CAKE using veth-pair + Guest WiFi for IoT devices?

[Lynx]

@dave14305

The kernel is transmitting upload packets via the wan interface (egress). They are not considered to be received by the wan interface (ingress) when being transmitted. Between lan and wan interfaces is the kernel. Upload: Ingress to lan, routed by kernel, egress from wan.

@moeller0

It does not, but the fact is Linux only implements the top row, an interface connects the kernel with a network, your diagramm shows the connections between two networks, the kernel lives in the space in between the two rows, so the upper row might describe a wan interface, the lower row a lan interface. This is less about logic and more about what the Linux kernel does

@dlakelan

No, think of the WAN ethernet port. Packets either leave it, in which case they go through the EGRESS machinery, or they come into it in which case they go through the INGRESS machinery.

Your green packets that the router passes along through the WAN are ONLY EGRESSING... They typically would INGRESS through the LAN.

I really appreciate your attempts to help me understand. Does this make sense?

So is it fair to state that ingress and egress is always relative to OpenWrt / the kernel. That is, at WAN, an upload packet egresses relative to OpenWrt. A download packet ingresses relative to OpenWrt. At LAN, an upload packet ingresses relative to OpenWrt (e.g. from a client PC) and an download packet egresses relative to OpenWrt (e.g. to a client PC).

@dave14305 your suggestion in the related thread is actually really helpful:

root@OpenWrt:~# tc -s filter show dev wan parent ffff:
filter protocol ip pref 1 u32 chain 0
filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1
filter protocol ip pref 1 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid ??? not_in_hw
  match b2efa2b3/ffffffff at 12
        action order 1: gact action pass
         random type none pass val 0
         index 1 ref 1 bind 1 installed 130796 sec used 0 sec firstused 130795 sec
        Action statistics:
        Sent 5976050952 bytes 5092952 pkt (dropped 0, overlimits 0 requeues 0)
        backlog 0b 0p requeues 0

filter protocol all pref 2 matchall chain 0
filter protocol all pref 2 matchall chain 0 handle 0x1
  not_in_hw (rule hit 5201230)
        action order 1: mirred (Egress Redirect to device ifb) stolen
        index 1 ref 1 bind 1 installed 130796 sec used 0 sec firstused 130796 sec
        Action statistics:
        Sent 14931519849 bytes 12163406 pkt (dropped 0, overlimits 0 requeues 0)
        backlog 0b 0p requeues 0

I can keep running that by pressing up and enter on terminal and download either through VPN or WAN and compare the pass bytes with the matched bytes. In the case of VPN, the pass bytes increases rapidly. In the case of non-VPN, the matched bytes increases rapidly.

Any idea if this will survive a VPN/WAN restart or connection drop, etc.? Just wondering if I need to add some kind of hotplug capability to my script here:

@Lynx

root@OpenWrt:/etc/init.d# cat sqm-wan-vpn
#!/bin/sh /etc/rc.common
# Copyright (C) 2007 OpenWrt.org

exec &> /tmp/sqm.log

START=50
STOP=4

start() {
        # apply CAKE on upload (must be besteffort flows nonat nowash to work with the skb->hash preservation)
        tc qdisc add dev wan root cake bandwidth 30Mbit besteffort flows nonat nowash no-ack-filter split-gso rtt 100ms noatm overhead 92

        # set up ifb that combines vpn and wan flows
        ip link add name ifb type ifb
        tc qdisc add dev wan handle ffff: ingress
        tc qdisc add dev vpn handle ffff: ingress
        ip link set ifb up

        # filter out packets from WireGuard src IP on wan, else preserve, and combine all vpn flows
        tc filter add dev wan parent ffff: protocol ip prio 1 u32 match ip src xx.xx.xx.xx/32 action pass
        tc filter add dev wan parent ffff: prio 2 matchall action mirred egress redirect dev ifb
        tc filter add dev vpn parent ffff: matchall action mirred egress redirect dev ifb

        # apply CAKE on download using the ifb
        tc qdisc add dev ifb root cake bandwidth 25Mbit besteffort triple-isolate nat wash ingress no-ack-filter split-gso rtt 100ms noatm overhead 92
}

stop() {
        tc qdisc del dev wan ingress
        tc qdisc del dev wan root
        tc qdisc del dev vpn ingress
        tc qdisc del dev ifb root
        ip link set ifb down
        ip link del ifb
}