WG Server test with flowcache bypass

[ColinTaylor]

This is Wi-Fi 5 2-stream client to Ethernet NAS on my AX86U with Runner and Flow Cache disabled (Bandwidth Limiter enabled):

View attachment 47356

It's about 500Mbps in normal Wi-Fi environment with some activity on the same channels. Seems about right to me, not bad.

You'd only notice it if you're using a wireless client that's normally able to saturate the GbE LAN connection. Here's my ax client saturating the link:

 

[Tech9]

How much impact Flow Cache disabled has on LAN/WLAN transfers? Is it Flow Cache only or Runner disabled as well like in Cake, Traditional QoS, Bandwidth Limiter? I never noticed this issue indeed.

 

[sfx2000]

How much impact Flow Cache disabled has on LAN/WLAN transfers? Is it Flow Cache only or Runner disabled as well like in Cake, Traditional QoS, Bandwidth Limiter? I never noticed this issue indeed.

It shouldn't have any impact to LAN side traffic, either wireless or ethernet as this is all layer 2 traffic thru the switch, and shouldn't hit runner...

 

[Tech9]

I know, but we are discussing some bug discovered in this particular AX86U router model.

 

[ColinTaylor]

How much impact Flow Cache disabled has on LAN/WLAN transfers? Is it Flow Cache only or Runner disabled as well like in Cake, Traditional QoS, Bandwidth Limiter? I never noticed this issue indeed.

I can't put my finger on exactly what causes the problem. Simply running runner disable doesn't seem to cause the issue. In theory QoS (Cake or otherwise) ought not to have any impact at all but yet it seems it does. I admit that logically none of this makes sense so I can only assume there's some other factor in play that I'm not aware of.

I'm not really in a position to do any more testing with this so I'll have to leave it to others if they're interested.

 

[Morris]

You'd only notice it if you're using a wireless client that's normally able to saturate the GbE LAN connection. Here's my ax client:
View attachment 47358

896 Mb/sec. That's close to 1-Gb on WiFi...

Looks like you have demonstrated that there is no issue.

 

[ColinTaylor]

896 Mb/sec. That's close to 1-Gb on WiFi...

Looks like you have demonstrated that there is no issue.

I was demonstrating to @Tech9 (see post #60) what it looks like when there's isn't a problem. When there is a problem the throughput drops to about 80% of that. As I said in my last post I'm not in a position to test this any more as this is my primary router, but @supe has posted all the relevant information before.

 

[Tech9]

Yes, thank you. It never crossed my mind something WAN related may affect LAN to LAN/WLAN throughput.

 

[hancox]

If flowcache were enabled, Adaptive QOS code would not see the traffic and would do nothing.

Release - Asuswrt-Merlin 388.1 is now available for all supported Wifi 6 models

Still having random reboots from the kernel panic bug on my AX86U, anyone got a solution on what to do? Thats quite bad something causing your router to be unstable hardware/software failure

www.snbforums.com

Guessing fc, at least interacts, if not is required by, nat acceleration. I could have confused the 2, though. However, disabling fc after enabling Adaptive QoS fixes the issue on the AX86U, of throttled speeds.

 

[Morris]

Release - Asuswrt-Merlin 388.1 is now available for all supported Wifi 6 models

Still having random reboots from the kernel panic bug on my AX86U, anyone got a solution on what to do? Thats quite bad something causing your router to be unstable hardware/software failure

www.snbforums.com

Guessing fc, at least interacts, if not is required by, nat acceleration. I could have confused the 2, though. However, disabling fc after enabling Adaptive QoS fixes the issue on the AX86U, of throttled speeds.

When you do this, is QOS working properly? Overload your WAN link with lots of downloads and then try streaming a few 4K sources. Any stutter?

 

[hancox]

When you do this, is QOS working properly? Overload your WAN link with lots of downloads and then try streaming a few 4K sources. Any stutter?

It "works" in that it correctly segments traffic. It just throttles the download bandwidth to ~300Mbps, which defeats the purpose of using Adaptive. Cake can hit this, and with less hassle, without hardware acceleration

 

[Morris]

It "works" in that it correctly segments traffic. It just throttles the download bandwidth to ~300Mbps, which defeats the purpose of using Adaptive. Cake can hit this, and with less hassle, without hardware acceleration

I don't know why anyone would use any QOS that CAKE. All the others are an exercise in frustration.

 

[Tech9]

I have actually tested Cake QoS and Bandwidth Limiter on a common Cable ISP connection and both produce very similar results. As long as the ISP line (with already QoS applied) is not saturated there is no bufferbloat and the latency stays low. For up to 300Mbps ISP lines Bandwidth Limiter is a good option for stock Asuswrt users. It can also be applied to a group of high bandwidth devices only by using DHCP reservations and Target group.

 

[hancox]

I don't know why anyone would use any QOS that CAKE. All the others are an exercise in frustration.

that's the frustration - anyone over ~300Mbps can choose to either use no QoS, or reduce their bandwidth.

If I had <300, Cake would be my choice too.

 

[rkk2025]

I'm on AsusWRT Merlin 386.7_2 and I have both Runner and Flow Cache HW Acceleration enabled while I have Wireguard running in a site-to-site setup + a couple of single peers to connect to my LAN from the outside if necessary. I did have to modify the Wireguard "amtm" script to prevent it from disabling the HW acceleration, and so far I had no issues whatsoever (No disconnections nor speed issues).

Without going too much off topic, could @RMerlin or somebody with some insight into this matter explain why HW offloading is causing issues with Wireguard running on the router? What's the difference or incompatibility with running Wireguard with all hardware acceleration enabled vs having it bypassing the flowcache?

Is it some kind of security risk I'm exposing myself to by having HW acceleration enabled? Or is it just a speed penalty? (I did a couple of IPerf speed tests and I do not see the speed penalty, but I only have 60MBit of upload speed with my ISP)

 

[ZebMcKayhan]

could @RMerlin or somebody with some insight into this matter explain why HW offloading is causing issues with Wireguard running on the router?

I would be interested in this explanation as well.
My conclusion of the issue is NAT that takes place to and/or from a local process. From a system perspective we could compare Wireguard to dnsmasq (or Unbound / AGH). Both are local processes in the router. Both recieves packets from lan and creates a new packet that goes out WAN. And apparantly Wireguard runs just fine with both flowcache and runner enabled just like dnsmasq when it does exactly like this as in your site2site configuration.
Based on this simple reasoning I would like to believe that it is when you start to do SNAT on a package going to and/or from a local process. DNSDirector currently performs DNAT to dnsmasq which appears fine so the problem may only be related to SNAT (MASQUARADE).

So as wireguard is basically speed limited by routers ability to perform SNAT in software it would be interesting to find out exactly what makes the incompatability. For Example a Wireguard server peer on the router wouldnt NEED snat (altough its convenient) so I wonder which speeds could be reached then?? And for all those out there running server peers without nat, could they enable fc/runner again?

There were also another remark from someone that it was caused by packet transaction to/in kernel space (dont know if dnsmasq is in kernel or user space) so there could be more to the story but it wouldnt go well with the fact that wg site2site works perfectly with fc and runner enabled.

By the way, WireguardManager dont disable FC automatically anymore on any router, its up to the userconfig. So you shouldnt have to hack the script anymore.

 

[heysoundude]

@Morris nice explanation... but IMO this misunderstanding is going to become more & more common place as 1G ISP connections become the new normal.
And here's the rub.... most people don't really need the additional speed. Of course newer technology keeps finding uses that gobble up more & more bandwidth...
Streaming SD-Video... (No no no) You need HD-Video... hmmm maybe we do... But 4K-Video (a need... Not really).

1Gbps availability IS the new normal- my local cable provider has been offering 1Gb/30Mb FTTN at the same price as my 50/10 DSL for the past 6mo, and I can't say I've not struggled with temptation...but while my DL speed would 20x, why is my upload only 3x?

if you think 4k-HDR-Atmos is too much, wait until you've tried AR...the bubbles are coming for you, and AI will customize it to you. Soma would say it's a Brave New World...

 

[jsbeddow]

..the bubbles are coming for you,

Do you mean Rover? Was that a reference to The Prisoner (Patrick McGoohan spy series from the '60s)? If so, are you #6 or #2 ?
Sorry for the off topic post.

 

[heysoundude]

So as wireguard is basically speed limited by routers ability to perform SNAT in software it would be interesting to find out exactly what makes the incompatability.

<devil horns on>

Support of IPv4?

 

[heysoundude]

Do you mean Rover? Was that a reference to The Prisoner (Patrick McGoohan spy series from the '60s)? If so, are you #6 or #2 ?
Sorry for the off topic post.

not familiar..so, no.