[Solved] ASUS RT-AC68U DSL settings

[warchief]

@moeller0

two different set-ups?

The asus is a bridged DSL modem, the linksys with openwrt is the router? I am always confused about the actual terms.

Otherwise I am making progress with the Ultimate SQM settings: Layer_cake + DSCP marks - #444 by dlakelan thread, this solved many of the questions I had running advancedtomato whereas I begin to run to the end of the router config and needed scripts to further sharpen the qos. It was suggested I just run cake so I did

I also have other questions like do I use

nat dual-dsthost ingress
nat dual-srchost

on all sqm instances - layer_cake and piece_of_cake? Do I swap the rules on the LAN sqm instance the same way I swap the up/down speed?

Are these set correctly?

My icmp is not functioning like the udp rule, it does when assigned mac but should this be

the WAN, LAN flipping egress and ingress values confuses me and @dlakelan explained but lol

##priority function creates a rule which isolates all traffic and defaults it, while prioritizing the egress udp packets from my pc on the lan

##firewall tcp/udp
## flush mangle table
iptables -t mangle -N dscp_mark
iptables -t mangle -F dscp_mark

iptables -t mangle -A FORWARD -j dscp_mark

iptables -t mangle -A FORWARD -p udp -m hashlimit  --hashlimit-name gaming --hashlimit-above 75/sec --hashlimit-burst 50 --hashlimit-mode srcip,srcport,dstip,dstport -j CONNMARK --set-mark 0x55

##priority
iptables -t mangle -A dscp_mark -i br-lan -j DSCP --set-dscp-class CS1

##packetlimit
iptables -t mangle -A FORWARD -p udp -m connmark ! --mark 0x55 -m conntrack --ctorigsrc 192.0.0.0 -m connbytes --connbytes 0:700 --connbytes-dir both --connbytes-mode avgpkt -j DSCP --set-dscp-class CS6

## icmp gets CS6
iptables -t mangle -A dscp_mark -p icmp -d 192.0.0.0 -j DSCP --set-dscp-class CS6

## game traffic
iptables -t mangle -A dscp_mark -p udp -d 192.0.0.0 -j DSCP --set-dscp-class CS6
iptables -t mangle -A dscp_mark -p udp -m mac --mac-source 0000000000 -j DSCP --set-dscp-class CS6
iptables -t mangle -A dscp_mark -p tcp -d 192.0.0.0 -j DSCP --set-dscp-class CS6
iptables -t mangle -A dscp_mark -p tcp -m mac --mac-source 0000000000 -j DSCP --set-dscp-class CS6

##firewall tcp/udp
iptables -A -p udp --sport 00:000 -d 000000000 -j ACCEPT
iptables -A -p udp --dport 00:000 -m mac --mac-source 0000000000 -j ACCEPT
iptables -A -p tcp --sport 00:00- d 192.0.0.0 -j ACCEPT
iptables -A -p tcp --dport 00:00 -m mac --mac-source 000000000 -j ACCEPT

#tcpdump
#tcpdump -i br-lan and udp and portrange 1-65535 and -vv -X -w /root/cap-name.pcap

@easyteacher

Connbyte with avgpkt has already taken packet length into account. Specifically, upload and download traffic need to be separately considered.

@easyteacher

		-m connbytes \
			--connbytes :128 \
			--connbytes-dir original \
			--connbytes-mode avgpkt \
		-m connbytes \
			--connbytes :512 \
			--connbytes-dir reply \
			--connbytes-mode avgpkt \
		-m hashlimit \
			--hashlimit-above 15 \
			--hashlimit-mode srcip,srcport \
			--hashlimit-srcmask 32 \
			--hashlimit-name "mark_game_above" \
		-m hashlimit \
			--hashlimit-upto 128 \
			--hashlimit-mode srcip,srcport \
			--hashlimit-srcmask 32 \
			--hashlimit-name "mark_game_upto" \
		-j CONNMARK --set-xmark 0x50/0xf0 \
		-m comment --comment "Realtime Interactive: Games, match upload traffic, tickrate 15(PUBG)-128(CSGO)"

$ipt -A PREROUTING -m conntrack --ctstate RELATED,ESTABLISHED -m connmark ! --mark 0xf0/0xf0 -m connmark ! --mark 0x60/0xf0 -m connmark ! --mark 0x70/0xf0 -m statistic --mode random --probability 0.005 -j CONNMARK --and-mark 0xff0f
$ipt -A PREROUTING -i br-lan -m connmark --mark 0x0/0xf0 -j mark_DSCP_ul

$ipt -A PREROUTING -m connmark --mark 0x50/0xf0 -j DSCP --set-dscp-class CS4

My iptables rule to match the game traffic. Connmark, connbytes and hashlimit are used. LOL tested.

Take LOL for example.
ipv4 2 udp 17 179 src=192.168.1.121 dst=182.254.35.166 sport=8786 dport=7080 packets=55483 bytes=4841699 src=182.254.35.166 dst=172.27.77.225 sport=7080 dport=8786 packets=65694 bytes=12491560 [ASSURED] mark=80 zone=0 use=2

Average upload packet length: 4841699/55483≈87
Average download packet length: 12491560 / 65694≈190
Games like DNF will have larger download packet length around 300-400.

I am using connmark to avoid those connections whose rates are bouncing back and forth. The following two rules are used to save CPU cycles by only checking connections with no connmark and remove connmark with a probability of 0.5% in order to let some connections checked again later.

$ipt -A PREROUTING -m conntrack --ctstate RELATED,ESTABLISHED -m connmark ! --mark 0xf0/0xf0 -m connmark ! --mark 0x60/0xf0 -m connmark ! --mark 0x70/0xf0 -m statistic --mode random --probability 0.005 -j CONNMARK --and-mark 0xff0f
$ipt -A PREROUTING -i br-lan -m connmark --mark 0x0/0xf0 -j mark_DSCP_ul

These two posts by @easyteacher are what I am trying to accomplish, if the router is able to distinguish lines this way using code, I would attempt it and monitor it like you said, but I need assistance it is very complex and written in a format I am not familiar with. First, what programs would I use to monitor this type of data, I see he drew some packets from the connections and while these values are important it is not critical and uncommon - we would like to simplify this ruleset. Like say I added a checkbox to OpenWrt that said "accelerate game packets" how would this be written in relation to @easyteacher 's code ?

Basically I want to build a virtual bullet train and as long as I have the hardware to accomplish this right now, I believe configuring it is the issue. If there are any other scripts you can think of which will assist or have suggestions to my rules - I only want a pipe running from my pc to the game servers which is big as possible and super slippery for the hit reg udp packets to transfer through.

My hope is to create a rule in iptables where layer cake is combined with dscp marked udp burst and length designed in a fashion related to @easyteacher 's packet identification

Your input is greatly appreciated, I am making more progress than I have in 2 years.