Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 3 subscribers
  • Views 1617 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can you QoS by source IP when the traffic is coming through the web proxy?

Jon Lee

Hi,

We have recently installed a UTM SG330 v9.510-5 to replace an existing multi part system we were using.

We have one internal and one external interface.  We operate a transparent web proxy and are trying to use QoS rules to shape the traffic from 4 internal ip ranges within our internal subnet.  We use a network definition for each internal range, we then put those into 4 groups (along with a few other random IPs), we then use those groups to form 4 selectors and from there 4 bandwidth pools attached to our external interface (a low bandwidth Satellite connection 1mbps upload).

Using watch -n .2 'tc -s qdisc' from the shell access I can see activity within the QoS groups, but we do have a few other ports open outbound (default is drop) and I don't believe we're seeing the HTTP/HTTPS traffic from the machines in those ranges.  Which leads me to wonder whether the traffic, by the time it reaches the QoS section, is now only seeing the Proxy IP rather than the source client ip.  Our users have reported a slow down for them in the priority range and the personal range are suggesting an improvement which makes me also think the QoS'ing is not behaving as expected.

If my wondering is true, is there a way we can QoS the HTTP(S) traffic based on client ip?
If my wondering is false, what would be the best way to dig deeper and actually see outbound traffic and what QoS rules have been applied to it?

Appreciate any assistance or pointers.  Not a Linux person and new to some of these concepts, so might have easily made wrong assumptions! Found the command above from https://community.sophos.com/kb/en-us/115402 

Thanks in advance for any assistance you can offer.

Jon



This thread was automatically locked due to age.
Parents
  • +1

    Hi Jon and welcome to the UTM Community!

    You're right, you cannot QoS by original IP after the traffic has gone through Web Filtering.  Only Uplink Balancing can "see" the original IP.

    You can QoS the traffic with the original IPs if you create rules on the Internal interface instead of the External.

    I would not choose Limit Uplink/Downlink on the 'Status' tab unless you are paying based on volume.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob,

    Thanks so much for the reply and confirmation.

    We are using a Satellite connection and have a contractual rate and a maximum rate agreed with the supplier.  We must make every effort to average to our contractual rate but are able to burst the link at times when necessary.  Therefore it's on us to limit the link to the agreed 4mbps down and 1mpbs up.  Is there another place to achieve this or is the approach used above the correct place.

    Can I confirm you're suggesting that the rules attached to the internal interface would work to achieve the QoS balancing on the upload rate whilst still using the web filtering?  That seems like a simple enough change, or are there downsides to this approach?

    Thanks again for all the assistance you've given so many here and your 'rulz' as we studied those a lot as we designed our solution!

    Jon

  • 0 in reply to Jon Lee

    With the 'Limit' boxes checked, there can be no burst rate, Jon.

    It's more difficult to get desired results when doing QoS on the Internal interface, but just keep fiddling with it until you're close enough.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0 in reply to Jon Lee

    With the 'Limit' boxes checked, there can be no burst rate, Jon.

    It's more difficult to get desired results when doing QoS on the Internal interface, but just keep fiddling with it until you're close enough.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML