Help with choosing which setting is best for me

Installing and Using OpenWrt Network and Wireless Configuration
83

Hello! I hope you're doing well.. :sweat_smile:

I installed Tailscale on my OpenWrt router and enabled LAN access. Everything works great for me. I also have AdGuard Home (AGH) installed on the router with Cloudflare DoH, so I wanted my ads to be blocked even when I'm using Tailscale outside my home network for me.

*I have used the AGH Guide from OpenWrt Wiki page and so I also have the "firewall4 rule" which is

Add a new rule to Network → Firewall → Port Forwards , setting “Protocol” as “UDP”, “Source zone” as “lan”, “External port” to 53, “Destination zone” as “unspecified” and “Internal IP Address” your router address (usually 192.168.1.1) and “Internal port” still 53. Saving and applying the rule all UDP/53 traffic will redirected to your router.

To do that, I added the OpenWrt router’s Tailscale IP address (shown in the Machines section) as a Global Nameserver in Tailscale DNS settings. That worked my DNS queries go through AdGuard Home and ads are blocked even when I’m on mobile data this works because I have Tailscale running on my own account.

The issue is that I invited a friend to my Tailscale network so his ads gets blocked as well. I configured the same DNS settings for him, and DNS filtering works. However, even though he cannot access my LAN devices, he can still open the OpenWrt LuCI interface using the router’s Tailscale IP address also his ads are not getting blocked though I can see his DNS requests in my AGH Panel

What I want is:

  • His DNS requests should go through my AdGuard Home.
  • He should not be able to access LuCI or anything else on the router.
  • He should not have access to my LAN devices.

Is it possible to allow DNS-only access to the router through Tailscale while blocking all other services like LuCI and SSH?

84

Open a new thread, I am only peering family via p2p wireguard tunnels :wink:

85

Okay :smiley: I'll do that

86

Hello do you know any package for just simple limiting speed for devices qos? like how tp link has it just put the speed and done? Easy QoS if there is one in openwrt already or a community based one will work as well

87

qos should even that out - eg qosmate can either downprioritize bulk downloads, or bulk downloaders, failing that you can rate limit individual clients.

88

I tried QosMate once but it was very confusing for me there were a lot of settings :face_with_spiral_eyes: I had no one to help me

I already have luci-app-sqm installed and I'm using it to limit the "Guest Network" speeds

89

Cmon, either auto-detect or type like 19000/19000 in the bandwidths.

90

Auto Setup just works and I don't need to configure anything?? and btw I upgraded my packages to 25mbits I already have luci-app-sqm installed what about that then? I had a limit set on br-guest as well

91

Yesssir, it is that simple. A bit more clicking around on low-end routers....

You have to disable,better remove SQM.

the target bw should be less than normally achieved (20/20)
then you can downprioritize guest subnet like setting it to CS1.

93

this isn't a problem right?

Section @redirect[0] (adguardhome_dns_53) does not specify a destination, assuming 'lan'
Service stopped
94

I am denying existence of agh, if there is a faulty rule stuffed by it you have to check in respective support thread.

95

If AGH is that bad should I switch to adblock-lean then is that a better option? I do need adblocking still that's why...

96

okay leave that for now which root queue disicpline should I choose there are a bunch

CAKE
HFSC
Hybrid
HTB?

97

I think cake is default, just check with whichever bufferbloat test that one you choose is not worsening the result.

98

The default was HFSC just to tell you I'll test and see which one works best

99

CAKE was the best one so far I tested multiple times now my issue is that everything feels so slow :sweat_smile: I think everything is going in probably best effort which is the lowest? Minecraft servers takes so much time to load and Discord on PC is not even starting up :upside_down_face:

100

Is that after auto detecting bandwidth? Is the WAN interface the real WAN interface ie pppoe-wan.

101

pppoe-wan and yes after auto detecting several times the best was 21515 something but I just reduced it to 21000kbps both upload and download

102

General Information

Root Queueing Discipline: cake

WAN Interface: pppoe-wan

Priority Queue Type (Ingress): diffserv4

Priority Queue Type (Egress): diffserv4

CAKE Egress Statistics - eth1

Tin Threshold Target Interval Peak Delay Avg Delay Sparse Delay Bytes Packets Dropped ECN Marked
Tin 0 1312.50 Kbit/s 13.84 ms 108.84 ms 25 µs 13 µs 10 µs 292.57 KiB 4784 0 0
Tin 1 21000.00 Kbit/s 5.00 ms 100.00 ms 432 µs 73 µs 10 µs 6.9 MiB 91324 0 0
Tin 2 10500.00 Kbit/s 5.00 ms 100.00 ms 80 µs 13 µs 10 µs 4.55 MiB 55246 2 0
Tin 3 5250.00 Kbit/s 5.00 ms 100.00 ms 43 µs 2 µs 2 µs 10.8 KiB 46 0 0

General Information

Root Queueing Discipline: cake

WAN Interface: pppoe-wan

Priority Queue Type (Ingress): diffserv4

Priority Queue Type (Egress): diffserv4

CAKE Ingress Statistics - eth1

Tin Threshold Target Interval Peak Delay Avg Delay Sparse Delay Bytes Packets Dropped ECN Marked
Tin 0 1312.50 Kbit/s 13.84 ms 108.84 ms 56.29 ms 38.41 ms 9.18 ms 12.92 MiB 9463 729 0
Tin 1 21000.00 Kbit/s 5.00 ms 100.00 ms 13.44 ms 9.40 ms 45 µs 382.34 MiB 322324 11931 0
Tin 2 10500.00 Kbit/s 5.00 ms 100.00 ms 785 µs 113 µs 15 µs 72.14 MiB 120026 827 0
Tin 3 5250.00 Kbit/s 5.00 ms 100.00 ms 274 µs 11 µs 11 µs 3.71 KiB 50 0 0
103

Discord still hasn't load up :sweat_smile: It's been like 3 minutes now
Yes I tried restarting Discord if it was the issue but nah it worked fine before