[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Ultimate SQM settings: Layer_cake + DSCP marks

Hi again!
I switched back from fireqos to SQM, because my router (TP-LINK W8970) have low power to handle fireqos config.
also it's better idea to control both bufferbloat + doing prioritization using a AIO solution.
I started to read and play with SQM settings, DSCP marks,etc...
and the result was amazing!, it's like having SQM + adaptive QOS, in one package simple and easy to config.
so i made a script that will handle DSCP marks and traffic routing using veth method like how
@dlakelan
taught me, now i can play an online (LOL) game on my pc while download + seeding a torrent without lag,
ping is very stable with rare ping spike (due to bad bandwidth settings and bad isp's network), also i can
download + browsing internet without delay (download will suffer when i browsing or download on my phone),
bandwidth fairness is really good, no more streaming lags.
this script still need to be optimization, correction to handle everything, after that i want to integrate it to layer_cake script, so it will be more easier for basic users to handle a simple configs.
to make this happen i want the valued help from this great forum members/modders.
some tests:
SQM off:
a.unloaded network:
League of legends game ping is 90~100ms.
whatsapp voice calls,viber voice calls= few lags and delay.
b.loaded network:
League of legends game ping is 200~400ms.
whatsapp voice calls,viber voice calls= more lags and delay, sometimes other person cant's hear clearly.
SQM on with DSCP tags:
a. unloaded network:
League of legends game ping is 100~117ms.
whatsapp voice calls,viber voice calls= no lags or delay.
b.loaded network:
League of legends game ping is 109~124ms.
whatsapp voice calls,viber voice calls= very rare lag, no delay.
This is ISP bandwidth splitting speeds:
download:
services= google ggc,cache,games updates,some CDN's.==8 mbps upto 12 mbps.
youtube= 8mbps upto 12 mbps.
facebook= 4 mbps.
main download speed=1.1 mbps, and 8mbps from 2am to 10am.
upload:
between 1.5mbps ~ 7mbps differ from site to site.but if i disable upload shaping bufferbloat is too low for upload, only my download have spikes!, and can be fixed by set download limit to 1000kbit.
*all of those traffic is isolated from each other!.they use dscp tag on youtube traffic (can't remember which value exactly but i think its 0x60 or 0x30).
My setup:
i used this guide to have extroot--> https://www.pcsuggest.com/configuring-extroot-with-openwrt-on-tp-link-mr-3220/
use this command to backup your installed packages names to file:
opkg list-installed | cut -f 1 -d ' ' > /etc/config/packages.list
and use this to reinstall your packages after sysupgrade
opkg install $(cat /etc/config/packages.list)
needed packages:
first run "opkg update", without quotes, then
opkg install kmod-veth kmod-netem kmod-ipt-ipopt kmod-nf-nathelper-extra kmod-sched kmod-sched-cake ip-full ipset iptables-mod-conntrack-extra iptables-mod-extra iptables-mod-ipopt iptables-mod-nat-extra
opkg remove dnsmasq ; opkg install dnsmasq-full
optional:
opkg install tcpdump -->to dump packets on interface for debugging.
opkg install kmod-tcp-bbr -->to enable BBR tcp congestion control,it's really improve network response.
then go to /etc/sysctl.conf and add those two lines:
net.core.default_qdisc=fq_codel
net.ipv4.tcp_congestion_control=bbr
I named my script net.sh and place it in /root/net.sh
IPT="iptables"

####Latency Sensitive Ports
##league of legends,PUBGM,some voip service like whatsapp.
sport1="37,53,81,88,123,500,1500,1863,3074:3076,3478:3481,3544,3659,4244"
sport2="4379,4380,4500,5222,5223,5228,5242,5000:5500,7985,8000,8888,9339,9785,34784"
sport3="10000:10300,19132,25565,27000:27030,28960,59172,39499,34141,59437:59581,45395,50318,59234"
dport1="37,53,81,88,123,500,1500,1863,3005,3074:3076,3101,3478:3481,3544"
dport2="3659,4244,4379,4380,4500,5222,5223,5228,5242,5000:5500,7985,8000,8888,34784"
dport3="9339,9785,10000:10300,19132,25565,27000:27030,28960,59172,39499,34141,59437:59581,45395"
dport4="1119,3724,7000:7999,8011,8081:8090,9030,17000,50318,59234"

## set up a 2 pair of veth devices to handle inbound and outbound traffic
ip link show | grep veth0 || ip link add type veth

## get new veth interfaces up
ip link set veth0 up
ip link set veth1 up

## trun on promisc mode,sometimes it's needed to make bridge work
ip link set veth1 promisc on

## add veth1,veth3 to bridge
brctl addif br-lan veth1

## just to make sure there's nothing inside those 2 tables
ip rule del priority 100
ip route flush table 100

##ipset for streming sites.they are bening filled by dnsmasq
ipset create vidstream hash:ip
ipset create usrcdn hash:ip
ipset create bulk hash:ip
ipset create latsens hash:ip

## flush mangle table
$IPT -t mangle -F PREROUTING

## add routing for veth0 this will handle all slow traffic
ip route add default dev veth0 table 100
ip rule add iif pppoe-wan table 100 priority 100

#Clear interface dscp marks, we don't trust ISP marks(also to use our own marks).
$IPT -t mangle -A PREROUTING -i pppoe-wan -j DSCP --set-dscp 0

########################################
# Latency Sensitive (gaming/voip)
########################################
##Latency Sensitive
$IPT -t mangle -A PREROUTING -p icmp -j DSCP --set-dscp-class CS6 ##dscp tag for ping packets

$IPT -t mangle -A PREROUTING -m set --match-set latsens src -j DSCP --set-dscp-class CS6 ## set dscp tag for our Latency Sensitive (latsens) ipset

$IPT -t mangle -A PREROUTING -p tcp -m conntrack --ctorigsrc 192.168.1.150 -m multiport ! --ports 80,443 -j DSCP --set-dscp-class CS6 -m comment --comment "PS4" #i don't have PS4, change the ip according to your ip setting.
$IPT -t mangle -A PREROUTING -p udp -m conntrack --ctorigsrc 192.168.1.150 -j DSCP --set-dscp-class CS6 -m comment --comment "PS4"

$IPT -t mangle -A PREROUTING -p udp -m multiport --sport $sport1 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p udp -m multiport --sport $sport2 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p udp -m multiport --sport $sport3 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p tcp -m multiport --sport 22,2099,4244,5222,5223,5228,5242,8088,8393:8400,50318,59234 -j DSCP --set-dscp-class CS6

$IPT -t mangle -A PREROUTING -p udp -m multiport --dport $dport1 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p udp -m multiport --dport $dport2 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p udp -m multiport --dport $dport3 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p udp -m multiport --dport $dport4 -j DSCP --set-dscp-class CS6
$IPT -t mangle -A PREROUTING -p tcp -m multiport --dport 22,2099,3013,4244,5222:5228,5242,10012,17000,17500,8088,8393:8400,50318,59234 -j DSCP --set-dscp-class CS6

########################################
# Streaming Media (videos/audios)
########################################
$IPT -t mangle -A PREROUTING -m set --match-set vidstream src -j DSCP --set-dscp-class AF41 ##set dscp tag for our ipset vidstearm
$IPT -t mangle -A PREROUTING -m set --match-set usrcdn src -j DSCP --set-dscp-class AF21 ##set dscp tag for our ipset usrcdn #those cdn's are isolated by my ISP.
$IPT -t mangle -A PREROUTING -p tcp -m multiport --dport 1935 -j DSCP --set-dscp-class AF41

########################################
# Best Effort (browsing/services)
########################################
$IPT -t mangle -A PREROUTING -p tcp -m multiport --ports 80,443,853,3455,8080,27015 -j DSCP --set-dscp-class AF13
$IPT -t mangle -A PREROUTING -p udp -m multiport --ports 80,443,853,3455,8080 -j DSCP --set-dscp-class AF13

#########################################
# Background Traffic (Bulk/file transfer)
#########################################
$IPT -t mangle -A PREROUTING -m set --match-set bulk src -j DSCP --set-dscp-class CS1 ##set dscp tag for our bulk ipset
$IPT -t mangle -A PREROUTING -p tcp -m multiport --ports 21,80,443,8080,60887,27014:27050 -m connbytes --connbytes 1048576: --connbytes-dir both --connbytes-mode bytes -j DSCP --set-dscp-class CS1 #60887 bittorrent
$IPT -t mangle -A PREROUTING -p udp -m multiport --ports 21,80,443,8080,60887 -m connbytes --connbytes 1048576: --connbytes-dir both --connbytes-mode bytes -j DSCP --set-dscp-class CS1
Q1. Is it needed to tag sport?, if yes then how ?
Q2. Should i route my fast traffic to another pair of veth?
Q3. How to benefit from ECN ?
Q4. How to wmm qos queue ?
Q5. Is it needed to add -w option to iptables to get rid of xt_table lock issue?
My dnsmasq.conf ipset's /etc/dnsmasq.conf :
##Latency Sensitive (gaming/voip)
ipset=/*.igamecj.com/igamecj.com/latsens

##video/audio streams
# Youtube is also isolated by my isp
ipset=/googlevideo.com/*.googlevideo.com/vidstream
# NetFlix
ipset=/nflxvideo.net/vidstream
# AmazonVideo
ipset=/s3.ll.dash.row.aiv-cdn.net/d25xi40x97liuc.cloudfront.net/aiv-delivery.net/vidstream
# Facebook
ipset=/fbcdn.net/vidstream
# Twitch
ipset=/ttvnw.net/vidstream
# VeVo
ipset=/vevo.com/vidstream
# Spotify
ipset=/audio-fa.scdn.cot/vidstream
# Deezer
ipset=/deezer.com/vidstream
# SoundCloud
ipset=/sndcdn.com/vidstream
# last.fm
ipset=/last.fm/vidstream

##i have isolated speed for those cdn's
ipset=/googletagmanager.com/googleusercontent.com/*.googleusercontent.com/google.com/fbcdn.net/*.fbcdn.net/akamaihd.net/*.akamaihd.net/whatsapp.net/*.whatsapp.net/whatsapp.com/*.whatsapp.com/www-cdn.whatsapp.net/googleapis.com/*.googleapis.com/ucy.ac.cy/1e100.net/hwcdn.net/usrcdn

## Bulk downloads
#qq download
ipset=/download.qq.com/bulk
# Steam Download
ipset=/steamcontent.com/bulk
# PSN Download
ipset=/gs2.ww.prod.dl.playstation.net/bulk
# DropBox
ipset=/dropbox.com/dropboxstatic.com/dropbox-dns.com/log.getdropbox.com/bulk
# Google Drive
ipset=/drive.google.com/drive-thirdparty.googleusercontent.com/bulk
# Google Docs
ipset=/docs.google.com/docs.googleusercontent.com/bulk
# PlayStore Download
ipset=/gvt1.com/bulk
# WhatsApp Files
ipset=/mmg-fna.whatsapp.net/bulk
# Youtube Upload
ipset=/upload.youtube.com/upload.video.google.com/bulk
# WindowsUpdate
ipset=/windowsupdate.com/update.microsoft.com/bulk
My /etc/config/sqm :
config queue 'wan'
 option ingress_ecn 'ECN'
 option egress_ecn 'ECN'
 option enabled '1'
 option debug_logging '0'
 option verbosity '5'
 option qdisc 'cake'
 option qdisc_advanced '1'
 option qdisc_really_really_advanced '1'
 option squash_dscp '0'
 option squash_ingress '0'
 option linklayer 'ethernet'
 option linklayer_advanced '1'
 option tcMTU '2047'
 option tcTSIZE '128'
 option tcMPU '64'
 option linklayer_adaptation_mechanism 'cake'
 option download '0'
 option interface 'veth0'
 option shaper_burst '1'
 option script 'layer_cake.qos'
 option ilimit '18'
 option elimit '18'
 option iqdisc_opts 'overhead 28 diffserv4 nat dual-srchost rtt 200ms'
 option eqdisc_opts 'overhead 35 diffserv4 nat dual-dsthost rtt 200ms'
 option overhead '0'
 option upload '16000'

config queue
 option debug_logging '0'
 option verbosity '5'
 option ingress_ecn 'ECN'
 option tcMTU '2047'
 option tcTSIZE '128'
 option enabled '1'
 option download '0'
 option qdisc 'cake'
 option qdisc_advanced '1'
 option squash_dscp '0'
 option squash_ingress '0'
 option egress_ecn 'ECN'
 option qdisc_really_really_advanced '1'
 option linklayer 'ethernet'
 option linklayer_advanced '1'
 option tcMPU '64'
 option linklayer_adaptation_mechanism 'cake'
 option shaper_burst '1'
 option upload '7000'
 option script 'layer_cake.qos'
 option ilimit '18'
 option elimit '18'
 option interface 'pppoe-wan'
 option overhead '0'
 option iqdisc_opts 'diffserv4 nat dual-dsthost rtt 200ms'
 option eqdisc_opts 'overhead 18 diffserv4 nat dual-srchost rtt 200ms'

config queue
 option debug_logging '0'
 option verbosity '5'
 option qdisc 'cake'
 option qdisc_advanced '1'
 option ingress_ecn 'ECN'
 option qdisc_really_really_advanced '1'
 option enabled '1'
 option squash_dscp '0'
 option squash_ingress '0'
 option egress_ecn 'ECN'
 option shaper_burst '1'
 option interface 'eth0'
 option script 'test_LAN_triple-isolate__piece_of_cake.qos'
 option linklayer 'ethernet'
 option overhead '8'
 option linklayer_advanced '1'
 option tcMTU '2047'
 option tcTSIZE '128'
 option tcMPU '64'
 option linklayer_adaptation_mechanism 'cake'
 option ilimit '18'
 option elimit '18'
 option iqdisc_opts 'mpu 64 nat dual-srchost'
 option eqdisc_opts 'mpu 64 nat dual-dsthost'
 option download '58120'
 option upload '0'
I used diffserv4 for layer cake:
you can edit this in /usr/lib/sqm/defaults.sh
replace diffserv3 with diffserv4
I'm using "Linux OpenWrt 4.14.79 #0 SMP Mon Nov 12 16:09:09 2018 mips GNU/Linux
- r8450", tomorrow i will upgrade to latest snapshot.
*note: software offloading is off!.
bufferbloat test:
sqm off:
DSL Reports – 1 Nov 18
Speed test result
I tested my connection at DSLReports.com/speedtest ..

DSL Reports – 1 Nov 18
Speed test result
I tested my connection at DSLReports.com/speedtest ..

sqm on:
DSL Reports – 11 Nov 18
Speed test result
I tested my connection at DSLReports.com/speedtest ..

DSL Reports – 7 Nov 18
Speed test result
I tested my connection at DSLReports.com/speedtest ..

DSL Reports – 3 Nov 18
Speed test result
I tested my connection at DSLReports.com/speedtest ..
Many thanks to openwrt dev's/modder's for making openwrt great and better.
Many thanks to
@dlakelan
for taught me and help me to configure fireqos.
Many thanks to
@shm0
for your script, i took some codes from your script!
*NOTE:
Here is the newest script, don't use old script it's a port based and outed dated!
QOS script
Dnsmasq, dnsmasq.conf:
dnsmasq.conf
**Use an overhead that will suit your connection type!
***I used sqm on eth0 for test purpose and maybe sometimes fix spikes!
****For routers that have Switch0 interface(DSA architecture switch), you don't need to use veth method!

2 Replies
8

[Assistant]
I forget to say that my connection type now is FTTH using EPON modem. my connection RTT is between 150ms-200ms.
My /etc/sysctl.conf :
# Defaults are configured in /etc/sysctl.d/* and can be customized in this file
#new
net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1

net.netfilter.nf_conntrack_acct=1
net.netfilter.nf_conntrack_checksum=0
net.netfilter.nf_conntrack_max=16384
net.netfilter.nf_conntrack_tcp_timeout_established=7440
net.netfilter.nf_conntrack_udp_timeout=60
net.netfilter.nf_conntrack_udp_timeout_stream=180

#new settings to improve ping response and lowering ping spikes
net.core.netdev_budget=300
net.core.netdev_max_backlog = 1000

#ecn
net.ipv4.tcp_ecn=2
net.ipv4.tcp_timestamps=1
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1

First, impressive!
hisham2630:
option iqdisc_opts 'overhead 28 diffserv4 nat dual-srchost rtt 200ms' option eqdisc_opts 'overhead 35 diffserv4 nat dual-dsthost rtt 200ms'
This seems odd, typically networks use symmetric overhead in both directions and recent cake learned how to undo the variable overhead part the kernel adds dependent on the type of interface. Could you post the output of "tc -s qdisc" so we can figure out whether your cake is recent enough?

1 Reply
1

hisham2630:
net.ipv4.tcp_congestion_control=bbr
This will only affect traffic that is served from your router, so if you do not serve TCP-connections from your browser this will have very little effect.

1 Reply
1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: HOWTO: OpenWrt on the Raspberry Pi 4

Hey all, I've been enjoying my RPi 4 router and it seems to be a popular topic so I thought I'd write up a quick article to help people get started with their own setup. If you have any feedback or would like to propose an edit please feel free to open an issue or PR on GitHub.
So You Want To Build a Raspberry Pi Router
With the increasing prevalence of gigabit-speed home internet connections in the US and elsewhere comes the need for routing hardware with greater performance than many "all-in-one" devices can offer. This is especially true for users who wish to take advantage of advanced traffic shaping technologies like SQM which is notoriously CPU-intensive. The Raspberry Pi 4 single-board computer is affordable, ubiquitous, and runs circles around any consumer device near its price point. All of these qualities make it an ideal candidate to become the next foundation of your home network.
What It's Good For
Full gigabit routing performance with SQM disabled. The CPU is certainly capable of much more, limited only by the speed of the network interfaces.
~800 Mbps up/down with SQM enabled.
Oodles of extra RAM and processing power for running additional services if you're so inclined.
Doing all of the above with no moving parts, low power consumption and in a very compact footprint, at a very competitive price.
What It's Not So Good For
Servicing your wireless devices. The Pi's onboard WiFi implementation is truly pitiful compared to a decent all-in-one consumer router. Instead, plan on supplementing the Pi with another device to serve as a wireless access point.
What You'll Need
A Raspberry Pi 4 board. 1GB of RAM will be plenty for this application but more won't hurt.
Power supply or PoE hat.
A quality microSD card of any commonly available size; even 8GB is an enormous amount of space compared to your average plastic consumer network router.
A case designed for passive cooling. Here are a few options you might consider:
Flirc
Argon40 One
Argon40 Neo
Geekworm Armor
A USB-to-Ethernet interface. Any dongle based on the RTL8153 chipset will do. The TP-Link UE300 is a popular choice and works very well.
It's possible to use the Pi in a so-called "router-on-a-stick" configuration using only the single onboard Ethernet port in conjunction with VLANs. This configuration requires the use of a managed switch and is beyond the scope of this guide.
Example Build and Total Cost
Raspberry Pi 4 2GB: $35
Inland USB-C power supply: $6
Micro Center 64GB microSD card: $7
Argon Neo case: $15
TP-Link UE300: $14
Total: $77
Note that due to the ongoing global unpleasantness the 2GB Pi 4 recently suffered a price bump to $45. This is said to be a temporary measure but for the time being I feel the 4GB version is a better value at $55. Opting for the 4GB board will bring the total build cost to $97.
Getting Started
With your Pi assembled it's time to write an OpenWrt image to your microSD card. One option is to use wulfy23's excellent build which should get you up and running with minimum fuss. Another is to use the stock image OpenWrt provides; however the stock image lacks a driver for the USB dongle. The last, and the one we'll explore here, is to build a customized image with the needed packages. Luckily for us the OpenWrt firmware selector website makes it easy to request such an image.
To get started, navigate to the firmware selector server at https://firmware-selector.openwrt.org/. Start typing Raspberry Pi 4 into the search field and select Raspberry Pi 4B/400/4CM (64bit). Now expand the Customize accordion.
We are now free to add additional packages to our firmware image. Nice! Go ahead and add these three packages to the end of the list: kmod-usb-net-rtl8152 luci luci-ssl. This will ensure that both the USB Ethernet driver and the LuCI web interface are baked into our custom image.
Click Request Build and go top up your coffee while you wait for your image to be built. Once it's ready, download the FACTORY (EXT4) image. Decompress the gzipped image and finally flash it to your microSD card using the tool of your choice.
Getting Online
Connect your Pi's onboard Ethernet port to your LAN. Connect your WAN connection to the USB dongle, but DO NOT connect it to the Pi just yet. Navigate to http://192.168.1.1 in your browser and log in without a password. Immediately do the following:
Navigate to System -> Administration -> Router Password and configure a strong password.
Navigate to System -> Administration -> SSH Access and configure the SSH server to listen only on the LAN interface.
If desired, provide a public key for SSH login in System -> Administration -> SSH-Keys
Now that LuCI (OpenWrt's web-based configuration interface) and SSH have both been locked down you may connect the USB Ethernet dongle. Navigate to Network -> Interfaces -> Devices and confirm that you see a new eth1 device. If you don't, restart your router from System -> Reboot.
Click back to the Interfaces tab. Add a new interface called WAN using the correct protocol for your internet service and attach it to the new eth1 interface. Complete any additional configuration steps based on your chosen protocol, then save and apply your changes.
If your ISP requires your WAN device to communicate over a specific VLAN, use the "custom" device field to provide the VLAN ID in the form DEVICE.VLANID, e.g. eth1.10.
Navigate to Firewall Settings and confirm that the new WAN interface is set as the firewall zone.
During this step, you also need to navigate to the "Firewall Settings" tab, and assign "WAN" as the firewall zone.
You should now be connected to the Internet!
Maximizing Performance
In its current configuration your router will effortlessly route a symmetric gigabit connection. However, there are a handful of things we can do to wring even more performance out of the Pi.
Configuration Tweaks
Navigate to Network -> Interfaces -> Global network options and enable Packet Steering. This feature helps ensure that all packets belonging to a particular flow are handled by the same processing core, enhancing performance. See here for a helpful introduction to the concept.
Navigate to Network -> Firewall and verify the Software flow offloading setting. If you intend to use SQM you will want to leave this feature disabled. If you will not be using SQM go ahead and enable it now.
Enabling irqbalance
IRQs are the mechanism by which your network interfaces inform the operating system that there is work to be done. By default these requests will be handled by a single CPU core which can result in a bottleneck in situations where the lone core can't keep up.
This is where the irqbalance package comes in. This daemon monitors processor load and IRQ volume and distributes the IRQs across different CPU cores, easing the bottleneck.
Using irqbalance is as straightforward as it gets: just install it from System -> Software and either reboot the router or manually start the service from System -> Startup to ensure that the daemon is running. You should now see an irqbalance process in Status -> Processes.
Overclocking the CPU
Your new router's CPU can be overclocked to 2 GHz with a simple configuration change. Do the math - that's a 33% performance bump across all cores for free! While the higher frequency will necessarily translate to more heat, a quality case designed for passive cooling or any active cooling solution should have no trouble keeping your Pi at a comfortable temperature.
While even higher overclocks are possible (and despite conventional wisdom will no longer void your warranty as of the Pi 4) I think the extra juice is unlikely to be worth the squeeze for most.
To enable the overclock simply add the following lines to the bottom of /boot/config.txt, then reboot:
over_voltage=6
arm_freq=2000
Putting it all together
Here are a handful of Ookla speedtests and Waveform bufferbloat tests to give you an idea of what you can expect both with and without SQM enabled.
Without SQM
With SQM
Settings:
sqm.eth1=queue
sqm.eth1.qdisc='cake'
sqm.eth1.debug_logging='0'
sqm.eth1.verbosity='5'
sqm.eth1.linklayer='ethernet'
sqm.eth1.overhead='44'
sqm.eth1.script='piece_of_cake.qos'
sqm.eth1.interface='pppoe-WAN'
sqm.eth1.download='850000'
sqm.eth1.upload='850000'
sqm.eth1.enabled='1

2 Replies
16

[Assistant]
Once my NanoPi R4S shows up I thought it might be cool to do a roundup comparing the Pi, the R4S, and maybe a Belkin RT3200 as well. Let me know if you'd be interested in that and I'll see what I can do.

5

hi @aporétique very good tutorial
for more conventional reasons and to have a decent wifi I tested the RT3200 in optical fiber which gave me very good results, with irq balance and packet steering enabled
Summary

1

Thanks so much for sharing this! The RT3200/E8450 is definitely a terrific option (shoutout to
@daniel
for all of his hard work) and there's no contest if you need the onboard radios. If you get a chance I'd love to see what sort of numbers your setup can push with SQM enabled.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Request for testing LuCI on DSA devices

@jow
has recently added LuCI support for DSA configs. DSA is upstream Linux solution for controlling switches.
OpenWrt targets that seem to be using DSA:
bcm4908
bmips
gemini
imx6
ipq806x
kirkwood
mvebu
octeon
realtek
If you happen to have device using DSA and you can install the latest master - please test it. Install LuCI and see if you can configure switch, ports, interfaces.
We need some testing before proceeding with the 21.02 releases.

9

[Assistant]
ipq806x is only about to migrate to DSA with the pending bump to kernel v5.10, which is currently still being debugged for weird behaviour on e.g. the nbg6817 (qcom-smem, the automatic partition parser, and the qca8337 switch not working yet (reporting a wrong switch ID and not passing data through)).

1

I'm planning to test the 5.10 kernel on an r7500v2 soon. Is there a specific/different luci package I need to select at build time to test the luci DSA config? I'd like it to be included in the build as I'm expecting to not have internet access initially.
Also is the luci config ready for AP only configs with VLANs?
EDIT: based on the responses below, I changed my initial "hand" config for /etc/config/network - see my posts below.

2 Replies

The plain luci/ luci-ssl meta-packages should pull in everything necessary, https://github.com/openwrt/luci/pull/4307 has some (older) screenshots of the DSA configuration pages. It's a little complex to wrap your head around at first, but you should be able to get it working
--
Disclaimer: I haven't been able to really test it myself so far.

2


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: CAKE w/ Adaptive Bandwidth [October 2021 to September 2022]

UPDATE: one outcome of this thread has been the development of a bash script, config file and associated service file for automatically adjusting CAKE bandwidth in the context of variable rate connections such as LTE or Starlink, which is available here:
GitHub
GitHub - lynxthecat/cake-autorate: Eliminate the excess latency and jitter...
Eliminate the excess latency and jitter terrorizing your 4G, 5G, LTE, Starlink or other variable rate connection! - lynxthecat/cake-autorate
There is also a LUA-based approach available here:
GitHub
GitHub - sqm-autorate/sqm-autorate: Adjusts bandwidth for CAKE by measuring...
Adjusts bandwidth for CAKE by measuring load and RTT times - sqm-autorate/sqm-autorate
If you use either script then I have just one ask: please can you provide your feedback on this thread and/or on the respective GitHub pages. Such feedback motivates and helps shape further development work. After all, these are maintained on a purely voluntary basis by enthusiasts.
There are a couple of further approaches in development. If the author of any such approach would like theirs mentioned on this post then please let me know.
Original post is below (and the figure above demonstrates the issue). Happy reading!
So from browsing these forums it is evident that CAKE's autorate-ingress is a feature that is highly sought after. It promises automatic bandwidth determination for the many of us who have connections with a fluctuating bandwidth. From the man page:
autorate-ingress
Automatic capacity estimation based on traffic arriving at this qdisc. This is most likely to be useful with cellular links, which tend to change quality randomly. A bandwidth parameter can be used in conjunction to specify an initial estimate. The shaper will periodically be set to a bandwidth slightly below the estimated rate. This estimator cannot estimate the bandwidth of links downstream of itself.
Sadly it is also evident from these forums that it doesn't work. I have tested this on my own 4G connection without success. It ramps up slowly to a point where I see a lot of bufferbloat. Happy to test further if I should be trying it in conjunction with different settings (could my packet overhead be set too low - presently 70 to cover 60 for WireGuard and 10 for LTE overhead?), but I do not think I have come across even just one positive experience with this feature.
Overall CAKE seems to work very well, but the issue of bandwidth determination remains highly problematic, and for some individuals is even a reason to forego CAKE altogether.
Might the developers be convinced to make it work for those of us on such connections?
As for presumably any LTE connection, my own 4G connection heavily fluctuates. Mostly there is a 30Mbit/s stable component and then anything between 0-40Mbit/s on top of that. Setting bandwidth to 30Mbit/s is mostly OK, but in the evenings I still see some bufferbloat, presumably because of congestion at my ISP / cell tower.
In summary I sacrifice a huge amount of otherwise perfectly usable bandwidth for a solution that works only most of the time. This is obviously not very satisfactory. Anyone on a variable rate connection will face the same issue.
Otherwise I see various DIY attempts have been made to address this interesting issue.
These can be divided into two categories.
Firstly, bandwidth is tweaked by monitoring latency. For example ping tests are carried out and used to increase bandwidth until the ping increases.
@dlakelan
wrote a script for this:
github.com
dlakelan/routerperf/blob/master/sqmfeedback.erl
-module(sqmfeedback).
-export([main/0,pingtimes_ms/3,monitor_ifaces/3,monitor_a_site/1,adjuster/1,monitor_delays/2,timer_process/2,monitor_bw/2 ]).

%% Read a line of ping output and extract the time in milliseconds

pingline_to_ms(Line) ->
    case re:replace(Line,".*time=([0-9.]+) ms","\\1") of
 [[L]] ->
     try binary_to_float(L)
     catch
  error:_Reason ->
      try float(binary_to_integer(L))
      catch
   error:_ -> false
      end
     end;
 _ -> false
    end.
This file has been truncated. show original
Secondly, an attempt is made to determine the maximum bandwidth by saturating the connection.
A crude implementation is to disable CAKE and then run a bandwidth test and take the output from that bandwidth test to inform CAKE.
A better approach is however excellently summarised in this post by
@richb-hanover-priv
here:
Help to make sh script adjust SQM automaticaly
For Developers
I think the approach is intriguing. On a period basis: Run a process to guarantee the link is fully-loaded Make some measurement of max up and down transfer rates Adjust the SQM params based on those measured speeds. I don't know if these random thoughts might help/be feasible: Using ifconfig values would seem to capture the actual number of bytes transferred in each direction. Thus it's not affected by other client traffic. You also avoid needing to install another package. To get data…
The idea is that you disable SQM and then just run a speed test to saturate the connection. You don't care about the output from the speed test; it is just to ensure that the connection is totally saturated. You then compare packets transferred before and after to determine the max bandwidth on the line. The nice thing about this is that it helps reduce interference with normal traffic since you are just filling in the gaps around ordinary traffic. I suppose a downside with this approach however is that it will still result in temporary bufferbloat. So it would presumably interfere with a zoom call.
@Bndwdthseekr
wrote a script based on this approach - see here:
Help to make sh script adjust SQM automaticaly
For Developers
Try this: cat /sys/class/net/pppoe-wan/statistics/rx_bytes cat /sys/class/net/pppoe-wan/statistics/tx_bytes Replace 'pppoe-wan' with your iface of course, and that's your data point, which is updated in realtime Edit: Maybe this will help. Its lazy as... but it works over here. I didn't bother adding upload as mine is always constant. #set to max bandwidth connection can support tc qdisc change root dev ifb4pppoe-wan cake bandwidth 6944Kbit dual-dsthost nat overhead 44 ingress #…
My question is: what is the best approach between the above two? I think I favour the former on a theoretical level because it presumably offers reduced interference with normal traffic. But personally I think I would favour a simple and elegant bash script whereas the erlang script looks a bit complicated.
I'd like to try such a simple and elegant script even if it means writing my own.
@Bndwdthseekr
what did you settle on in the end?
@moeller0
I'd love to have your thoughts on the above.

Solved by moeller0 in post #88
So, unllike
@dlakelan
I did not actually try to implement anything like this at all, so can really just speculate, so take my words with caution. I understand that what you probably desire is to be able to configure a hard minimum and hard maximum shaper rate (per direction) and want to keep the sh…
7

[Assistant]
Well, variable rate links without proper AQM or back-pressure are just nasty. For transmission things like BQL for ethernet sand AQL for WiFi demonstrate that even with variable rates buffers can be kept smallish automatically, but that requires integration into the variable rate link's driver. For reception things are even nastier and the best we can do is heuristics. I never tried autorate-ingress since I am using a fixed rate link myself (the problem I see is that cake tries to determine the rate from the inter-packet delay of incoming packets, but if inter-packet delay is large, is this because bandwidth is low, or just because one of the senders has little data to send?).
Out of the other approaches I consider the "monitor latency" the better approach, but I note that this will only work after the fact, so you can expect at least some level of bufferbloat to appear transiently. Not a big issue if the rate of bandwidth fluctuation is small compared to the "latency sampling" frequency of the heuristic, but at latests once bandwidth changes happen faster than the sampling frequency things will become unpleasant (maybe some hysteresis can help).
In short I do not envy you... the proper solution is debloating the LTE basestation and modem seems infeasible, and the other options are work-arounds that can ameliorate the situation but not reliably fix it. That said, I can see that a work-around might still be attractive even if it only works most of the time.

2

Insightful, thank you!
Any idea why autorate-ingress increases bandwidth to a level that is too high and results in bufferbloat for me? It really feels like this feature could do with some further development, no?
And since bandwidth determination is so fundamental to CAKE it would seem CAKE could be significantly improved in this respect.
Although naturally I understand that we are at the mercy of what the developers choose to do with their own free time!

Lynx:
Insightful. Any idea why autorate-ingress increases bandwidth to a level that is too high and results in bufferbloat for me? It really feels like this feature could do with some further development, no?
As far as I can tell the feature works for its designer, but as I said I never tried it myself. Looking at it, I would have expected an UI in which one could configure both an upper and a lower limit.... If packets come in smoothly it probably works, but I guess it will fail if packets are delivered in bursts, because then estimating the instantaneous rate from the inter-packet interval will over-estimate the true available capacity.
But, if you feel up for it, have a look at sch_cake in the Linux kernel, maybe you see some ways to improve it, I am sure a lot of users would be happy.
Lynx:
And since bandwidth determination is so fundamental to CAKE it would seem CAKE could be significantly improved in this respect.
Sure, but how?
Lynx:
Although naturally I understand that we are at the mercy of what the developers choose to do with their own free time!
NO, the beauty of open source is that you can just have a go at it in your own time, and if you have a proof of principle I am sure getting it upstream you would find some help

4


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Adblock-oisd : 22.03 allows you to use huge blocklists with dnsmasq

UPDATE: an outcome of this thread has been the development of adblock-oisd - a super lean script written as an OpenWrt service file that implements adblocking via the oisd blocklist and incorporates several safety checks and useful features. adblock-oisd will download the latest oisd list and perform various safety checks associated with the file before and after restarting dnsmasq and act accordingly. It is designed to be run as a daily scheduled task.
adblock-oisd is available here:
GitHub
GitHub - lynxthecat/adblock-oisd: Set up adblock using oisd dnsmasq file
Set up adblock using oisd dnsmasq file. Contribute to lynxthecat/adblock-oisd development by creating an account on GitHub.
ORIGINAL POST:
Not my work, just reposting here for more people to see. I'm using this method - it's truly insanely fast, and the full OISD blocklist is only consuming ~30mb ram on my r7800 / 22.03.
Thanks to luigi_xp whoever/wherever you are. Link to original reddit thread:
reddit
r/openwrt - FYI: 22.03 allows you to use huge blocklists with dnsmasq
Bis jetzt 63 Votes und 22 Kommentare auf Reddit
22.03-rcx comes with dnsmasq 2.86, which brings a full rewrite of the dns handling code making it much more efficient in both ram and processing for various things, including common blocklist syntax.
I'm running the full 1M+ line oisd blocklist with no noticeable performance penalty on my humble MT7621/128MB Archer C6.
I created a script which is literally
wget https://dnsmasq.oisd.nl -O /tmp/dnsmasq.d/oisd.txt && /etc/init.d/dnsmasq restart
and setup it to run every day and on startup, and it's working silk smooth. Dnsmasq is using a "large" amount of ram (17%), but considering what it's doing and that there's still a lot of free ram left, i'm happy with the result.
Unfortunately plugins such as adblock still choke because they process the lists before, but if you use dnsmasq directly and create a little script to download and update the lists it works as good if not better than the standalone plugins.
Hope someone finds this useful

2 Replies
13

[Assistant]
Wizballs:
22.03-rcx comes with dnsmasq 2.86
Great - I run dnsmasq, now also at version 2.86, on my Linux desktop, with several blocklists that in total, in their human readable text format, consume over 27 Mbytes. I've been using dnsmasq since at least 2016. It's outstanding.

1

Wizballs:
Unfortunately plugins such as adblock still choke because they process the lists before
Kudos for sharing this, afaik there are lot of people here on the forum who don't frequent reddit and vice a versa.
Obviously to each their own, and yes, that blocklist would probably choke simple-adblock on a 128Mb router, but there are upsides of "processing", especially if you're using multiple sources -- adblock pioneered and simple-adblock shamelessly copied the functionality to remove duplicates and unnecessary 3rd level domains from the final block list for supported dnsmasq/unbound configs.
Another upside of using adblock or simple-adblock is a built-in enforcement of OpenWrt's resolver across your network, so even if your clients are set up to use hardcoded DNS (but not DoT/DoH) servers, the ads would still be blocked.
PS. Have you run any actual tests to measure the performance of dnsmasq with and without that list?

2 Replies
3

Hey no problems re-posting it here. Exactly why I did it, I think a lot of people would never visit the Reddit/Openwrt community. In fact I only found it by complete accident doing a google search. Hit the jackpot in this case tho.
I'll send details of performance etc when I get home (which is very, very good BTW!)


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [SQM/QOS] Recommended settings for the dslreports speedtest (bufferbloat testing)

Dear All,
NOTE: As of late April/early May 2020 the dslreports speedtest seems to be disabled because of overload? Not clear how/if that situation is going to resolve, we might have just lost a powerful bufferbloat measurement tool. While I hope that this fine service is going to come back again, I anyway want to take the opportunity to thank dslreports for their great service for all those years for free!
As of mid 2020 tests seem to work again to some degree, so please use cautiously to avoid overloading the servers; that means by all means no automated repeated tests using the dslreports infrastructure, for simple bandwidth measurements, Ookla's speedtest.net (as of mid 2022 both the iOS and Android clients also report latency under load as detailed results) should be better suited for that use case, as would be fast.com (which can be configured to also report loaded latency, but it is unclear what the single number represents). Also a decent speedtest leveraging cloudflare's CDN as traffic source and sink is the waveform speedtest https://www.waveform.com/tools/bufferbloat; and this one actually measures latency as well and allows to download a .csv file containing the individual latency measurements. Cloudflare itself also added latency under load measurements to https://speed.cloudflare.com which also contains an un-loaded packet-loss test. BUT see Note 5, and always try the http test if https tests fail
Occasionally, while trying to understand bufferbloat issues, it is helpful to have finer control over a speedtest's variables than most speedtests seem to expose. Luckily the https://www.dslreports.com/speedtest offers a number of interesting knobs and toggles, if one completes the free registration. Here is the set of configuration changes I recommend to users wanting to better understand the bufferbloat behavior of their link (say, while trying to reduce bofferbloat with qos-scripts or sqm-scripts).
I recommend to configure the following speedtest parameters (you get to the configuration/preferences page by clicking the cog button):
set "No. download streams:" to 16 (if this causes errors during testing change both to 8 or even lower (see Note 1 below)
set "No. upload streams:" to 16 (if this causes errors during testing change both to 8 or even lower (see Note 1 below)
Rationale: To test the suitability of a link for concurrent usage one better tests with concurrent usage.
check the "Hi-Res BufferBloat:" checkbox (on the detailed results page of a finished test click the Idle, Downloading, and Uploading labels underneath the bufferbloat bar graph to get results from all individual latency probes per test phase to better understand the bufferbloat issues)
Rationale: The higher temporal resolution helps in differentiating between different potential causes for high bufferbloat measurements.
set "Upload duration:" to 30, note not registered anonymous users are not allowed to change the duration
set "Download duration:" to 30, note not registered anonymous users are not allowed to change the duration
Rationale: A number of ISPs use transient bandwidth boosting approaches that are a decent help for sparse users, but that will also often make a short speedtest report overly optimistic bandwidth numbers. Since these transient boost typically seem to be only a few seconds measuring longer will help average their effect partially away.
check the "dodge compression: " checkbox
Rationale: While compression can be a fair way to increase bandwidth, it is not a generally applicable technique and will not allow to compress all data equally well.
if you perform a test post a link to the detailed results page here in the forum (much nicer than just overview images), either copy and past the "link" from the results page "Sharing" section, or better select "Linked BBCode" which will give the summary graphic tat also acts as a link to the detailed results page (but make sure that those graphics actually display in the forum, otherwise post the link).
It seems a number of SSL cerificates used when HTTPS is enabled have expired and cause errors, so better not check the HTTPS checkbox (see note 5 below).
Examples (click on image to go to the detailed results):
Unmitigated Bufferbloat, especially on egress ([http://www.dslreports.com/speedtest/6796065])(http://www.dslreports.com/speedtest/6796065):
Mitigated Bufferbloat (https://www.dslreports.com/speedtest/9507819)
I would recommend to not simply judge a link by the one letter Bloat classifier in the summary graph but always look at the three individual detail plots (by clicking the "Idle", "Downloading", and "Uploading" links at the bottom of the three bars in the default bufferbloat plot).
Notes:
If your internet connection is very slow you might need to reduce the number of concurrent streams to account for the slowness. Depending on the asymmetry of the link you might need to use a lower number of streams in the upload direction. Typically a smaller number of streams will lead to less utilization of the link and lower reported bandwidth numbers. More streams emulate multiple concurrent bandwidth users, if you only ever use the link with one bandwidth heavy application at a time, setting the number of streams to 1 or 2 might lead to a better estimate of the useable bandwidth for that application, but for bufferbloat testing more streams typically create a stricter test, so go as high as your link will allow.
The ready-made profile types all use different numbers of streams (which seems a decent approach to account for the different capabilities of the different link technologies), which will make it somewhat tricky to compare the bandwidth results between the different profiles, so make sure to always use the same profile (potentially your own) when aiming for comparable tests...
If one selects too many streams in a direction the symptoms might be that not all of them start up and one gets an error message somewhere in the detailed results, in that case one should select a lower number until one finds a number that reliably works; also for asymmetrical links this number can be different for upload and download. It seems not important to always use the maximum number though, but something like 8-16 should allow to saturate a link even with TCP's typical bandwidth probing...
Also note that for some users setting the number of streams too high (say 16/16 for a 2/0.3 ADSL link) will not result in the described error message, but instead a badly bloated test result, in that case one should also try to manually set the test to use fewer streams (see https://forum.openwrt.org/t/sqm-makes-bufferbloat-significantly-worse/13456/33?u=moeller0)
Once the test is running you can use the field at the bottom labeled "Note:" to add information about the test, this is a great place to document any relevant data, especially if you set out to test a number of different configurations.
For the lucky ones with really fast (500 Mbps and above?) links, have a look at the "official" dslreports recommendations of how to trim your browser/OS to be able to reliably hit such speeds: https://www.dslreports.com/forum/r29994522-speedtest-gigabit-testing-results-debugging
The dslreports speedtest results page renders different versions for mobile browsers, especially it does not show the bufferbloat detailed results; at least for mobile firefox this can be worked-around by checking the "Request desktop site" checkbox (this checkbox should be visible after clicking/tapping the three vertical dots "hamburger lite" menu in the upper right corner) and reloading the results.
Some/most/all? SSL certificates of the dslreports speedtest servers seem to cause issues with modern browsers, so make sure to run the test over http instead of https. There is a clickable link (use http) on the top right corner of the widget in which to select the test type, make sure to click this.

19

[Assistant]
Great to have a well standardized method for the community, to gauge what is a difficult to visualize issue and when it's improved.
One thing to be aware of, if you look at the results on a mobile phone vs the full site (some of us, like me, do most of their browsing on phones?) you don't see the most useful part, the high res bufferbloat graphs. At least on my Android with the browsers I use. Not sure if there's a way around this, didn't see a link to switch sites, etc.
I wanted to mention it, since it caught me out back when I first started to look at this, and those hi-res latency graphs are the main piece of information.

1

JonP:
One thing to be aware of, if you look at the results on a mobile phone vs the full site (some of us, like me, do most of their browsing on phones?) you don’t see the most useful part, the high res bufferbloat graphs. At least on my Android with the browsers I use. Not sure if there’s a way around this, didn’t see a link to switch sites, etc.
Hi Jon,
good point! As a work around firefox offers a "Request desktop site" checkbox in the menu that appears if one clicks the 3 stacked dots symbol in the upper right corner; once this box is checked, firefox shows the bufferbloat plots again. The same trick also seems to work for chrome. It is a bit counter intuitive that dslreports hide this information for mobile users though...
Best Regards

I get best results by setting ingress to 0 and egress to 1.5 times the upload bandwidth, along with layer_cake.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [Tutorial] [No CLI] Configuring DNS over TLS with LuCI using Stubby and Dnsmasq

I recently decided to implement DNS over TLS and found that many tutorials were not oriented to those who are less tech savvy. This is a simple approach which allows you to do all configuration in LuCI without any CLI commands. I have to give credit to https://candrews.integralblue.com/2018/08/dns-over-tls-on-openwrt-18-06/, as that is where I got my setup instructions from, and just figured out how to do them in LuCI
Notes:
This setup expects you to use Cloudflare's DNS resolvers. If you want to use an alternative such as Google DNS, you will have to use some CLI.
This tutorial is based on the latest master branch commit as of 2018-01-10. The steps may be similar for different versions or setups, but are not guaranteed. Most likely these steps are going to be the same for 18.06.1, but I don't quite remember the differences in LuCI.
Instructions:
Log into LuCI at http://192.168.1.1/cgi-bin/luci/, go to System -> Software, and hit the Update Lists button.
Filter down to find the package called "stubby", and click the Install button. For OpenWrt 18.06.1 users, also install "ca-certificates" and "ca-bundle". This is needed due to a missed dependency on the stubby package. Newer versions of OpenWrt corrected this.
Go to System -> Startup, find stubby, and click the Start button. Also set stubby to "Enabled" on this same screen.
Under Network -> DHCP and DNS, click the "Resolv and Hosts Files" tab, and put a check mark next to "Ignore resolve file". Press Save & Apply.
Under Network -> DHCP and DNS, click the "General Settings" tab, set the "DNS forwardings" list to 0::1#5453 and 127.0.0.1#5453.
Go to System -> Startup, find "dnsmasq" and click "Restart".
Your done! To verify everything is working, open a new tab in your internet browser and try to go to some websites you don't normally go to. You can also go to https://www.cloudflare.com/ssl/encrypted-sni/ and press "Check My Browser". You should see green check marks for "Secure DNS" and "DNSSEC".
Edit 2021-03-13:
Removed step to set custom DNS servers on WAN and WAN6 due to the research from
@open.nya
,
@jbrossard
, and
@thekiefs
. Thanks!

28

[Assistant]
It is not working: Stubby produces following error:
Could not schedule query: None of the configured upstreams could be used to send queries on the specified transports
As a result I have no internet connection.
I am using OpenWrt 18.06.1 r7258-5eb055306f / LuCI openwrt-18.06 branch (git-18.228.31946-f64b152)

1 Reply

Thats not good. I will do a fresh install of 18.06.1 when I get home from work today to test. In the meantime, in DHCP and DNS you can change from the localhost resolver to your favorite DNS resolver, or under your WAN and WAN6 interfaces, recheck "Use DNS servers advertised by peer".
Sorry for any inconveniences and I'll keep you updated on what I find.

Alright I looked into this more. Looking at https://github.com/openwrt/packages/issues/6682, the dependencies for 18.06.1 r7258 are not correct for stubby. Can you also install "ca-certificates" through System -> Software? If that doesn't fix it, can you also install "ca-bundle"?
You may need to restart stubby/dnsmasq after installing.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: How I fixed my luci.ucodebridge error

After fiddling around in LuCI (OpenWrt 23.05.0-rc3) I managed to get myself to the point where I would see the login screen but immediately after logging in, received this error:
Error
Unhandled exception during request dispatching
module 'luci.ucodebridge' not found:
 no field package.preload['luci.ucodebridge']
 no file './luci/ucodebridge.lua'
 no file '/usr/share/lua/luci/ucodebridge.lua'
 no file '/usr/share/lua/luci/ucodebridge/init.lua'
 no file '/usr/lib/lua/luci/ucodebridge.lua'
 no file '/usr/lib/lua/luci/ucodebridge/init.lua'
 no file './luci/ucodebridge.so'
 no file '/usr/lib/lua/luci/ucodebridge.so'
 no file '/usr/lib/lua/loadall.so'
 no file './luci.so'
 no file '/usr/lib/lua/luci.so'
 no file '/usr/lib/lua/loadall.so'

In [anonymous function](), file [C]

In [anonymous function](), file /usr/share/ucode/luci/runtime.uc, line 133, byte 10:
  called from function [arrow function] (/usr/share/ucode/luci/runtime.uc:141:63)
  called from function render ([C])
  called from function [anonymous function] (/usr/share/ucode/luci/runtime.uc:141:64)
  called from function run_action (/usr/share/ucode/luci/dispatcher.uc:778:34)
  called from function [anonymous function] (/usr/share/ucode/luci/dispatcher.uc:998:48)
  called from anonymous function (/www/cgi-bin/luci:39:12)

             die(ex);
  Near here --------^
I googled and searched this forum and found many many many people with the same or similar errors but the closest I found to a solution was (unhelpfully) "just factory reset".
Once I got it working again I thought it would be nice to post how I resolved it so that the next person hopefully finds something a bit more useful than "just factory reset" when they have the same problem. Good luck, unknown future person!
I fixed it by SSH-ing into the router and running opkg install luci-app-uhttpd
I don't know why but it works now.

2 Replies
12

[Assistant]
iacvlvs:
OpenWrt 23.05.0-rc3
I have the same problem on OpenWrt version 23.05.0-rc4.

By any chance are you making images via the Firmware Selector?

no, I downloaded the firmware here. https://downloads.openwrt.org/releases/23.05.0-rc4

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: LEDE v17.01.3 service release

The LEDE Community is proud to announce the third service release of stable LEDE 17.01 series.
LEDE 17.01.3 “Reboot” incorporates a fair number of fixes back ported from the development branch during the last sixteen weeks.
Some selected highlights of the service release are:
Linux kernel updated to version 4.4.89 (from 4.4.71 in v17.01.2)
Numerous security fixes to curl, dnsmasq, mbedtls, tcpdump and the Linux kernel
Assorted platform fixes for ar7, ar71xx, bcm53xx, brcm63xx, imx6, ipq806x, lantiq, ramips, sunxi and x86
For a detailed list of changes since 17.01.2 refer to
https://lede-project.org/releases/17.01/changelog-17.01.3
For latest information about the 17.01 series, refer to the wiki at:
https://lede-project.org/releases/17.01/
To download the v17.01.3 images, navigate to:
https://downloads.lede-project.org/releases/17.01.3/
As always, a big thank you goes to all our active package maintainers,
testers, documenters and supporters.
Have fun!
The LEDE Community

13

[Assistant]
Since I changed to LEDE I am impressed about the overall quality of the releases and the development process. Thank you all very much!

3

115 days since last reboot on 17.01.2 (c2600). I almost hate to upgrade and reboot.

2

I have a very strange issue on latest version of LEDE. Before anyone says could be issue with other hardware, its not as this never happens when Im running DD WRT.
So once a day my Synology NAS which is connected wired to the router looses all connectivity and nothing can access it on my network. Only way to get it back is to either unplug and replug the ethernet cable and wait 5 mins or reboot my NAS.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: IPv4 is now a minority share

Some time in the last few months, Google's "ipv6 share" from US traffic went above 50%. Ipv4 is now a minority of traffic to Google from the US. Moreso even in France (72%) and Germany (66%).
OpenWrt handles Ipv6 flawlessly out of the box for most providers.
I know I'm celebrating!

Solved by dlakelan in post #105
I think this thread kind of ran its course. I'm going to summarize it and select this as the "answer" so we don't have it resurrected from the dead all the time. Yes, IPv6 from major developed world has moved above 50% of traffic to google, but not everything is google and not everything is the de…
10

[Assistant]
IPv6 only make senses in BIG data centers.
IPv4 is best for home users.

2 Replies
4

ppmm:
IPv4 is best for home users.
Tell it to those users whose ISPs only offer IPv6.

3

ISPs that offer only IPv6 without NAT64 (via RFC6146) are broken. Thankfully, OpenWRT supports RFC6146 via the 464xlat package, and, to the connected clients, it then looks like the ISP supports both IPv4 and IPv6, with some strange encapsulation hop just after the router.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: A note about using ChatGPT for OpenWrt Answers

I want to make it clear: ChatGPT is not an authoritative source for information about OpenWrt or networking in general (among many other topics).
The AI systems currently create human-sounding answers, and they pull from various sources on the internet. The problem is that they do not have any mechanisms to ensure the accuracy of the responses, nor do they provide context as to how they arrived at the answer.
Please do not post the ChatGPT ‘conversations’ or ‘solutions’ here, as they are more likely to cause confusion, and they certainly are not reliable. Further, if you choose to use an AI based solution, do so at your own risk.
The contributors to the OpenWrt forums are human and generally highly skilled, and will provide far better support than you’ll ever get with an AI system (at least for the foreseeable future). What makes this forum so great is the exchange of information that only humans can do reliably… let’s keep that going!

38

[Assistant]
The main problem is that ChatGPT at its current level cannot reliably verify the provided information and validate it against best practices, so its answers can be outdated, incomplete, nonsensical, or just harmful, however it can probably serve as a good source of inspiration to show possible research directions.

5

In none of the instances that came up recently, I've seen any of that. Yes, it sounded convincing, it sounded authoritative, it even went as far as suggesting 'detailed' configuration files, but technically it was far away from the truth and the capabilities of the really existing hardware available to this day.

2

This likely depends on the difficulty of a specific problem, but it can provide albeit sub-optimal, but more or less working answers.
I think it needs a good and up-to-date machine knowledge base as well as some sort of integration with test automation frameworks to improve the answer quality.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [Tutorial] DNS-over-TLS with dnsmasq and stubby (no need for unbound)

All the guides I see for using DNS-over-TLS on OpenWRT require unbound, what I found out is that in fact you only need stubby, which does the DNS-over-TLS and acts as a proxy for DN resolution.
Stubby is simple to configure and dnsmasq can point to this proxy instead and continue to do all the things it needs to do such as domain name caching.
Because I have this setup running in a old router (4/32) without much space on the overlay to install stubby and its dependencies I have it setup so it installs stubby on startup to the RAM, because of this I'm presenting 2 tutorials, one for a RAM installation and another for a permanent install. All the instructions are for the console, stubby doesn't have a LUCI module so you must be confortable with configuring your router using SSH and Linux.
These configuration are for running DNS-over-TLS in STRICT mode on Cloudfare 1.1.1.1 service.
Strict mode means that only encrypted requests are allowed from a server with a valid certificate.
Install to RAM
Add the following lines to /etc/rc.local (what to do when the router boots)
opkg update
opkg install ca-bundle -d ram
opkg install stubby -d ram
rm /tmp/opkg-lists/*
sleep 5
export PATH="/usr/sbin:/usr/bin:/sbin:/bin:/tmp/usr/bin:/tmp/usr/sbin" && export LD_LIBRARY_PATH="/tmp/lib:/tmp/usr/lib" && /tmp/usr/sbin/stubby -C /etc/myconfig/stubby.yml -g
Explanation:
CA-bundle installs the certificates bundle needed for TLS
The rm command is there to free up some space from the RAM (deletes the OPKG lists as they are no longer needed)
The Export commands are required in order to be able to run applications and libraries installed to the /tmp/ dir (RAM).
Finally it launches stubby, notice the "-C /etc/myconfig/stubby.yml" that is the configuration file (more on that later), you can store permanently as the example in /etc/myconfig (myconfig is an example, just make sure to include the dir in your backup configuration).
1st run:
You should first run those commands by manually via console on your router before having them run automatically at startup.
First, run the opkg commands to install all that we need.
Secondly copy the default config from /tmp/etc/stubby/stubby.yml to your custom config dir in /etc/
Now we need to edit /etc/myconfig/stubby.yml using vi.
#NOTE: See '/etc/stubby/stubby.yml.default' for original config file and descriptions

resolution_type: GETDNS_RESOLUTION_STUB

dnssec: GETDNS_EXTENSION_TRUE

appdata_dir: "/tmp/stubby"

tls_ca_file: "/tmp/etc/ssl/certs/ca-certificates.crt"

dns_transport_list:
  - GETDNS_TRANSPORT_TLS

tls_authentication: GETDNS_AUTHENTICATION_REQUIRED

tls_query_padding_blocksize: 128

edns_client_subnet_private : 1

round_robin_upstreams: 0

idle_timeout: 10000

listen_addresses:
  - 127.0.0.1@5453
  -  0::1@5453

upstream_recursive_servers:
# IPv6 addresses
# # Cloudflare IPv6
  - address_data: 2606:4700:4700::1111
    tls_port: 853
    tls_auth_name: "cloudflare-dns.com"

# # Cloudflare IPv6
  - address_data: 2606:4700:4700::1001
    tls_port: 853
    tls_auth_name: "cloudflare-dns.com"

# # Quad 9 IPv6
#  - address_data: 2620:fe::10
#    tls_auth_name: "dns.quad9.net"

# IPv4 addresses
# # Cloudflare servers
  - address_data: 1.1.1.1
    tls_port: 853
    tls_auth_name: "cloudflare-dns.com"

# # Cloudflare servers
  - address_data: 1.0.0.1
    tls_port: 853
    tls_auth_name: "cloudflare-dns.com"

# Quad 9 service
#  - address_data: 9.9.9.10
#    tls_auth_name: "dns.quad9.net"
Explanation:
dnssec: GETDNS_EXTENSION_TRUE : This line provides DNSSEC validation
appdata_dir: Where the keys for DNSSEC are stored
tls_ca_file is important, this is the name and location of the CA bundle file required for TLS to work.
notice the "listen adresses", 5453 is the port number dnsmasq will have to connect on localhost.
Finally we need to edit dnsmasq.conf in /etc/.
Add the following lines (replace the existing server(s) lines)
no-resolv
proxy-dnssec
server=127.0.0.1#5453
If the only "server" line present in the dnsmasq.conf is the one above then all requests from clients will go to
to stubby.
To test the settings:
killall dnsmasq
/etc/init.d/dnsmasq start
export PATH="/usr/sbin:/usr/bin:/sbin:/bin:/tmp/usr/bin:/tmp/usr/sbin" && export LD_LIBRARY_PATH="/tmp/lib:/tmp/usr/lib" && /tmp/usr/sbin/stubby -C /etc/myconfig/stubby.yml -g
It's important to notice, that with this configuration the DNS traffic is only available for clients after stubby is successfully installed and running.
In order for the router to run opkg and set the time after reboot it needs to perform Domain Name resolution even thou Stubby is not running yet, because of that I only have dnsmasq running for the clients, all dn lookups made by the router itself are going to the ISP DN servers that are obtained via DHCP on the WAN side.
If everything is working correctly (you can use http://www.dnsleaktest.com/ to test, note that you will not see the 1.1.1.1 IP but you should see the ISP name as Cloudfare, the IP you will see there is that of the closest cloudflare server and that is a good thing) then you can reboot and have rc.local do the job for you.
Permanent Install
The permanent install is simpler
Run the following commands manually:
opkg update
opkg install ca-certificates
opkg install stubby
Edit /etc/stubby/stubby.yml (see above, but you shouldn't need to set the tls_ca_file), and edit dnsmasq as above.
Run:
killall dnsmasq
/etc/init.d/dnsmasq start
/etc/init.d/stubby start
/etc/init.d/stubby enable
Attention: this tutorial is a work in progress and might be incomplete, use at your own risk.
source: https://wiki.archlinux.org/index.php/Stubby

11

[Assistant]
what's the difference between ca-bundle and ca-certificates package?
Thanks for your tutorial btw.

rpugsley:
what's the difference between ca-bundle and ca-certificates package?
Thanks for your tutorial btw.
You're welcome.
Ca-bundle installs all the root certificates in a bundle, one .crt file, ca-certificates installs separate files for each certificate. Ca-bundle ends up occupying less space because of this. cURL (which I have also installed on the same system) works by default with ca-bundle and that's why it's present on the Install to RAM section. Libopenssl which stubby uses works by default with ca-certificates, and as such you don't need to set "tls_ca_file" in the stubby configuration for the permanent install, as it's going to look by default in /etc/ssl/ for the certificates.
I hope that clarifies!

2

The title just says that unbound isn't needed, not getdns.
When you do 'opkg install stubby' getdns is a dependency and is installed so is libopenssl, this is obvious by just checking the package.
(this post was in response to a post that was deleted)


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Best practices and tools for measuring wifi performance

What is this thread about?
Having read a lot of forum threads, I came to the conclusion that many users (myself included) lack coherent information about how to conduct proper debugging and how to properly measure wifi performance. Furthermore, they lack information about tools available to do such. I invite everybody to point to proper practices, tools and methods in hopes of giving users and committers to OpenWRT alike a starting point to evaluate and debug their wifi issues. Posting measurements for educational purposes would be great. You are all very welcome to teach. Comparison of methods and tools sounds nice too, but might be a little exhaustive. Screenshots will be nice. I plan to sporadically update and edit this Initial message to account for responses and debate in this thread. Eventually, some info from here could be used for the docs.
What is this thread not about?
Expecting help, because your measurements point to flaws in OpenWRT code.
Debugging your very very personal setup of OpenWRT
→ If you have issues with your setup or if your measurements point to flaws in the code or hardware, please open a new forum post, instead of raising the issue here.
Best practices:
test latency (e.g. round trip time) simultaneously with throughput (show graphics side by side) [1]
run tests long enough [2]
test same configuration on same hardware with various distances/paths [2]
test same configuration on same hardware with various hindrances (e.g. walls inbetween)
test same configuration with multiple devices and different hardware
Measure latency under load ! [2]
Measure latency/throughput also with multiple (client) streams[2]
Do not interpret UDP and TCP results with equal weights [2]
Do not overvalue throughput rate over range without looking at latency or rate control [2]
Do not overvalue summary statistics that don’t look at inter-station behaviors [2]
Also check out the OpenWRT docs about Performance and logging
Sources: [1], [2]; OpenWRT Forum; Common Sense
Tools:
aircrack-ng
ping
arping
Ping Tracer
Bufferbloat test hosted by waveform
Crusader (Network bandwidth and latency tester)
Collectd
additional info:
graphical interface and data collected is roughly similar to Grafana, but less polished. Installation is easier though, as no data needs to be exported and collectd can be managed from within LuCI.
Flent (The flexible network tester)
"Wraps well-known network benchmarking tools (such as netperf and iperf2)"
Grafana
How to:
How I monitor my OpenWrt router with Grafana Cloud and Prometheus
irtt (isochronous round trip tester)
Iperf2
The successor to Iperf
Iperf3
iPerf3 and Iperf2 are based on different code. Iperf3 is not the successor to Iperf2.
Difference between Iperf2 and Iperf3)
Nuttcp
netperf
netperf in the OpenWrt forum
sockperf
tcpdump + tcptrace -G and xplot.org
How to: Verifying tcp correctness with xplot.org
OAM Tools
OWAMP (One Way Active Measurement Protocol)
perfSONAR project:
website
github
TWAMP (Two-Way Active Measurement Protocol)
TWAMP-GUI
Wireshark
how to:
capture wifi management frames with wireshark: https://wiki.wireshark.org/CaptureSetup/WLAN
Wavemon
WiFi Analyzer (VREM version)
Simple methods for beginners:
For starters, usually it is advised to differentiate between your actual wifi and the connection from your main router to your internet service provider or some other endpoint on the internet.
Hosted tests on the web, for example for throughput like speedtest.net or fast.com will be bottlenecked by the slowest performing device along the way (or alternatively your contracted speedlimits, as offered by your internet provider). Tests for latency like the bufferbloat test hosted by waveform fall in the same category and best describe your connection from your router outwards towards the web.
By testing your wifi separately and restricted to your local network, as a major first step, you will be able to eliminate all sources of errors that stem from your internet provider and other connectivity issues along that path. Additionally, often, your wifi will be substantially faster than the speeds offered by your internet provider, but sometimes, the reverse can hold true as well. Also, for this reason, please test wifi separately from your outwards internet connection.
To find out what truly has an impact on your wifi connection, it is advised to test both throughput AND latency. Sometimes, your throughput will be great, but you will still face severe connectivity issues, because of latency. In the last section, a great variety of tools have been listed that (mostly) can be used to do exactly this. The abundance of tools may paralyse newcomers. Which tool is best? Which tool do I need? How can I best use them? - The answer to these question is difficult and may depend on your exact use case. It may also change from time to time, as many of these tools experience ongoing development.
To help you newcomers, I have listed a short introcution to Iperf3 (for throughput) and Wireshark (latency) down below, which should suffice for the most basic of needs and give you a rough idea about your devices current wifi capabilities:
1. Iperf3
How to capture throughput:
Run following command at the serverside: Ìperf3 -s
Run one of the following commands at the client side:
TCP test, which measures the upload from client to server
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -t 60 -i 10
TCP test with 4 Client Streams, which measures the uploads from clients to server
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -P 4 -t 60 -i 10
TCP test with 8 Client Streams, which measures the uploads from clients to server
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -P 8 -t 60 -i 10
TCP test; Reverse mode: server sends, client receives
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -t 60 -i 10 -R
TCP test with 4 Client Streams; Reverse mode: server sends, clients receive
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -P 4 -t 60 -i 10 -R
TCP test with 8 Client Streams; Reverse mode: server sends, clients receive
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -P 8 -t 60 -i 10 -R
Bidirectional TCP test
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -t 60 -i 10 --bidir
Bidirectional TCP test with 4 Client Streams
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -P 4 -t 60 -i 10 --bidir
Bidirectional TCP test with 8 Client Streams
iperf3 -c <IP of Iperf Server> -p <Port of Iperf Server> -P 8 -t 60 -i 10 --bidir
Tips and things to look out for when using Iperf3
Official Iperf3 user docs
Default configuration of Iperf3 measures the UPLOAD from client to server
Where you run the testing tool server and client is important
Test bufferbloat on both wired and wifi
Avoid WiFi scanning tools while testing
Interpreting Iperf results on UDP bandwidth
2. Wireshark:
How to capture latency via testing round trip time:
Use Iperf in combination with Wireshark. Capture traffic with wireshark while doing throughput tests with iperf, choose a random data packet from that time frame, then look at Wireshark's "Statistics → Stream graphs → Round Trip Time"
How to further debug wifi issues:
OpenWRT: Wireless FAQ
OpenWRT: How can I debug my wireless
https://oldwiki.archive.openwrt.org/doc/devel/debugging#wireless (actually holds more info than the current OpenWRT website!)
Additional info in German language:
https://bergs.biz/blog/2017/01/05/wlan-probleme-erkennen-und-beseitigen/
https://bergs.biz/blog/2022/01/15/mein-internet-funktioniert-nicht-was-tun/
Avoid configuration pitfalls:
Choose the best channel and band for your wifi. Avoid channels that are contested by neighbouring devices. The more devices are trying to use the same channel, the worse the connection, as there will be interference. To find the best channels, use WiFi Analyzer (VREM version)
Choose best wifi protocol for your use case:
802.11n (wifi 4) at the 2GHz band, for long range (low throughput)
802.11ac (wifi 5) at the 5 GHz band, for high throughput, but slightly lower range
802.11ax (wifi 6) for higher throughput than n and ac and for less interference when multiple devices are in close proxity to each other and sharing channels/bands. Usable with both 2 GHz and 5 GHz. Theoretically estimated to have lower range in 2 GHz than n and in 5 GHz than ac.
Using VPN can drastically lower your experienced real world internet speed.
Many users report issues with SSID encryption in mixed mode. Avoid mixed encryption.
Have as less active devices connected as possible to avoid interference.
Avoid long distance and multiple walls.
Advanced configurations like roaming or mesh (802.11s, k, v...) bring their own problems and may be the cause of some of your network problems. If you really wanna know, disable these features during your tests
A wifi repeater (e.g. using relayd) by default halfs your wifi speed. If you can, use access point configuration and cable.
Miscellaneous:
Key Vocabulary:
throughput
latency
round trip time (rtt)
often measured in milliseconds (ms)
What is round trip time? - Cloudfare
Millisecond (ms)
Bit
Byte
Difference between MB/s and Mb/s, or MBps and Mbps: A, B
1 Byte = 8 bit
MB = MegaByte
Mb = Megabit
Mbps: Mega bits per second
Mb/s: Mega bits per second
MBps: Mega Bytes per second
MB/s: Mega Bytes per second
Gigacalculator: Mbps to MB/s Converter
What is the Difference between TCP and UDP?
Methods that look like, but that actually do NOT measure wifi performance:
Please run iperf3 -c 127.0.0.1 and post results here to make router database - #179 by slh
Projects that try (or tried) to fix Linux Wifi
https://netdevconf.info/
https://bufferbloat-and-beyond.net/
https://www.bufferbloat.net/projects/
History, Videos and Literature about how wifi works, how it used to work in the past and historical attempts to fix it:
2022: Linux Plumbers Conference: All types of wireless in Linux are terrible and why
the vendors should feel bad
2022: Playlist/Tutorial: How TCP works
2020: "How internet congestion control actually works in the bufferbloat age" - Dave Taht (LCA 2020)
2016: Making Wifi Fast + Slides - BattleMeshV8 - When do you drop packets?
2016: Linux Plumbers conference - Fixing wifi latency
2016: "Making Wifi fast" - Article about the Linux Plumbers Conference - by Jonathan Corbet
November 8, 2016, LWN.net
Dump of links, which are related to the topic, but that still have to be sifted through and that I am possibly considering to comment upon:
https://forum.openwrt.org/t/is-there-tools-that-can-measure-latency-or-connection-performance/126555\ - replaced by this thread.
Best ways to conduct Speed and Network Performance test from OpenWrt? - #4 by guidosarducci - replaced by this thread.
Antenna diagnostics/info
Bufferbloat - Continuous measurement script
Reducing multiplexing latencies still further in wifi - #75 by amteza
Speedtest: new package to measure network performance - #23 by davidc502
How do you measure throughput on an OpenWrt device?
Wifi diagnostics and performance measurement under LEDE
Ways to measure bufferbloat
Help me figure out why I have gaming latency - #3 by dlakelan
Shaping performance
How to measure (show) cake preformance with luci-app-statistic?
dtaht: Explaining sch_cake's statistics
Comparative Throughput Testing Including NAT, SQM, WireGuard, and OpenVPN - #3 by jeff
Iperf 2.3.8-rc1 and bufferbloat testing - #17 by dtaht
https://lore.kernel.org/linux-wireless/CAA93jw6F1WLDu=Fq2pDt+gswWkJpygv4CDswD06v=yoCMgHo6A@mail.gmail.com/T/#u (iperf2 now can measure round trip latency (rtt) alongside throughput
Ethertype Packet counter needed
Internet protocol suite
https://github.com/Mellanox/libvma/wiki/Architecture (NVIDIA Messaging Accelerator (vma) userspace application that bypasses the kernel and its TCP/UDP handling network stack to achieve low latency)

2 Replies
18

[Assistant]
ThiloteE:
Having read a lot of forum threads
Me to.
ThiloteE:
[Reserved 3]
But you are seriously the first one to make three reserved posts in your own tread without anyone actually giving some feedback on your first hypothesis.
If you ask me “measuring perfection” is addictive for the human brain, once in that loop there will never be enough measuring and when the measuring to perfection is finally done. Then add another decimal and the carrousel starts all over.
So does the world change if everyone measures the wifi performance with all these tools? Does actually anyone have time to use the wifi if measuring it this exactly all the time?

1

I recently wanted to post the systemlog and kernellog from OpenWRT, because i encountered an issue and i had to post those two in three different posts, because there is a characterlimit, so I wanted to make sure to have enough space Maybe we will not need the reserved space here, but who knows.
You are free to fix your wifi without measurements. You are also free to not fix your wifi at all. With help of some measurements, my personal world changed though, because in my flat, i found a better location for my wifi-repeater. I am sure, somebody who actually knows how to code may make even better use of precise measurements. #Education. #Free Speech. #People have to start somewhere learning about things.

ThiloteE:
I recently wanted to post the systemlog and kernellog from OpenWRT, because i encountered an issue and i had to post those two in three different posts, because there is a characterlimit, so I wanted to make sure to have enough space
Did you post those logs as “preformated text”?


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 19.07.1 Service Release

Hi,
The OpenWrt Community is proud to announce the first service release of the stable OpenWrt 19.07 series. OpenWrt 19.07.1 incorporates important security updates for base packages, fixes for 5GHz performance issues and flow offloading memory leaks as well as new versions of the Linux kernel and fixes for various devices.
Selected highlights of this service release are:
Linux kernel updated from 4.14.162 to 4.14.167
Important security fixes for opkg and libubox
Flow offloading memory leak fixes
5GHz performance fixes
Device support fixes for Ubiquiti Rocket M Titanium, Netgear WN2500RP v1, Zyxel NSA325, Netgear WNR3500 V2, Archer C6 v2, Ubiquiti EdgeRouter-X, Archer C20 v4, Archer C50 v4 Archer MR200, TL-WA801ND v5, HiWiFi HC5962, Xiaomi Mi Router 3 Pro, Netgear R6350
For a detailed list of changes since 19.07.0 refer to
https://openwrt.org/releases/19.07/changelog-19.07.1
For latest information about the 19.07 series, refer to the wiki at:
https://openwrt.org/releases/19.07/
To download the v19.07.1 images, navigate to:
https://downloads.openwrt.org/releases/19.07.1/
Have fun!
The OpenWrt Community

29

[Assistant]
Running great on my EA6350v3 and EA8500 AP's - many thanks to the Developers!
I will give sysupgrade from snapshot a try tomorrow morning on the Edgerouter X (kids won't let me "fix" the internet tonight-they remember what happened last time with the Edgerouter X )

1 Reply
2

Why is the NAND section in ath79 not available? The Zyxel NBG6716 should have ath79 since 19.06 according to the devicepage, but the download is not available and gives a 404.

Flawless update from 19.07.0 on my R7800. Great job as ususal

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: KidSafe (or Guest) WiFi, Forced SafeSearch and Adblock

KidSafe (or Guest) WiFi, Forced SafeSearch and Adblock
I had been experimenting for several weeks with creating a Guest wireless network with LEDE. Particularly of interest, I wanted multiple dnsmasq instances and thorough filtering options with
@dibdot
s phenomenal Adblock package.
Initially I had a lot of difficulty getting Adblock to filter multiple dnsmasq instances on separate zones. That is what took the majority of time to troubleshoot and solve. I've got Adblock filtering multiple dnsmasq instances on separate zones successfully now.
Then I thought about changing that Guest wireless network into a network safe for kids with Adblock filtering lists, but also OpenDNS Family Shield, forced Google SafeSearch, Bing Family Shield, and Strict Restricted YouTube access, etc. The main wireless network remains entirely unrestricted, though Adblock filtering is still active..
I have learned a lot via the LEDE Project forum and OpenWrt forum over the years and this is my way of giving back. I wanted to share this since it may be beneficial for some parents wanting to keep their kids safer online or some code benefits here for guest network and Adblock filtering in general.
I will try to update this thread as I continue to add more filtering options to keep kids safe online.
Highlights;
forces network level protection on all kids iPads, iPhones, laptops, etc. within the home network
makes use of multiple instances of dnsmasq and dhcp
forced Google SafeSearch, Bing Family Filter, and Strict Restricted YouTube access
utilizes OpenDNS Family Shield
additional local filtration (ads, trackers, malware, etc.) with
@dibdot
s Adblock for multiple dnsmasq instances
main wireless network remains entirely unrestricted, though Adblock filtering is still active
/etc/config/dhcp
(related dhcp/dnsmasq additions)
config dnsmasq 'main'
 option domainneeded '1'
 option boguspriv '1'
 option filterwin2k '0'
 option localise_queries '1'
 option rebind_protection '1'
 option rebind_localhost '1'
 option local '/lan/'
 option domain 'lan'
 option expandhosts '1'
 option nonegcache '0'
 option authoritative '1'
 option readethers '1'
 option leasefile '/tmp/dhcp.leases'
 option resolvfile '/tmp/resolv.conf.auto'
 option nonwildcard '1'
 list interface 'lan'
 option cachesize '1000'
 option logfacility '/dev/null'

config dnsmasq 'kidsafe'
 option domainneeded '1'
 option boguspriv '1'
 option filterwin2k '0'
 option localise_queries '1'
 option rebind_protection '1'
 option rebind_localhost '1'
 option local '/kidsafe/'
 option domain 'kidsafe'
 option expandhosts '1'
 option nonegcache '0'
 option authoritative '1'
 option readethers '1'
 option leasefile '/tmp/dhcp.leases.kidsafe'
 option resolvfile '/tmp/resolv.conf.kidsafe'
 option strictorder '1'
 option nonwildcard '1'
 list interface 'kidsafe'
 list notinterface 'lo'
 option cachesize '1000'
 option logfacility '/dev/null'
 list address '/google.com/216.239.38.120'
 list address '/google.ca/216.239.38.120'
 list address '/bing.com/204.79.197.220'
 list address '/bing.ca/204.79.197.219'
 list address '/youtube.com/216.239.38.120'
 list address '/m.youtube.com/216.239.38.120'
 list address '/youtubei.googleapis.com/216.239.38.120'
 list address '/youtube.googleapis.com/216.239.38.120'
 list address '/youtube-nocookie.com/216.239.38.120'
 list server '208.67.222.123'
 list server '208.67.220.123'

config dhcp 'lan'
 option instance 'main'
 option interface 'lan'
 option start '100'
 option limit '150'
 option leasetime '12h'

config dhcp 'kidsafe_private'
 option instance 'kidsafe'
 option interface 'kidsafe'
 option start '100'
 option limit '150'
 option leasetime '12h'

config dhcp 'wan'
 option interface 'wan'
 option ignore '1'

config odhcpd 'odhcpd'
 option maindhcp '0'
 option leasefile '/tmp/hosts/odhcpd'
 option leasetrigger '/usr/sbin/odhcpd-update'
/etc/config/firewall
(related firewall additions)
config zone
 option name 'kidsafe'
 option input 'ACCEPT'
 option forward 'DROP'
 option output 'ACCEPT'
 option network 'kidsafe'

config rule
 option target 'ACCEPT'
 option proto 'tcp udp'
 option dest_port '53'
 option name 'KidSafe DNS'
 option src 'kidsafe'

config rule
 option enabled '1'
 option target 'ACCEPT'
 option proto 'udp'
 option dest_port '67-68'
 option name 'KidSafe DHCP'
 option src 'kidsafe'

config redirect 'adblock_dns'
 option name 'Adblock DNS'
 option src 'lan'
 option proto 'tcp udp'
 option src_dport '53'
 option dest_port '53'
 option target 'DNAT'

config redirect 'adblock_dns_kidsafe'
 option name 'Adblock DNS KidSafe'
 option src 'kidsafe'
 option proto 'tcp udp'
 option src_dport '53'
 option dest_port '53'
 option target 'DNAT'

config forwarding
 option dest 'wan'
 option src 'kidsafe'
/etc/config/network
(related network additions)
config interface 'kidsafe'
 option proto 'static'
 option ipaddr '192.168.3.1'
 option delegate '0'
 option dns '208.67.222.123 208.67.220.123'
 option netmask '255.255.255.0'
/etc/config/wireless
(related wireless additions / radio settings may differ)
config wifi-iface
 option device 'radio0'
 option mode 'ap'
 option encryption 'psk2+ccmp'
 option key '****'
 option network 'kidsafe'
 option ssid 'OpenWrt-KidSafe'

14

[Assistant]
Looking good, I'll watch this thread with interest - thank you for the effort.

There was one outstanding issue with regard to Multiple DNS (dnsmasq) instances in LEDE which was causing both (or all) WiFi networks to use the same DNS servers. If this is a bug within LEDE and someone knows more about creating bug reports, please let me know what I can do to help here.
With this config, we get:
/tmp/resolv.conf.auto
/tmp/resolv.conf.kidsafe
The main 5GHz and 2.4GHz networks (used by adults and not restricted) were set to pull in DNS servers from resolv.conf.auto, while the KidSafe WiFi pulls DNS servers from resolv.conf.kidsafe
The problem with my KidSafe Wifi Multiple DNS instance LEDE setup is that nothing was being written to the resolv.conf.kidsafe file. The file was being created correctly and being polled correctly from KidSafe WiFi clients, but nothing was being written to that file. It always remained blank.
The problem was with the resolv.conf.auto file being written was:
# Interface lan
nameserver 208.67.222.222
nameserver 208.67.220.220
# Interface wan
nameserver 208.67.222.222
nameserver 208.67.220.220
# Interface kidsafe
nameserver 208.67.222.123
nameserver 208.67.220.123
The correct resolv.conf files should be as follows:
resolv.conf.auto
# Interface lan
nameserver 208.67.222.222
nameserver 208.67.220.220
# Interface wan
nameserver 208.67.222.222
nameserver 208.67.220.220
resolv.conf.kidsafe
# Interface kidsafe
nameserver 208.67.222.123
nameserver 208.67.220.123
So to work around the potential Multiple DNS instance LEDE bug, I had to manually create a "hacky" fix to this which survives every sysupgrade that I do. If somebody is able to share a smoother, more correct, less "hacky" fix, I am always happy to receive any kind of help or suggestions.
I had to manually create a resolv.conf.kidsafe file:
/etc/resolv.conf.kidsafe
# Interface kidsafe
nameserver 208.67.222.123
nameserver 208.67.220.123
I had to edit sysupgrade.conf to keep this file on every sysupgrade:
/etc/sysupgrade.conf
/etc/resolv.conf.kidsafe
I had to edit rc.local so that, upon any reboot or sysupgrade, my fix would be applied automatically and copied to the correct location:
/etc/rc.local
sleep 60
cp /etc/resolv.conf.kidsafe /tmp/resolv.conf.kidsafe

exit 0
There was one modification that had to be done to my original settings from the original post of this thread.
In /etc/config/network I had to remove the following:
option dns '208.67.222.123 208.67.220.123'
That had to be removed since it was incorrectly being written to the main resolv.conf.auto file instead of the proper resolv.conf.kidsafe file.
So while this probably appears sloppy and "hacky", my Multiple DNSmasq instance setup with a separate KidSafe WiFi (additional protection for kids) is absolutely smooth sailing and has survived well over a dozen sysupgrades. I fixed this issue locally about a month ago and has been running smooth ever since, however I had this long delay in writing about this fix here in this thread. So I apologize for that.
Cheers!

2 Replies
1

Also need to remove the following from /etc/config/dhcp:
list server '208.67.222.123'
list server '208.67.220.123'


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 18.06.2 Service Release

The OpenWrt Community is proud to announce the second service release of
the stable OpenWrt 18.06 series.
OpenWrt 18.06.2 incorporates a fair number of bug fixes in the network userland and the build system, as well as updates to the kernel and base packages.
Some selected highlights of the service release are:
Linux kernel updated to versions 4.9.152/4.14.95 (from 4.9.120/4.14.63 in v18.06.1)
Security fixes for the Linux kernel, GNU patch, Glibc, BZip2, Grub, OpenSSL and MbedTLS
Build system bug fixes
IPv6 and network service fixes
For a detailed list of changes since 18.06.1 refer to
https://openwrt.org/releases/18.06/changelog-18.06.2
For latest information about the 18.06 series, refer to the wiki at:
https://openwrt.org/releases/18.06/
To download the v18.06.2 images, navigate to:
https://downloads.openwrt.org/releases/18.06.2/
Have fun!
The OpenWrt Community

1 Reply
44

[Assistant]
Thank you for your hard work.
Downloaded and installed on TP-Link Archer C7 v2 with no problem seen after 10 hours of uptime on a pretty vanilla configuration.
Model TP-Link Archer C7 v2
Architecture Qualcomm Atheros QCA9558 ver 1 rev 0
Firmware Version OpenWrt 18.06.2 r7676-cddd7b4c77 / LuCI openwrt-18.06 branch (git-19.020.41695-6f6641d)
Kernel Version 4.9.152
Uptime 10h 22m 58s

1

Hello
this release does not work with the D-Link DIR-885L, I can only get the 18.06.1 to work, I tried to flash through emergency mode and also through the openwrt gui (flash image) but it keeps flashing and nothing happens, waited 15 min, but when flashing previous builds it flashes less then 30 seconds. thanks

Thank you very much!
Runs without errors.
Model
TP-Link TL-WDR3600 v1
Architecture
Atheros AR9344 rev 2
Firmware Version
OpenWrt 18.06.2 r7676-cddd7b4c77 / LuCI openwrt-18.06 branch (git-19.020.41695-6f6641d)
Kernel Version
4.9.152
Local Time
Wed Feb 6 14:57:42 2019
Uptime
6h 31m 18s


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 19.07.0 second release candidate

Highlights in OpenWrt 19.07.0-rc2
The OpenWrt community is proud to announce the second release candidate of the upcoming OpenWrt 19.07 stable version series. It incorporates 126 commits since the previous release candidate 19.07.0-rc1.
With this release, the OpenWrt project brings all supported targets back to a single common kernel version and further refines and broadens existing device support. It also provides initial support for the new ath79 target, the future device tree based successor of the popular ar71xx target. For 19.07, both targets are still built, but it is recommended to switch to the ath79 target whenever possible: future releases of OpenWrt will drop support for the ar71xx target.
Highlights of this release candidate since the previous OpenWrt 19.07.0-rc1 release candidate are:
Linux kernel updated to versions 4.14.156 (from 4.14.151 in v19.07.0-rc1)
GCC update to version 7.5.0 (from 7.4.0 in v19.07.0-rc1)
Hostapd update to version 2.9
Device support bugfixes for many devices
Security fixes for curl, e2fsprogs, expat, wolfssl, intel-microcode
Sysupgrade bugfix for an issue that could cause sysupgrade to silently fail to upgrade
Added support for the following devices: YunCore XD4200 and A782, TP-Link Archer C60 v1/v2, ALFA Network Quad-E4G and R36M-E4G, AVM FRITZ!Repeater 1200
Disable image generation for several devices due to insufficient flash space for the default set of packages. Images can still be built with the help of the ImageBuilder or SDK with a more minimal set of packages
When upgrading from 19.07.0-rc1, if you are affected by the sysupgrade bug, you need to manually edit /lib/upgrade/stage2 and add /usr/share/libubox/jshn.sh to list of files in the install_file line (around line 51).
Known issues:
Sysupgrade from ar71xx to ath79 and vice versa is not officially supported, a full manual reinstall is recommended to switch targets for devices supported by both ar71xx and ath79
Images for some device became too big to support a persistent overlay, causing such models to lose configuration after a reboot. If you experience this problem, please report the affected device and consider downgrading to OpenWrt 18.06 or using the Image Builder to pack a smaller custom image
Some optional GUI packages crash with an error about missing “cbi.lua”, install the luci-compat package to fix these
Possible Wi-Fi issues with ath10k-based boards. If you encounter such an issue, please file a bug report against openwrt-19.07.
https://openwrt.org/releases/19.07/notes-19.07.0-rc2
https://downloads.openwrt.org/releases/19.07.0-rc2/targets/

12

[Assistant]
Getting extreme jitter/latency (ping from router to device) when moving the pads (e.g. send a lot of packets I guess) on my Google Stadia controller which is connected via 5GHZ wifi. No problems whatsoever when using rc-1 nor when using usb cable instead of WIFI.
Can someone provide hints at what packages I should look first to try and pinpoint the issue as part of creating a bug report?
edit: device = wrt3200acm / wrt32x

1 Reply
1

I have the same problem of
@dynasticorpheus
This is a screnshot where i ping the stadia controller, connected to 5ghz wifi, from the router itself.
In red you can see ping spikes when i move pads on the controller.
No issues on OpenWrt 19.07.0-rc1 r10649-c4fdb377a2

1 Reply
1

Upgraded TP-Link WDR 4300 from RC1 to RC2. All looking fine atm.

1 Reply
2