We have several CCR's in production now, and have been quite happy with their performance in handling large amounts of PPPOE connections and routed traffic.
In our early years, we have some very details QoS rules that we ran to keep bandwidth usage under control, however as time went on we ended up turning the rules off to save CPU power and just bought more bandwidth.
We are now passing at peak 600Mbps/200Mbps though our 'firewall' router and onto our border router (both CCR's)
We have a LNS at every main tower site now, ranging in models depending on the amount of connections at each site, but most have been upgraded to CCR's now.
Here is my problem, When I enable my 200 mangle rules on my firewall router (all it normally does is firewall our network and act as a router for a bunch of IP ranges) [normal CPU load is 1-3%]. the entire thing locks up and dies... 100% CPU load and I am unable to winbox into it even locally plugged into a management interface. We need to physically isolate it from our network disable the mangle rules and then reconnect it. - this is BAD.
note: This is with JUST the mangle rules enabled, the Queue tree is still disabled at this time
The very same rules I have on a LNS (CCR) with 120 PPPOE tails, and it works fine. there is a big difference in traffic though.
Out of my 200 Mangle rules I have 130 Layer 7 rules. (could this be my issue)
Some of the rules are for IP lists with maybe 20-30 IP ranges
the remaining rules are ports.
The setup I use, we mark a connection and have each category in its own chain, we then mark the packets and jump to the next chain:
Example p2p marks:
Code: Select all
add action=mark-connection chain=p2p comment="ALL p2p" disabled=yes new-connection-mark=p2pC p2p=all-p2p
add action=mark-connection chain=p2p comment="P2P - Layer7" disabled=yes layer7-protocol=P2P-bittorrent new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=torrent-wwws new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=torrent-dns new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-kugoo new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-jabber new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-ares new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol="P2P-bittorrent II" new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol="P2P-bittorrent III" new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-100bao new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-applejuice new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-audiogalaxy new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-directconnect new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-fasttrack new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-freenet new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-gnucleuslan new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-imesh new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-gnutella new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-goboogy new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-hotline new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-mute new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-napster new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-openft new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-poco new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-soribada new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-tesla new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-thecircle new-connection-mark=p2pC
add action=mark-connection chain=p2p disabled=yes layer7-protocol=P2P-xunlei new-connection-mark=p2pC
add action=mark-packet chain=p2p comment="p2p Download > Flow" connection-mark=p2pC disabled=yes in-interface="GbE6 - Internet comes from here" new-packet-mark=p2pFlow-download passthrough=no
add action=mark-packet chain=p2p comment="p2p Upload > Flow" connection-mark=p2pC disabled=yes new-packet-mark=p2pFlow-upload passthrough=no
add action=jump chain=prerouting comment=p2p disabled=yes jump-target=p2p
So while my CCR may be pushing around 250k pps across all interfaces with a total throughput of about 600/200 Mbit should a CCR be able to handle and mark packets for QoS?. what can I do to solve this issue as QoS would be nice to have again, save me having to buy more transit.
Note:
I have also tried to enable the rules on a router with only 200Mbit of traffic and the same crash occurs
Thanks.
