Help me update my HFSC shaper scripts for fw4/nftables

anon78773196 · December 3, 2023, 5:21pm

yes i has exactly make that in modern 2 and 3 and doesn't work

me too in the past work but now no

dlakelan · December 3, 2023, 10:51pm

I'm pretty sure your bandwidth isn't 50 Gigabits per second... so it's probably some measurement problem in the game.

xato_coslada · March 11, 2024, 7:57pm

Hi, I am trying to reinstall this script but I have a problem, I am on my x86 machine with the latest official version and every time I want to load the script I get disconnected and without access to the machine. Does anyone know if anything has been updated that causes this problem? Previously on my other routers I had no problem loading this script nor the previous one based on iptables. Thanks

Hudra · March 11, 2024, 8:15pm

Just a guess… Do you have docker installed?

xato_coslada · March 11, 2024, 8:28pm

No, I use a clean install only the necessary packages. It is curious that it only happens to me with this script.

Hudra · March 11, 2024, 8:39pm

I was asking because docker enables bridge firewalling and this could interfere with the veth setup in this script…

Did you follow the instructions on the GitHub repository and also made sure you are on the right branch? The right branch is „nftables“ not „master“

xato_coslada · March 11, 2024, 8:48pm

Yes, I am using nftables, I seem to remember that I have configured this script before on another device. I don't understand what could be happening now but I just run the script and I'm offline.

Hudra · March 11, 2024, 9:09pm

Can you post the script with the settings you’re having issues?

Also post the output of:

ubus call system board; 
uci export network; uci export firewall;

Please make sure to redact sensitive information

xato_coslada · March 11, 2024, 9:24pm

Ok, as soon as I can I will send you a picture with the configuration.

Zia786 · March 12, 2024, 8:07pm

Tried this too. i get disconnected also.

Zia

xato_coslada · March 13, 2024, 6:44pm

Hi, my configuration is basic I simply add pppoe-wan to my wan interface and br-lan to my lan interface.

In the dscptag.nft file I just add my wan interface which is pppoe-wan.

Once I load the script or reboot the router it stops working and I can't access it.

It is very strange since I have had this script working on another occasion with another router and an older version.

dlakelan · March 13, 2024, 7:01pm

Are you using veth, or have you tried using veth? Also do you have the appropriate packages installed including the hfsc qdisc etc?

xato_coslada · March 13, 2024, 7:20pm

Hi, I also tried with veth and there is no way, every time I want to load the script I have to install again from factory because I can not enter with 192.168.1.1

The packages I install are the ones indicated in the forum.

Hudra · March 13, 2024, 11:15pm

I haven’t used the script in a while, but I wanted to know if I could get it to work and the first thing I noticed was that the readme in the nftables branch is a bit misleading. In the beginning of the readme the link points to the dscptag.sh of the (iptables) master branch and also the file should be placed under /usr/share/nftables.d/ruleset-post/ and not /etc

With the following steps I could get it to work on a openwrt vm.

Log into your OpenWrt router and make sure the following packages are installed:

kmod-sched
ip-full
kmod-veth
tc

Download all relevant files to the right folders:

wget -O /etc/SimpleHFSCgamerscript.sh https://raw.githubusercontent.com/dlakelan/routerperf/nftables/SimpleHFSCgamerscript.sh && chmod a+x /etc/SimpleHFSCgamerscript.sh

wget -O /etc/hotplug.d/iface/13-SimpleHFSCGamerScriptHotplug https://raw.githubusercontent.com/dlakelan/routerperf/nftables/13-SimpleHFSCGamerScriptHotplug

mkdir -p /usr/share/nftables.d/ruleset-post/ && wget -O /usr/share/nftables.d/ruleset-post/dscptag.nft https://raw.githubusercontent.com/dlakelan/routerperf/nftables/dscptag.nft

Edit edit SimpleHFSCgamerscript.sh under:

/etc/SimpleHFSCgamerscript.sh

to set your WAN and LAN interfaces, your network speeds, and the speed you reserve for your game (GAMEUP and GAMEDOWN)

edit the dscptag.nft script under:

/usr/share/nftables.d/ruleset-post/dscptag.nft

to include your gaming boxes in the set of ips that is prioritized for UDP:
if you want to use netem also grab the files in tc-dists folder and place in /usr/lib/tc on your router

In LUCI add a new interface called veth
• Add new interface
• Name: veth
• Protocol: Unmanaged
• Device: lanveth
• In the custom field just type “lanveth” and hit enter

image553×730 113 KB

• Create Interface
• Firewall settings: assign firewall-zone = LAN
• Save & Apply
Run the script

/etc/SimpleHFSCgamerscript.sh

xato_coslada · March 13, 2024, 11:40pm

I will give it another try as soon as I get home but I have to say that this is how I do it and I always get the same thing. I will try to use with a virtual machine in proxmox.

Zia786 · March 14, 2024, 6:19am

define realtime4 = {192.168.1.2} # example, just add all your game console here

Do you add the extra ip in the same line .i have 2 pc and ps5?
Sry for the noob question

Also if you want go back to defualt you just delete all files folders?

Zia

Hudra · March 14, 2024, 10:50am

Generally, maybe an easy to use install/unistall script for the first use would help new users? Something like this:

Summary

install.sh

#!/bin/sh

echo "Starting the installation process..."

# Checking and installing required packages
REQUIRED_PACKAGES="kmod-sched ip-full kmod-veth tc"
for pkg in $REQUIRED_PACKAGES; do
    if ! opkg list-installed | grep -q "^$pkg "; then
        echo "Installing $pkg..."
        opkg update && opkg install "$pkg"
    fi
done

echo "Downloading and setting up scripts..."

# Download and set execution permissions for the scripts
wget -O /etc/SimpleHFSCgamerscript.sh https://raw.githubusercontent.com/dlakelan/routerperf/nftables/SimpleHFSCgamerscript.sh && chmod a+x /etc/SimpleHFSCgamerscript.sh
wget -O /etc/hotplug.d/iface/13-SimpleHFSCGamerScriptHotplug https://raw.githubusercontent.com/dlakelan/routerperf/nftables/13-SimpleHFSCGamerScriptHotplug
mkdir -p /usr/share/nftables.d/ruleset-post/ && wget -O /usr/share/nftables.d/ruleset-post/dscptag.nft https://raw.githubusercontent.com/dlakelan/routerperf/nftables/dscptag.nft

echo "Configuring veth interface..."

# Configure the veth interface
uci set network.veth=interface
uci set network.veth.proto='none'
uci set network.veth.ifname='lanveth'
uci set network.veth.device='lanveth'
uci commit network

echo "Checking for LAN firewall zone and adding veth interface if it exists..."

LAN_ZONE_NAME=$(uci show firewall | grep -E "firewall.@zone\[.*\].name='lan'" | cut -d'.' -f2)
if [ ! -z "$LAN_ZONE_NAME" ]; then
    uci add_list firewall.$LAN_ZONE_NAME.network='veth'
    uci commit firewall
    /etc/init.d/firewall reload
    echo "veth interface added to LAN firewall zone."
else
    echo "LAN firewall zone does not exist, skipping addition."
fi

echo "Reloading network service..."
/etc/init.d/network reload

echo "Installation completed successfully!"

uninstall.sh

#!/bin/sh

echo "Starting the uninstallation process..."

echo "Removing specific scripts..."

# Remove the specific script and its configuration
rm -f /etc/SimpleHFSCgamerscript.sh
rm -f /etc/hotplug.d/iface/13-SimpleHFSCGamerScriptHotplug
rm -f /usr/share/nftables.d/ruleset-post/dscptag.nft

echo "Removing veth interface configuration..."

# Remove the veth interface configuration
uci delete network.veth
uci commit network

echo "Checking for LAN firewall zone to remove veth interface..."

LAN_ZONE_NAME=$(uci show firewall | grep -E "firewall.@zone\[.*\].name='lan'" | cut -d'.' -f2)
if [ ! -z "$LAN_ZONE_NAME" ]; then
    uci del_list firewall.$LAN_ZONE_NAME.network='veth'
    uci commit firewall
    /etc/init.d/firewall reload
    echo "veth interface removed from LAN firewall zone."
else
    echo "LAN firewall zone does not exist, skipping removal."
fi

echo "Reloading network service..."
/etc/init.d/network reload

echo "Uninstallation completed successfully!"

Here is how you can use it:

Download the Installation Script: Once logged into your router, enter the following command to download the installation script to the root directory:

cd /root
wget https://raw.githubusercontent.com/dlakelan/routerperf/master/install.sh && chmod +x install.sh

Run the Installation Script: Execute the script by typing:

./install.sh

The script will automatically handle the installation process, including downloading necessary files, setting up the veth interface, and adding it to the LAN firewall zone.

Uninstallation Guide

If you wish to revert the changes made by the installation script, follow these steps:

Download the Uninstallation Script: Use the following command to download the uninstallation script to the root directory:

cd /root
wget https://raw.githubusercontent.com/dlakelan/routerperf/master/uninstall.sh && chmod +x uninstall.sh

Run the Uninstallation Script: Execute the script by typing:

./uninstall.sh

The script will remove the configurations applied during the installation, including removing the veth interface from the network and firewall configurations.

After installing you will still have to edit the files according to your needs…

Edit edit SimpleHFSCgamerscript.sh under:

/etc/SimpleHFSCgamerscript.sh

to set your WAN and LAN interfaces, your network speeds, and the speed you reserve for your game (GAMEUP and GAMEDOWN)

edit the dscptag.nft script under:

/usr/share/nftables.d/ruleset-post/dscptag.nft

Run the script

/etc/SimpleHFSCgamerscript.sh

Hudra · March 14, 2024, 11:01am

yes, just comma seperated like this:

define realtime4 = {192.168.109.1, 192.168.109.2} # example, just add all your game console here

just delete the files manually and reboot or use my uninstall script

Zia786 · March 14, 2024, 7:33pm

Blockquote

thank you very much, appreciate your help
will give a try

Zia

dlakelan · March 15, 2024, 2:51am

Thanks for your install and uninstall scripts. I've added them to the repo and put a description with a link to your post for those who want to use them.

I've also merged nftables branch to master so that by default that's what people see. Few people should be using the old iptables version.