3CX SBC - Set DSCP with nftables

[Gavino]

I noticed in the v20 Update 7 release notes that it says, "marked RTP traffic as high priority (TOS 46) ".

When I upgraded to v20 about a year ago, I was surprised that the latest SBC software doesn't set industry standard QoS markings. I got to work in nftables to mark packets with correct DSCP markings in my network (using industry standard codepoints), and I thought I'd share them with you (a year later), as I cannot see that anyone else has shared this, although there was an old post asking how to do it...

These are my rules for QoS on a 3CX SBC (Debian Linux 12 / Bookworm):

sudo nft add table inet qosmark
sudo nft add chain inet qosmark postrouting '{type filter hook postrouting priority filter; policy accept;}'
sudo nft add rule inet qosmark postrouting counter ip protocol udp udp sport 20000-20127 ip dscp set ef return
sudo nft add rule inet qosmark postrouting counter ip protocol udp udp sport 5060 ip dscp set cs3 return
sudo nft add rule inet qosmark postrouting counter ip protocol tcp tcp sport 5060 ip dscp set cs3 return
sudo nft add rule inet qosmark postrouting counter ip protocol udp udp dport 5090 ip dscp set ef return
sudo nft add rule inet qosmark postrouting counter ip protocol tcp tcp dport 5090 ip dscp set ef return
sudo nft add rule inet qosmark postrouting counter ip protocol udp udp dport 123 ip dscp set cs6 return

Before you paste that in, check if a table called "qosmark" is present already:

sudo nft list ruleset

If you munge something and want to start again:

sudo nft flush table inet qosmark     # flush table, so you can re-do the "rule" lines.
sudo nft delete table inet qosmark    # delete table... like it never happened.

List the qosmark table:

sudo nft -s list table inet qosmark    # config
sudo nft list table inet qosmark       # confing with counters  
sudo nft -S list table inet qosmark    # config with counters and port/proto/DSCP names

If you're happy with it and want it to persist, add the "sudo nft -s list table inet qosmark" output to /etc/nftables.conf. e.g.:

table inet qosmark {
        chain postrouting {
                type filter hook postrouting priority filter; policy accept;
                counter ip protocol udp udp sport 20000-20127 ip dscp set ef return
                counter ip protocol udp udp sport 5060 ip dscp set cs3 return
                counter ip protocol tcp tcp sport 5060 ip dscp set cs3 return
                counter ip protocol udp udp dport 5090 ip dscp set ef return
                counter ip protocol tcp tcp dport 5090 ip dscp set ef return
                counter ip protocol udp udp dport 123 ip dscp set cs6 return
        }
}

If the nftables service isn't enabled, then enable and start it:

sudo systemctl enable nftables
sudo systemctl start nftables

Reboot to see if the qosmark persists post-reboot. Also check QoS markings on the wire with wireshark - make sure it's doing what you want.
Some guides recommend putting "flush ruleset" as the first line in /etc/nftables.conf, but things have worked for me fine without that, so....
The other thing is to run "ss -tulpn" to check your ports. Your RTP media source ports should be 20000-20127/UDP. You might not need the 5060/TCP line. The NTP one (port 123) is optional, but I like to mark that as well.

If there is a much more efficient way to do this with connection tracking then please me me know.