QoS to give VPN priority

[klau1]

How do you prioritize PPTP traffic over other traffic ie: torrents?

Currently have a server that handles both but would like to prioritize VPN connections over torrents.

PPTP uses GRE Port 47 for data, but it's not TCP or UDP

DLINK gives several options TCP, UDP, ICMP, and Other in it's QoS Engine page.

How to prioritize this on a D-Link router?

 

[talion83]

Does the D-Link allow you to do it by IP? If so you could probably do it by giving high priority to the IP address(s) of the VPN.

You could also try doing it in reverse - set QoS rules in which specific traffic (ie: torrents) get lowest priority.

Ultimately part of the issue is that the VPN traffic is going over the same ports as all of your other traffic - VPN isn't port based (aside from the initial connection). So standard QoS rules won't apply in this case, unless your VPN device allows for QoS tagging.

 

[klau1]

Does the D-Link allow you to do it by IP? If so you could probably do it by giving high priority to the IP address(s) of the VPN.

Negative, it's a single NIC DC, with Torrent download and VPN Server

You could also try doing it in reverse - set QoS rules in which specific traffic (ie: torrents) get lowest priority.

Might just work, I'll have to try that!

Ultimately part of the issue is that the VPN traffic is going over the same ports as all of your other traffic - VPN isn't port based (aside from the initial connection). So standard QoS rules won't apply in this case, unless your VPN device allows for QoS tagging.

The VPN is run by Windows Server 2003 RRAS. Does RRAS have QoS tagging?

 

[talion83]

I'm not really sure regarding 2003 QoS, I recall the capabilities there not being very robust. I believe on 2008r2 you can specify by IP - not sure about 2003.

If you can do it by IP then that might be an easier way, as you should be able to set a specific range of IP's for your VPN connections.

So if your network is 192.168.1.x, Set the DHCP for the VPN to 192.168.200-210, then set a rule indicating that anything from 200-210 (you probably need to do each one individually) gets highest priority.

For IP it is normally under something like 'bandwidth control'. It is for bandwidth throttling but should serve the same purpose as it will prioritize the traffic similar to QoS - when there is congestion, the ones with the higher setting get priority. If there isn't congestion, then it really doesn't matter.

 

[klau1]

I'm not really sure regarding 2003 QoS, I recall the capabilities there not being very robust. I believe on 2008r2 you can specify by IP - not sure about 2003.

If you can do it by IP then that might be an easier way, as you should be able to set a specific range of IP's for your VPN connections.

So if your network is 192.168.1.x, Set the DHCP for the VPN to 192.168.200-210, then set a rule indicating that anything from 200-210 (you probably need to do each one individually) gets highest priority.

The IP address given by the RRAS VPN is internal existing only behind the RRAS NAT.

Just to clarify, the scenario setup is:

VPN Client --------- Internet --------- Router --------- VPN Server

The router (correct me if I'm wrong) only sees the packets as from the VPN server LAN IP, and the VPN Client's external IP, not the internal IP given by the VPN Server's NAT.

So if I were to assign any range (ie: 192.168.1.200-210) to VPN Clients, it would not matter to the QoS, since the router doesn't see these IPs.

For any VPN packets traveling between the server and client, the router would only see the Client's real IP and the Server's LAN IP. (again, I'm not entirely sure, so correct me if I'm wrong, but it seems reasonable to me)

So it's questionable whether IP based QoS is possible in this scenario.

For IP it is normally under something like 'bandwidth control'. It is for bandwidth throttling but should serve the same purpose as it will prioritize the traffic similar to QoS - when there is congestion, the ones with the higher setting get priority. If there isn't congestion, then it really doesn't matter.

There's is nothing like bandwidth control other than the QoS section on the Dlink.