPN traffic, no conflicting or competing traffic.

Above is my categorisation of VPN traffic.

I also have the error mentioned by someone else in another thread:

Jun 18 01:39:10 NF-WKIT-01 codel: Codel AQM could not be enabled on 'imq0'. Error code: 2

When I reboot the IPFire device that error message is in the logs from startup. I am guessing that QoS is borked for me?

This is my iperf through the ipsec tunnel with QoS on:

This is my iperf with QoS turned off:

You can see the big difference right? So QoS is killing my S2S tunnel :confused:

This is a double post. It is not really helpful to flood this space with the same problems over and over again…

1 Like

Sorry I thought it might be good to put just this specific one in the QoS category, and I went into more depth here for investigation into the QoS side.

There has been a series of double/triple posts and I do not really know where to reply to. I would rather just leave it instead because nobody will be able to follow the conversation properly any more…

Its fine to delete it if you want because I guess you know about it so that’s the important part.

I am confused because 12642 – QoS does not correctly set fq_codel qdisc is closed as not a bug.

But I think I definitely have a bug (but admittedly could be unrelated to that bug description). Should I create one on bugzilla?

Yes, you can create a ticket, because I can reproduce this problem.

This is not a bug, but rather a user error.

1 Like