# QoS (Quality of Service) in VyOS

> Configure QoS in VyOS: Traffic Policy, traffic prioritization, bandwidth shaping, queuing disciplines and packet classification for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/qos/


VyOS provides powerful Quality of Service (QoS) mechanisms for managing bandwidth, prioritizing traffic and controlling latency across network connections.

## The QoS Concept

### Core QoS Objectives

**Quality of Service addresses:**
- Prioritizing critical traffic (VoIP, video conferencing)
- Limiting bandwidth for non-critical services
- Preventing congestion of communication links
- Guaranteeing minimum throughput
- Managing latency and jitter
- Controlling burst traffic

**Key metrics:**
- **Bandwidth**: Volume of data per unit of time
- **Latency**: Time taken to deliver a packet
- **Jitter**: Variation in latency
- **Packet loss**: Percentage of lost packets

### QoS Components in VyOS

**Traffic Policy:**
- Defining traffic handling rules
- Classifying packets by various criteria
- Applying actions to classified traffic

**Queueing Disciplines:**
- FIFO (First In First Out)
- Priority Queue
- Class-based Queue
- Fair Queue
- Random Early Detection (RED)

**Traffic Shaping vs Policing:**
- **Shaping**: Smoothing traffic using buffers
- **Policing**: Dropping traffic that exceeds the limit

## Traffic Policy Types

### 1. Shaper (Traffic Shaping)

Limits outbound traffic with the ability to prioritize:

```bash
configure

# Create a shaper policy
set traffic-policy shaper WAN-OUT bandwidth '100mbit'
set traffic-policy shaper WAN-OUT default bandwidth '10mbit'
set traffic-policy shaper WAN-OUT default ceiling '50mbit'
set traffic-policy shaper WAN-OUT default priority '7'

# Class for VoIP (high priority)
set traffic-policy shaper WAN-OUT class 10 bandwidth '20mbit'
set traffic-policy shaper WAN-OUT class 10 ceiling '30mbit'
set traffic-policy shaper WAN-OUT class 10 priority '1'
set traffic-policy shaper WAN-OUT class 10 match voip ip dscp 'ef'

# Class for video
set traffic-policy shaper WAN-OUT class 20 bandwidth '30mbit'
set traffic-policy shaper WAN-OUT class 20 ceiling '40mbit'
set traffic-policy shaper WAN-OUT class 20 priority '2'
set traffic-policy shaper WAN-OUT class 20 match video ip protocol 'udp'
set traffic-policy shaper WAN-OUT class 20 match video destination port '1935,5004,5005'

# Apply to the interface
set interfaces ethernet eth0 traffic-policy out 'WAN-OUT'

commit
save
```

### 2. Limiter (Rate Limiting)

Limits inbound traffic:

```bash
configure

# Create a limiter policy
set traffic-policy limiter LAN-IN bandwidth '1gbit'

# Class for the guest network (limited to 10 Mbps)
set traffic-policy limiter LAN-IN class 10 bandwidth '10mbit'
set traffic-policy limiter LAN-IN class 10 match guest-net source address '192.168.100.0/24'

# Class for torrents (limited to 5 Mbps)
set traffic-policy limiter LAN-IN class 20 bandwidth '5mbit'
set traffic-policy limiter LAN-IN class 20 match torrent destination port '6881-6889'
set traffic-policy limiter LAN-IN class 20 priority '7'

# Default class
set traffic-policy limiter LAN-IN default bandwidth '100mbit'

# Apply to the interface
set interfaces ethernet eth1 traffic-policy in 'LAN-IN'

commit
save
```

### 3. Priority Queue

Strict traffic prioritization:

```bash
configure

# Create a priority queue policy
set traffic-policy priority-queue PRIORITY-OUT

# Queue 1 (highest priority) - VoIP
set traffic-policy priority-queue PRIORITY-OUT class 1 queue-limit '100'
set traffic-policy priority-queue PRIORITY-OUT class 1 match voip ip dscp 'ef'

# Queue 2 - interactive traffic (SSH, DNS)
set traffic-policy priority-queue PRIORITY-OUT class 2 queue-limit '200'
set traffic-policy priority-queue PRIORITY-OUT class 2 match ssh destination port '22'
set traffic-policy priority-queue PRIORITY-OUT class 2 match dns destination port '53'

# Queue 3 - web traffic
set traffic-policy priority-queue PRIORITY-OUT class 3 queue-limit '500'
set traffic-policy priority-queue PRIORITY-OUT class 3 match http destination port '80,443'

# Default queue (lowest priority)
set traffic-policy priority-queue PRIORITY-OUT default queue-limit '1000'

# Apply to the interface
set interfaces ethernet eth0 traffic-policy out 'PRIORITY-OUT'

commit
save
```

### 4. Fair Queue (SFQ)

Fair distribution of bandwidth:

```bash
configure

# Create a fair queue policy
set traffic-policy fair-queue FAIR-QUEUE queue-limit '127'

# Apply to the interface
set interfaces ethernet eth2 traffic-policy out 'FAIR-QUEUE'

commit
save
```

### 5. Random Early Detection (RED)

Preventing queue congestion:

```bash
configure

# Create a random-detect policy
set traffic-policy random-detect RED-QUEUE bandwidth '100mbit'

# Configure RED parameters
set traffic-policy random-detect RED-QUEUE precedence 0 minimum-threshold '10'
set traffic-policy random-detect RED-QUEUE precedence 0 maximum-threshold '20'
set traffic-policy random-detect RED-QUEUE precedence 0 mark-probability '10'

# Apply to the interface
set interfaces ethernet eth0 traffic-policy out 'RED-QUEUE'

commit
save
```

### 6. Drop Tail

Simple packet dropping when the queue fills up:

```bash
configure

# Create a drop-tail policy
set traffic-policy drop-tail DROP-TAIL queue-limit '1000'

# Apply to the interface
set interfaces ethernet eth3 traffic-policy out 'DROP-TAIL'

commit
save
```

## Traffic Classification

### By IP Address

```bash
# Source address
set traffic-policy shaper WAN-OUT class 10 match users source address '192.168.1.0/24'

# Destination address
set traffic-policy shaper WAN-OUT class 20 match servers destination address '10.0.0.0/8'

# A specific host
set traffic-policy shaper WAN-OUT class 30 match host source address '192.168.1.100'
```

### By Ports and Protocols

```bash
# TCP ports
set traffic-policy shaper WAN-OUT class 10 match http destination port '80,443'
set traffic-policy shaper WAN-OUT class 10 match http protocol 'tcp'

# UDP ports (range)
set traffic-policy shaper WAN-OUT class 20 match rtp destination port '10000-20000'
set traffic-policy shaper WAN-OUT class 20 match rtp protocol 'udp'

# Source port
set traffic-policy shaper WAN-OUT class 30 match ephemeral source port '32768-61000'
```

### By DSCP/TOS Marking

```bash
# DSCP marking
set traffic-policy shaper WAN-OUT class 10 match voip ip dscp 'ef'
set traffic-policy shaper WAN-OUT class 20 match video ip dscp 'af41'
set traffic-policy shaper WAN-OUT class 30 match data ip dscp 'af21'

# TOS field
set traffic-policy shaper WAN-OUT class 40 match priority ip tos '0x10'
```

### By Interface

```bash
# Inbound interface
set traffic-policy shaper WAN-OUT class 10 match lan interface 'eth1'
```

### By MAC Address

```bash
# MAC source
set traffic-policy shaper WAN-OUT class 10 match device mac source '00:11:22:33:44:55'
```

## DSCP Marking

### Setting DSCP Marks

```bash
configure

# Mark VoIP traffic
set traffic-policy shaper WAN-OUT class 10 set-dscp 'ef'
set traffic-policy shaper WAN-OUT class 10 match voip destination port '5060,5061'

# Mark video traffic
set traffic-policy shaper WAN-OUT class 20 set-dscp 'af41'
set traffic-policy shaper WAN-OUT class 20 match video destination port '1935'

# Mark critical data
set traffic-policy shaper WAN-OUT class 30 set-dscp 'af21'
set traffic-policy shaper WAN-OUT class 30 match database destination port '3306,5432'

commit
save
```

### Standard DSCP Values

```
EF (Expedited Forwarding): 46 - VoIP
AF41 (Assured Forwarding): 34 - High-quality video
AF31: 26 - Streaming video
AF21: 18 - Critical data
AF11: 10 - Standard data
BE (Best Effort): 0 - Regular traffic
```

## Use Cases

### 1. Office Internet Link

Prioritizing corporate traffic:

```bash
configure

# 100 Mbps WAN link
set traffic-policy shaper OFFICE-WAN bandwidth '100mbit'

# VoIP (guaranteed 10 Mbps, up to 20 Mbps)
set traffic-policy shaper OFFICE-WAN class 10 bandwidth '10mbit'
set traffic-policy shaper OFFICE-WAN class 10 ceiling '20mbit'
set traffic-policy shaper OFFICE-WAN class 10 priority '1'
set traffic-policy shaper OFFICE-WAN class 10 match voip ip dscp 'ef'

# Video conferencing (guaranteed 20 Mbps, up to 40 Mbps)
set traffic-policy shaper OFFICE-WAN class 20 bandwidth '20mbit'
set traffic-policy shaper OFFICE-WAN class 20 ceiling '40mbit'
set traffic-policy shaper OFFICE-WAN class 20 priority '2'
set traffic-policy shaper OFFICE-WAN class 20 match zoom destination port '8801,8802'
set traffic-policy shaper OFFICE-WAN class 20 match teams destination port '3478-3481'

# Business applications (guaranteed 30 Mbps)
set traffic-policy shaper OFFICE-WAN class 30 bandwidth '30mbit'
set traffic-policy shaper OFFICE-WAN class 30 ceiling '60mbit'
set traffic-policy shaper OFFICE-WAN class 30 priority '3'
set traffic-policy shaper OFFICE-WAN class 30 match business destination address '10.0.0.0/8'

# Regular web browsing
set traffic-policy shaper OFFICE-WAN default bandwidth '20mbit'
set traffic-policy shaper OFFICE-WAN default ceiling '80mbit'
set traffic-policy shaper OFFICE-WAN default priority '5'

# Apply
set interfaces ethernet eth0 traffic-policy out 'OFFICE-WAN'

commit
save
```

### 2. Guest Network with Limits

```bash
configure

# Limit guest WiFi to 10 Mbps
set traffic-policy limiter GUEST-LIMIT bandwidth '10mbit'
set traffic-policy limiter GUEST-LIMIT default bandwidth '10mbit'
set traffic-policy limiter GUEST-LIMIT default priority '7'

# An even stricter limit for torrents
set traffic-policy limiter GUEST-LIMIT class 10 bandwidth '1mbit'
set traffic-policy limiter GUEST-LIMIT class 10 match torrents destination port '6881-6889,51413'
set traffic-policy limiter GUEST-LIMIT class 10 priority '7'

# Apply to the guest interface
set interfaces ethernet eth2 traffic-policy in 'GUEST-LIMIT'

commit
save
```

### 3. ISP Scenario - Per-Client Limits

```bash
configure

# Shaper for a subscriber on a 50 Mbps plan
set traffic-policy shaper CLIENT-50M bandwidth '50mbit'
set traffic-policy shaper CLIENT-50M default bandwidth '50mbit'
set traffic-policy shaper CLIENT-50M default burst '15k'

# Apply to the client's VLAN
set interfaces ethernet eth1 vif 100 traffic-policy out 'CLIENT-50M'

# Limiter for inbound traffic
set traffic-policy limiter CLIENT-50M-IN bandwidth '50mbit'
set traffic-policy limiter CLIENT-50M-IN default bandwidth '50mbit'
set interfaces ethernet eth1 vif 100 traffic-policy in 'CLIENT-50M-IN'

commit
save
```

### 4. VoIP/Video Prioritization

```bash
configure

# Strict priority for real-time traffic
set traffic-policy shaper RT-TRAFFIC bandwidth '200mbit'

# VoIP - highest priority
set traffic-policy shaper RT-TRAFFIC class 10 bandwidth '15mbit'
set traffic-policy shaper RT-TRAFFIC class 10 ceiling '20mbit'
set traffic-policy shaper RT-TRAFFIC class 10 priority '1'
set traffic-policy shaper RT-TRAFFIC class 10 queue-type 'priority'
set traffic-policy shaper RT-TRAFFIC class 10 match sip destination port '5060,5061'
set traffic-policy shaper RT-TRAFFIC class 10 match rtp destination port '10000-20000'

# Video conferencing
set traffic-policy shaper RT-TRAFFIC class 20 bandwidth '50mbit'
set traffic-policy shaper RT-TRAFFIC class 20 ceiling '100mbit'
set traffic-policy shaper RT-TRAFFIC class 20 priority '2'
set traffic-policy shaper RT-TRAFFIC class 20 match webrtc ip dscp 'af41'

# Remaining traffic
set traffic-policy shaper RT-TRAFFIC default bandwidth '100mbit'
set traffic-policy shaper RT-TRAFFIC default ceiling '180mbit'
set traffic-policy shaper RT-TRAFFIC default priority '7'

set interfaces ethernet eth0 traffic-policy out 'RT-TRAFFIC'

commit
save
```

## Integration with Cloud Platforms

### Yandex Cloud

**Characteristics:**
- Guaranteed bandwidth for virtual machines
- Burst traffic limits
- QoS for Cloud Interconnect
- Traffic shaping for egress traffic

```bash
configure

# Match the VM plan in Yandex Cloud
# For example: 2 vCPU = up to 1 Gbps
set traffic-policy shaper YC-VM-LIMIT bandwidth '1gbit'
set traffic-policy shaper YC-VM-LIMIT default bandwidth '100mbit'
set traffic-policy shaper YC-VM-LIMIT default ceiling '1gbit'

# Prioritize API calls to Yandex Cloud
set traffic-policy shaper YC-VM-LIMIT class 10 bandwidth '50mbit'
set traffic-policy shaper YC-VM-LIMIT class 10 priority '2'
set traffic-policy shaper YC-VM-LIMIT class 10 match yc-api destination address '84.201.0.0/16'

set interfaces ethernet eth0 traffic-policy out 'YC-VM-LIMIT'

commit
save
```

### VK Cloud

**Characteristics:**
- Egress traffic billing
- QoS for internal networks
- Prioritization of management traffic

```bash
configure

# Shaping to reduce egress costs
set traffic-policy shaper VK-EGRESS bandwidth '500mbit'

# Critical traffic - full speed
set traffic-policy shaper VK-EGRESS class 10 bandwidth '100mbit'
set traffic-policy shaper VK-EGRESS class 10 ceiling '500mbit'
set traffic-policy shaper VK-EGRESS class 10 priority '1'
set traffic-policy shaper VK-EGRESS class 10 match prod source address '10.0.1.0/24'

# Backup traffic - limited
set traffic-policy shaper VK-EGRESS class 90 bandwidth '10mbit'
set traffic-policy shaper VK-EGRESS class 90 ceiling '50mbit'
set traffic-policy shaper VK-EGRESS class 90 priority '7'
set traffic-policy shaper VK-EGRESS class 90 match backup source address '10.0.100.0/24'

set interfaces ethernet eth0 traffic-policy out 'VK-EGRESS'

commit
save
```

## Monitoring QoS

### Viewing Commands

```bash
# List all traffic policies
show traffic-policy

# Detailed information for a policy
show traffic-policy shaper WAN-OUT

# Per-class statistics
show queueing ethernet eth0

# View all interfaces with QoS
show interfaces
```

Example output:
```
vyos@router:~$ show queueing ethernet eth0
eth0 qdisc htb 1: root refcnt 2 r2q 10 default 7 direct_packets_stat 0
 Sent 123456789 bytes 987654 pkt (dropped 123, overlimits 456, requeues 0)

class htb 1:10 parent 1:1 prio 1 rate 20Mbit ceil 30Mbit burst 15k
 Sent 12345678 bytes 98765 pkt (dropped 12, overlimits 45, requeues 0)
```

### Testing QoS

```bash
# Generate test traffic using iperf3
# On the server
iperf3 -s

# On the client (through VyOS)
iperf3 -c <server-ip> -t 30 -b 100M

# Check DSCP marks
tcpdump -i eth0 -v -n | grep 'tos'
```

## Best Practices

### QoS Design

1. **Traffic analysis**: Use monitoring to understand traffic patterns
2. **Classification**: Define 3-5 traffic classes (more classes complicate management)
3. **Guarantees vs Ceiling**: Guarantee a minimum for critical traffic
4. **Leave headroom**: Do not allocate 100% of the bandwidth across classes
5. **DSCP marking**: Use standard values for compatibility

### Configuring Priorities

1. **Priority 1-2**: Real-time traffic (VoIP, video conferencing)
2. **Priority 3-4**: Interactive traffic (SSH, DNS, web)
3. **Priority 5-6**: Standard traffic (email, file transfer)
4. **Priority 7**: Low-priority traffic (backup, torrents)

### Performance

1. **Hardware offload**: Use hardware acceleration where available
2. **Minimal classification**: Complex match rules reduce performance
3. **Queue size**: Choose queue sizes appropriately
4. **Burst size**: Use an adequate burst to prevent micro-burst loss

### Security

1. **DDoS protection**: QoS can help minimize the impact of DDoS
2. **Do not trust DSCP from clients**: Rewrite incoming marks
3. **Rate limiting**: Limit unwanted traffic

## Troubleshooting

### Problem: QoS Is Not Working

**Symptoms:**
- The traffic policy is applied, but traffic is not being limited

**Solution:**
```bash
# Check that the policy is applied to the interface
show interfaces ethernet eth0

# Check the counters
show queueing ethernet eth0

# Make sure traffic passes through the interface
monitor traffic interface eth0

# Check the match rules
show traffic-policy shaper WAN-OUT
```

### Problem: Poor VoIP Quality

**Symptoms:**
- Latency, jitter, packet loss on VoIP

**Solution:**
```bash
# Give VoIP strict priority
set traffic-policy priority-queue VOIP-PRIORITY class 1 queue-limit '100'
set traffic-policy priority-queue VOIP-PRIORITY class 1 match rtp destination port '10000-20000'

# Minimal queue-limit for VoIP (reduces latency)
set traffic-policy shaper WAN-OUT class 10 queue-limit '50'

# Use DSCP EF
set traffic-policy shaper WAN-OUT class 10 set-dscp 'ef'
```

### Problem: High Latency

**Symptoms:**
- High ping latency even under low load

**Solution:**
```bash
# Reduce queue sizes
set traffic-policy shaper WAN-OUT default queue-limit '100'

# Use fair-queue for even distribution
set traffic-policy shaper WAN-OUT default queue-type 'fair-queue'

# Enable fq_codel (Flow Queue Controlled Delay)
set traffic-policy shaper WAN-OUT default queue-type 'fq-codel'
```

### Problem: Uneven Bandwidth Distribution

**Symptoms:**
- One class receives more bandwidth than the others

**Solution:**
```bash
# Check the sum of bandwidth across all classes
# The sum must not exceed the total bandwidth

# Check the priority values
show traffic-policy shaper WAN-OUT

# Use ceiling to limit burst
set traffic-policy shaper WAN-OUT class 10 ceiling '50mbit'
```

## Additional Resources

- [VyOS QoS Documentation](https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html)
- [Linux Traffic Control HOWTO](https://tldp.org/HOWTO/Traffic-Control-HOWTO/)
- [DSCP and TOS Values](https://www.iana.org/assignments/dscp-registry/dscp-registry.xhtml)
- [QoS Best Practices](https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/QoS-SRND-Book.html)

---

**Note**: QoS configuration requires fine-tuning to your specific requirements. It is recommended to start with simple rules and gradually add complexity based on traffic monitoring.