QoS (Quality of Service) in VyOS

VyOS provides powerful Quality of Service (QoS) mechanisms for managing bandwidth, prioritizing traffic and controlling latency across network connections.

The QoS Concept

Core QoS Objectives

Quality of Service addresses:

Prioritizing critical traffic (VoIP, video conferencing)
Limiting bandwidth for non-critical services
Preventing congestion of communication links
Guaranteeing minimum throughput
Managing latency and jitter
Controlling burst traffic

Key metrics:

Bandwidth: Volume of data per unit of time
Latency: Time taken to deliver a packet
Jitter: Variation in latency
Packet loss: Percentage of lost packets

QoS Components in VyOS

Traffic Policy:

Defining traffic handling rules
Classifying packets by various criteria
Applying actions to classified traffic

Queueing Disciplines:

FIFO (First In First Out)
Priority Queue
Class-based Queue
Fair Queue
Random Early Detection (RED)

Traffic Shaping vs Policing:

Shaping: Smoothing traffic using buffers
Policing: Dropping traffic that exceeds the limit

Traffic Policy Types

1. Shaper (Traffic Shaping)

Limits outbound traffic with the ability to prioritize:

configure

# Create a shaper policy
set traffic-policy shaper WAN-OUT bandwidth '100mbit'
set traffic-policy shaper WAN-OUT default bandwidth '10mbit'
set traffic-policy shaper WAN-OUT default ceiling '50mbit'
set traffic-policy shaper WAN-OUT default priority '7'

# Class for VoIP (high priority)
set traffic-policy shaper WAN-OUT class 10 bandwidth '20mbit'
set traffic-policy shaper WAN-OUT class 10 ceiling '30mbit'
set traffic-policy shaper WAN-OUT class 10 priority '1'
set traffic-policy shaper WAN-OUT class 10 match voip ip dscp 'ef'

# Class for video
set traffic-policy shaper WAN-OUT class 20 bandwidth '30mbit'
set traffic-policy shaper WAN-OUT class 20 ceiling '40mbit'
set traffic-policy shaper WAN-OUT class 20 priority '2'
set traffic-policy shaper WAN-OUT class 20 match video ip protocol 'udp'
set traffic-policy shaper WAN-OUT class 20 match video destination port '1935,5004,5005'

# Apply to the interface
set interfaces ethernet eth0 traffic-policy out 'WAN-OUT'

commit
save

2. Limiter (Rate Limiting)

Limits inbound traffic:

configure

# Create a limiter policy
set traffic-policy limiter LAN-IN bandwidth '1gbit'

# Class for the guest network (limited to 10 Mbps)
set traffic-policy limiter LAN-IN class 10 bandwidth '10mbit'
set traffic-policy limiter LAN-IN class 10 match guest-net source address '192.168.100.0/24'

# Class for torrents (limited to 5 Mbps)
set traffic-policy limiter LAN-IN class 20 bandwidth '5mbit'
set traffic-policy limiter LAN-IN class 20 match torrent destination port '6881-6889'
set traffic-policy limiter LAN-IN class 20 priority '7'

# Default class
set traffic-policy limiter LAN-IN default bandwidth '100mbit'

# Apply to the interface
set interfaces ethernet eth1 traffic-policy in 'LAN-IN'

commit
save

3. Priority Queue

Strict traffic prioritization:

configure

# Create a priority queue policy
set traffic-policy priority-queue PRIORITY-OUT

# Queue 1 (highest priority) - VoIP
set traffic-policy priority-queue PRIORITY-OUT class 1 queue-limit '100'
set traffic-policy priority-queue PRIORITY-OUT class 1 match voip ip dscp 'ef'

# Queue 2 - interactive traffic (SSH, DNS)
set traffic-policy priority-queue PRIORITY-OUT class 2 queue-limit '200'
set traffic-policy priority-queue PRIORITY-OUT class 2 match ssh destination port '22'
set traffic-policy priority-queue PRIORITY-OUT class 2 match dns destination port '53'

# Queue 3 - web traffic
set traffic-policy priority-queue PRIORITY-OUT class 3 queue-limit '500'
set traffic-policy priority-queue PRIORITY-OUT class 3 match http destination port '80,443'

# Default queue (lowest priority)
set traffic-policy priority-queue PRIORITY-OUT default queue-limit '1000'

# Apply to the interface
set interfaces ethernet eth0 traffic-policy out 'PRIORITY-OUT'

commit
save

4. Fair Queue (SFQ)

Fair distribution of bandwidth:

configure

# Create a fair queue policy
set traffic-policy fair-queue FAIR-QUEUE queue-limit '127'

# Apply to the interface
set interfaces ethernet eth2 traffic-policy out 'FAIR-QUEUE'

commit
save

5. Random Early Detection (RED)

Preventing queue congestion:

configure

# Create a random-detect policy
set traffic-policy random-detect RED-QUEUE bandwidth '100mbit'

# Configure RED parameters
set traffic-policy random-detect RED-QUEUE precedence 0 minimum-threshold '10'
set traffic-policy random-detect RED-QUEUE precedence 0 maximum-threshold '20'
set traffic-policy random-detect RED-QUEUE precedence 0 mark-probability '10'

# Apply to the interface
set interfaces ethernet eth0 traffic-policy out 'RED-QUEUE'

commit
save

6. Drop Tail

Simple packet dropping when the queue fills up:

configure

# Create a drop-tail policy
set traffic-policy drop-tail DROP-TAIL queue-limit '1000'

# Apply to the interface
set interfaces ethernet eth3 traffic-policy out 'DROP-TAIL'

commit
save

Traffic Classification

By IP Address

# Source address
set traffic-policy shaper WAN-OUT class 10 match users source address '192.168.1.0/24'

# Destination address
set traffic-policy shaper WAN-OUT class 20 match servers destination address '10.0.0.0/8'

# A specific host
set traffic-policy shaper WAN-OUT class 30 match host source address '192.168.1.100'

By Ports and Protocols

# TCP ports
set traffic-policy shaper WAN-OUT class 10 match http destination port '80,443'
set traffic-policy shaper WAN-OUT class 10 match http protocol 'tcp'

# UDP ports (range)
set traffic-policy shaper WAN-OUT class 20 match rtp destination port '10000-20000'
set traffic-policy shaper WAN-OUT class 20 match rtp protocol 'udp'

# Source port
set traffic-policy shaper WAN-OUT class 30 match ephemeral source port '32768-61000'

By DSCP/TOS Marking

# DSCP marking
set traffic-policy shaper WAN-OUT class 10 match voip ip dscp 'ef'
set traffic-policy shaper WAN-OUT class 20 match video ip dscp 'af41'
set traffic-policy shaper WAN-OUT class 30 match data ip dscp 'af21'

# TOS field
set traffic-policy shaper WAN-OUT class 40 match priority ip tos '0x10'

By Interface

# Inbound interface
set traffic-policy shaper WAN-OUT class 10 match lan interface 'eth1'

By MAC Address

# MAC source
set traffic-policy shaper WAN-OUT class 10 match device mac source '00:11:22:33:44:55'

DSCP Marking

Setting DSCP Marks

configure

# Mark VoIP traffic
set traffic-policy shaper WAN-OUT class 10 set-dscp 'ef'
set traffic-policy shaper WAN-OUT class 10 match voip destination port '5060,5061'

# Mark video traffic
set traffic-policy shaper WAN-OUT class 20 set-dscp 'af41'
set traffic-policy shaper WAN-OUT class 20 match video destination port '1935'

# Mark critical data
set traffic-policy shaper WAN-OUT class 30 set-dscp 'af21'
set traffic-policy shaper WAN-OUT class 30 match database destination port '3306,5432'

commit
save

Standard DSCP Values

EF (Expedited Forwarding): 46 - VoIP
AF41 (Assured Forwarding): 34 - High-quality video
AF31: 26 - Streaming video
AF21: 18 - Critical data
AF11: 10 - Standard data
BE (Best Effort): 0 - Regular traffic

Use Cases

1. Office Internet Link

Prioritizing corporate traffic:

configure

# 100 Mbps WAN link
set traffic-policy shaper OFFICE-WAN bandwidth '100mbit'

# VoIP (guaranteed 10 Mbps, up to 20 Mbps)
set traffic-policy shaper OFFICE-WAN class 10 bandwidth '10mbit'
set traffic-policy shaper OFFICE-WAN class 10 ceiling '20mbit'
set traffic-policy shaper OFFICE-WAN class 10 priority '1'
set traffic-policy shaper OFFICE-WAN class 10 match voip ip dscp 'ef'

# Video conferencing (guaranteed 20 Mbps, up to 40 Mbps)
set traffic-policy shaper OFFICE-WAN class 20 bandwidth '20mbit'
set traffic-policy shaper OFFICE-WAN class 20 ceiling '40mbit'
set traffic-policy shaper OFFICE-WAN class 20 priority '2'
set traffic-policy shaper OFFICE-WAN class 20 match zoom destination port '8801,8802'
set traffic-policy shaper OFFICE-WAN class 20 match teams destination port '3478-3481'

# Business applications (guaranteed 30 Mbps)
set traffic-policy shaper OFFICE-WAN class 30 bandwidth '30mbit'
set traffic-policy shaper OFFICE-WAN class 30 ceiling '60mbit'
set traffic-policy shaper OFFICE-WAN class 30 priority '3'
set traffic-policy shaper OFFICE-WAN class 30 match business destination address '10.0.0.0/8'

# Regular web browsing
set traffic-policy shaper OFFICE-WAN default bandwidth '20mbit'
set traffic-policy shaper OFFICE-WAN default ceiling '80mbit'
set traffic-policy shaper OFFICE-WAN default priority '5'

# Apply
set interfaces ethernet eth0 traffic-policy out 'OFFICE-WAN'

commit
save

2. Guest Network with Limits

configure

# Limit guest WiFi to 10 Mbps
set traffic-policy limiter GUEST-LIMIT bandwidth '10mbit'
set traffic-policy limiter GUEST-LIMIT default bandwidth '10mbit'
set traffic-policy limiter GUEST-LIMIT default priority '7'

# An even stricter limit for torrents
set traffic-policy limiter GUEST-LIMIT class 10 bandwidth '1mbit'
set traffic-policy limiter GUEST-LIMIT class 10 match torrents destination port '6881-6889,51413'
set traffic-policy limiter GUEST-LIMIT class 10 priority '7'

# Apply to the guest interface
set interfaces ethernet eth2 traffic-policy in 'GUEST-LIMIT'

commit
save

3. ISP Scenario - Per-Client Limits

configure

# Shaper for a subscriber on a 50 Mbps plan
set traffic-policy shaper CLIENT-50M bandwidth '50mbit'
set traffic-policy shaper CLIENT-50M default bandwidth '50mbit'
set traffic-policy shaper CLIENT-50M default burst '15k'

# Apply to the client's VLAN
set interfaces ethernet eth1 vif 100 traffic-policy out 'CLIENT-50M'

# Limiter for inbound traffic
set traffic-policy limiter CLIENT-50M-IN bandwidth '50mbit'
set traffic-policy limiter CLIENT-50M-IN default bandwidth '50mbit'
set interfaces ethernet eth1 vif 100 traffic-policy in 'CLIENT-50M-IN'

commit
save

4. VoIP/Video Prioritization

configure

# Strict priority for real-time traffic
set traffic-policy shaper RT-TRAFFIC bandwidth '200mbit'

# VoIP - highest priority
set traffic-policy shaper RT-TRAFFIC class 10 bandwidth '15mbit'
set traffic-policy shaper RT-TRAFFIC class 10 ceiling '20mbit'
set traffic-policy shaper RT-TRAFFIC class 10 priority '1'
set traffic-policy shaper RT-TRAFFIC class 10 queue-type 'priority'
set traffic-policy shaper RT-TRAFFIC class 10 match sip destination port '5060,5061'
set traffic-policy shaper RT-TRAFFIC class 10 match rtp destination port '10000-20000'

# Video conferencing
set traffic-policy shaper RT-TRAFFIC class 20 bandwidth '50mbit'
set traffic-policy shaper RT-TRAFFIC class 20 ceiling '100mbit'
set traffic-policy shaper RT-TRAFFIC class 20 priority '2'
set traffic-policy shaper RT-TRAFFIC class 20 match webrtc ip dscp 'af41'

# Remaining traffic
set traffic-policy shaper RT-TRAFFIC default bandwidth '100mbit'
set traffic-policy shaper RT-TRAFFIC default ceiling '180mbit'
set traffic-policy shaper RT-TRAFFIC default priority '7'

set interfaces ethernet eth0 traffic-policy out 'RT-TRAFFIC'

commit
save

Integration with Cloud Platforms

Yandex Cloud

Characteristics:

Guaranteed bandwidth for virtual machines
Burst traffic limits
QoS for Cloud Interconnect
Traffic shaping for egress traffic

configure

# Match the VM plan in Yandex Cloud
# For example: 2 vCPU = up to 1 Gbps
set traffic-policy shaper YC-VM-LIMIT bandwidth '1gbit'
set traffic-policy shaper YC-VM-LIMIT default bandwidth '100mbit'
set traffic-policy shaper YC-VM-LIMIT default ceiling '1gbit'

# Prioritize API calls to Yandex Cloud
set traffic-policy shaper YC-VM-LIMIT class 10 bandwidth '50mbit'
set traffic-policy shaper YC-VM-LIMIT class 10 priority '2'
set traffic-policy shaper YC-VM-LIMIT class 10 match yc-api destination address '84.201.0.0/16'

set interfaces ethernet eth0 traffic-policy out 'YC-VM-LIMIT'

commit
save

VK Cloud

Characteristics:

Egress traffic billing
QoS for internal networks
Prioritization of management traffic

configure

# Shaping to reduce egress costs
set traffic-policy shaper VK-EGRESS bandwidth '500mbit'

# Critical traffic - full speed
set traffic-policy shaper VK-EGRESS class 10 bandwidth '100mbit'
set traffic-policy shaper VK-EGRESS class 10 ceiling '500mbit'
set traffic-policy shaper VK-EGRESS class 10 priority '1'
set traffic-policy shaper VK-EGRESS class 10 match prod source address '10.0.1.0/24'

# Backup traffic - limited
set traffic-policy shaper VK-EGRESS class 90 bandwidth '10mbit'
set traffic-policy shaper VK-EGRESS class 90 ceiling '50mbit'
set traffic-policy shaper VK-EGRESS class 90 priority '7'
set traffic-policy shaper VK-EGRESS class 90 match backup source address '10.0.100.0/24'

set interfaces ethernet eth0 traffic-policy out 'VK-EGRESS'

commit
save

Monitoring QoS

Viewing Commands

# List all traffic policies
show traffic-policy

# Detailed information for a policy
show traffic-policy shaper WAN-OUT

# Per-class statistics
show queueing ethernet eth0

# View all interfaces with QoS
show interfaces

Example output:

vyos@router:~$ show queueing ethernet eth0
eth0 qdisc htb 1: root refcnt 2 r2q 10 default 7 direct_packets_stat 0
 Sent 123456789 bytes 987654 pkt (dropped 123, overlimits 456, requeues 0)

class htb 1:10 parent 1:1 prio 1 rate 20Mbit ceil 30Mbit burst 15k
 Sent 12345678 bytes 98765 pkt (dropped 12, overlimits 45, requeues 0)

Testing QoS

# Generate test traffic using iperf3
# On the server
iperf3 -s

# On the client (through VyOS)
iperf3 -c <server-ip> -t 30 -b 100M

# Check DSCP marks
tcpdump -i eth0 -v -n | grep 'tos'

Best Practices

QoS Design

Traffic analysis: Use monitoring to understand traffic patterns
Classification: Define 3-5 traffic classes (more classes complicate management)
Guarantees vs Ceiling: Guarantee a minimum for critical traffic
Leave headroom: Do not allocate 100% of the bandwidth across classes
DSCP marking: Use standard values for compatibility

Configuring Priorities

Priority 1-2: Real-time traffic (VoIP, video conferencing)
Priority 3-4: Interactive traffic (SSH, DNS, web)
Priority 5-6: Standard traffic (email, file transfer)
Priority 7: Low-priority traffic (backup, torrents)

Performance

Hardware offload: Use hardware acceleration where available
Minimal classification: Complex match rules reduce performance
Queue size: Choose queue sizes appropriately
Burst size: Use an adequate burst to prevent micro-burst loss

Security

DDoS protection: QoS can help minimize the impact of DDoS
Do not trust DSCP from clients: Rewrite incoming marks
Rate limiting: Limit unwanted traffic

Troubleshooting

Problem: QoS Is Not Working

Symptoms:

The traffic policy is applied, but traffic is not being limited

Solution:

# Check that the policy is applied to the interface
show interfaces ethernet eth0

# Check the counters
show queueing ethernet eth0

# Make sure traffic passes through the interface
monitor traffic interface eth0

# Check the match rules
show traffic-policy shaper WAN-OUT

Problem: Poor VoIP Quality

Symptoms:

Latency, jitter, packet loss on VoIP

Solution:

# Give VoIP strict priority
set traffic-policy priority-queue VOIP-PRIORITY class 1 queue-limit '100'
set traffic-policy priority-queue VOIP-PRIORITY class 1 match rtp destination port '10000-20000'

# Minimal queue-limit for VoIP (reduces latency)
set traffic-policy shaper WAN-OUT class 10 queue-limit '50'

# Use DSCP EF
set traffic-policy shaper WAN-OUT class 10 set-dscp 'ef'

Problem: High Latency

Symptoms:

High ping latency even under low load

Solution:

# Reduce queue sizes
set traffic-policy shaper WAN-OUT default queue-limit '100'

# Use fair-queue for even distribution
set traffic-policy shaper WAN-OUT default queue-type 'fair-queue'

# Enable fq_codel (Flow Queue Controlled Delay)
set traffic-policy shaper WAN-OUT default queue-type 'fq-codel'

Problem: Uneven Bandwidth Distribution

Symptoms:

One class receives more bandwidth than the others

Solution:

# Check the sum of bandwidth across all classes
# The sum must not exceed the total bandwidth

# Check the priority values
show traffic-policy shaper WAN-OUT

# Use ceiling to limit burst
set traffic-policy shaper WAN-OUT class 10 ceiling '50mbit'

Additional Resources

Note: QoS configuration requires fine-tuning to your specific requirements. It is recommended to start with simple rules and gradually add complexity based on traffic monitoring.

Reviewed by OpenNix LLC · Last updated on 29 July 2026