Shorewall VOIP Traffic Control Configuration

Jim Duda
Sat, 20 Jan 2007 01:33:58 -0000

I''m having troubles with my outbound VOIP connection.  I''m
convinced
that I don''t have QOS/traffic shaping configured properly in my
shorewall linux firewall, which serves as my Asterisk VOIP server and
Internet router/gateway.  I don''t have a separate router box.
I''ve been
using VOIP for about a year now, but just recently realized that I need
to setup QOS and traffic shaping through my firewall.  People
consistently tell me that my VOIP outbound service sucks.  I have
googled and googled and googled, but no definitive answer to my
questions.  I''m running Asterisk PBX software using the IAX protocol on
port 4569 to my VOIP provider.

linux# uname -a
Linux linux 2.6.18.1 #2 SMP Sat Oct 28 20:14:02 EDT 2006 i686 i686 i386
GNU/Linux

Do I have shorewall configured properly to prioritize VOIP traffic?

I have attached the status.txt.gz from shorewall dump.

What I believe are the relevant file entries are:

I''m not sure if I need the tos entries, I found these suggestions at
voip-info.org

/etc/shorewall/tos:
all     all             udp             4569            -               16
all     all             udp             5060            -               16
all     all             tcp             -               ssh             16
all     all             tcp             ssh             -               16
all     all             tcp             -               ftp             16
all     all             tcp             ftp             -               16
all     all             tcp             ftp-data        -               8
all     all             tcp             -               ftp-data        8
#

/etc/shorewall/tcdevices:
eth0            6000kbit        500kbit

tcclasses:
eth0            1       100kbit 180kbit    1
tos=0x68/0xfc,tos=0xb8/0xfc,tos=0x48/0xfc
eth0            2       full/4  full       2
tcp-ack,tos-minimize-delay
eth0            3       full/4  full       3            default
eth0            4       full/8  full*8/10  4
#

/etc/shorewall/tcrules:
1       0.0.0.0/0       0.0.0.0/0       udp     4569
1       0.0.0.0/0       0.0.0.0/0       tcp     4569
1       0.0.0.0/0       0.0.0.0/0       udp     5060
1       0.0.0.0/0       0.0.0.0/0       tcp     5060
2       0.0.0.0/0       0.0.0.0/0       icmp    echo-request
2       0.0.0.0/0       0.0.0.0/0       icmp    echo-reply
3       0.0.0.0/0       0.0.0.0/0       tcp     20
3       0.0.0.0/0       0.0.0.0/0       tcp     21
3       0.0.0.0/0       0.0.0.0/0       tcp     22
4       0.0.0.0/0       0.0.0.0./0      all     -       -       -       !0
#

These changes appear better, but certainly not MA BELL quality yet.  I
think it should be better still.

Thanks,

Jim