docs: egress shaping on the home host #414

Merged

mysticalsoap merged 1 commit from docs/egress-shaping into trunk

2026-10-08 17:29:27 -04:00

mysticalsoap commented

2026-10-08 17:24:04 -04:00

Owner

Problem

A sustained upload from this host filled the ISP modem's queue and collapsed the link for every LAN device (#156). Nothing host-side shaped the uplink, and until #412 nothing could even see it.

Fix

Host-level, in dotfiles (system/NetworkManager/dispatcher.d/50-shape-enp5s0, installed root-owned, runs on every link-up): HTB root on enp5s0 with an unshaped LAN class and a 38 Mbit WAN class, CAKE diffserv4 nat wash under the WAN class, and one nft rule in its own inet shaper table setting DSCP LE on gluetun's outer WireGuard flow so it files in Bulk. This PR is the docs page for it: layout, why HTB rather than a root CAKE, why an nft table rather than mangle, how to verify.

Verification

Measured 2026-10-08 from the raw link (curl --interface enp5s0, 75 MB to Cloudflare's upload endpoint, ping -I enp5s0 1.1.1.1 concurrently):

	idle	loaded, before	loaded, after
RTT avg	14 ms	27 ms	12.6 ms
RTT max	18 ms	54 ms	17.7 ms
NIC tx		41 Mbit/s	36 Mbit/s

CAKE tin counters: gluetun bytes in Bulk, the upload in Best Effort; Bulk grew by 5 MB during the 19 s test where its prior rate would have been ~28 MB, so it yielded.
HTB class 1:1 counts router pings; class 1:10 counts everything WAN-bound. Four u32 filters present.
Script dry-run in an unprivileged netns on a dummy enp5s0 before the root install.

Closes #156

🤖 Generated with Claude Code

## Problem A sustained upload from this host filled the ISP modem's queue and collapsed the link for every LAN device (#156). Nothing host-side shaped the uplink, and until #412 nothing could even see it. ## Fix Host-level, in dotfiles (`system/NetworkManager/dispatcher.d/50-shape-enp5s0`, installed root-owned, runs on every link-up): HTB root on enp5s0 with an unshaped LAN class and a 38 Mbit WAN class, CAKE `diffserv4 nat wash` under the WAN class, and one nft rule in its own `inet shaper` table setting DSCP LE on gluetun's outer WireGuard flow so it files in Bulk. This PR is the docs page for it: layout, why HTB rather than a root CAKE, why an nft table rather than mangle, how to verify. ## Verification Measured 2026-10-08 from the raw link (`curl --interface enp5s0`, 75 MB to Cloudflare's upload endpoint, `ping -I enp5s0 1.1.1.1` concurrently): | | idle | loaded, before | loaded, after | |---|---|---|---| | RTT avg | 14 ms | 27 ms | 12.6 ms | | RTT max | 18 ms | 54 ms | 17.7 ms | | NIC tx | | 41 Mbit/s | 36 Mbit/s | - CAKE tin counters: gluetun bytes in Bulk, the upload in Best Effort; Bulk grew by 5 MB during the 19 s test where its prior rate would have been ~28 MB, so it yielded. - HTB class 1:1 counts router pings; class 1:10 counts everything WAN-bound. Four u32 filters present. - Script dry-run in an unprivileged netns on a dummy enp5s0 before the root install. Closes #156 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap added 1 commit

2026-10-08 17:24:04 -04:00

docs: egress shaping on the home host

validate / validate (pull_request) Successful in 21s

Details

62bce3780a

The shaper itself is a NetworkManager dispatcher script in dotfiles;
this is the page that says why it exists, how it is laid out and how
to tell it is working. Measurements and the alternatives rejected are
in the dotfiles commit and on #156.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mysticalsoap merged commit 390db2bb33 into trunk

2026-10-08 17:29:27 -04:00

mysticalsoap deleted branch docs/egress-shaping

2026-10-08 17:29:27 -04:00

mysticalsoap referenced this pull request from a commit

2026-10-08 17:29:27 -04:00

Merge pull request 'docs: egress shaping on the home host' (#414) from docs/egress-shaping into trunk

mysticalsoap referenced this pull request

2026-10-08 17:55:26 -04:00

monitoring: ICMP probe of the WAN link from the physical interface #415