Shape a link with CAKE#

You will end up with a CAKE queue on one interface's egress, sized just below the link's real capacity, which is what stops a single upload from adding half a second of latency to everything else.

Before you start#

The operator role and a licence.
A measured upload speed. Not the number on the contract — run a speed test with nothing else using the link and use what you actually get.
The interface to shape. This is the uplink, and CAKE is attached to its egress.

What the editor writes, and what it does not#

Step 1 — Set the bandwidth#

Network → QoS, then the interface, or New CAKE policy.

set qos policy cake WAN-OUT bandwidth 70mbit
set qos policy cake WAN-OUT flow-isolation dual-src-host
set qos policy cake WAN-OUT rtt 100
set qos interface eth1 egress WAN-OUT

Set the bandwidth below what the link really does — commonly 90 to 95 per cent. The whole mechanism depends on the queue being on this router rather than in the provider's equipment, and it only is if this router is the bottleneck. A shaper set to exactly the link speed shapes nothing.

Step 2 — Choose the flow isolation#

dual-src-host is the editor's default and is right for most home and small-office links: it shares fairly between hosts first and between flows within a host second, so one machine with forty connections cannot take forty shares.

The value is passed through to CAKE, so the isolation modes VyOS accepts are the ones you can put here.

Step 3 — Set the RTT#

100 milliseconds is the editor's default and suits a typical internet path. Raise it for a satellite or long-haul link; lowering it on a high-latency path makes CAKE too aggressive and costs throughput.

Step 4 — Commit, then measure#

Check it worked#

The kernel installed what the configuration declares. This is the point of the QoS page: it shows the attached policy beside the qdisc the kernel actually installed. They can disagree — a policy that failed to attach, or a qdisc something else set — and the page says so rather than showing you your own configuration back.

bash

tc qdisc show dev eth1

Latency under load moved. The honest test, and the only one that matters:

Measure idle latency to something a few hops away.
Start a large upload.
Measure again.

Without shaping, the second number is typically hundreds of milliseconds worse. With CAKE sized correctly, it should barely move. If it does not improve, the bandwidth figure is too high — the queue is still in the provider's equipment.

What is not here#

Shaping inbound traffic on the router only drops what has already crossed the uplink, which is why the OPNsense importer translates the upload pipe and names the download pipe in its report rather than translating it.

Undoing it#

delete qos interface eth1

The panel's Detach stages exactly that, which removes the attachment and leaves the policy defined. Removing the policy as well:

delete qos policy cake WAN-OUT