coova-chilli: Download Speed Capped at 40-50 Mbps with CoovaChilli on OpenWrt 23.05.5 (MT7621 + xt_coova)

Issue: CoovaChilli Performance and Errors with xt_coova on OpenWrt 23.05.5

Setup Details

• CoovaChilli Version: 1.6
• Platform: OpenWrt 23.05.5
• Architecture: MT7621
• Firewall: firewall3 + iptables_zz_legacy
• Additional Support: xt_coova
• ISP Speed: 100 Mbps (Real-world)

Problem 1: Speed Capping on Download

When performing a speed test via CoovaChilli:

• Download Speed: 30-40 Mbps (tested using Ookla)
• Upload Speed: 100 Mbps (matches ISP speed)
• On the regular network (without CoovaChilli), both download and upload speeds match the ISP-provided 100 Mbps.

Additional Testing

Performed an iperf test:

• Setup: Iperf server on one CoovaChilli client, Iperf client on another CoovaChilli client.
• Result: Download and upload speeds via CoovaChilli WAN were approximately 300-400 Mbps, indicating no bottleneck in internal data flow.

---

Problem 2: Errors When Using kname="chilli"

After setting kname="chilli" in the configuration, the following errors are observed in the logs:

Tue Jan  7 10:47:43 2025 daemon.err chilli[8361]: chilli[8361]: PID 8361 reloaded binary options file
Tue Jan  7 10:47:43 2025 daemon.info chilli[8361]: CoovaChilli 1.6. Copyright 2002-2005 Mondru AB. Licensed under GPL. Copyright 2006-2012 David Bird (Coova Technologies). Licensed under GPL. See http://coova.github.io/ for details.
Tue Jan  7 10:47:43 2025 daemon.info chilli[8361]: TX queue length set to 100
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.445245] device br-network4 entered promiscuous mode
Tue Jan  7 10:47:43 2025 daemon.err chilli[8361]: No such file or directory: could not open /proc/net/coova/chilli
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.605612] xt_coova: looking for chilli
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.609731] xt_coova: created chilli refcnt=1
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.614072] xt_coova: match ret=0
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.632326] xt_coova: looking for chilli
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.636280] xt_coova: found chilli refcnt=2
Tue Jan  7 10:47:43 2025 kern.info kernel: [  204.640524] xt_coova: match ret=0
Tue Jan  7 10:47:43 2025 daemon.err chilli[8361]: bad idx (-1)
Tue Jan  7 10:47:43 2025 daemon.warn chilli[8361]: RADIUS id 0 was not found in queue!
Tue Jan  7 10:47:52 2025 kern.info kernel: [  213.969309] seq_file: buggy .next function 0x835ee0d8 did not update position index
Tue Jan  7 10:47:53 2025 kern.info kernel: [  214.978726] seq_file: buggy .next function 0x835ee0d8 did not update position index
Tue Jan  7 10:47:54 2025 kern.info kernel: [  215.988028] seq_file: buggy .next function 0x835ee0d8 did not update position index

---

Problem 3: Upload Speed is Unlimited, Bandwidth Limitation Not Working

• Observation: Upload speeds through CoovaChilli are now unlimited and match the ISP-provided speed (100 Mbps). However, any bandwidth limit (set manually or from RADIUS) for the upload is ignored.
• This issue occurs even when download bandwidth limitations are applied correctly.
• No errors appear in the logs specific to this problem, but the bandwidth control feature for uploads seems to be bypassed.

---

Configuration Details

Custom up.sh Script changes for xt_coova:

set_xt_coova_rules() {
    case $TUNTAP in
        "tun1") NETWORK_RANGE="172.21.100.0/24" ;;
        "tun2") NETWORK_RANGE="172.22.100.0/24" ;;
        "tun3") NETWORK_RANGE="172.23.100.0/24" ;;
        "tun4") NETWORK_RANGE="172.24.100.0/24" ;;
        *) echo "Unknown TUNTAP device: $TUNTAP"; return ;;
    esac
    ipt -I FORWARD -o wan --src $NETWORK_RANGE -m coova --name chilli -j ACCEPT
    ipt -I FORWARD -i wan --dst $NETWORK_RANGE -m coova --name chilli --dest -j ACCEPT
    ipt -I FORWARD --src $NETWORK_RANGE -j ACCEPT
    ipt -I FORWARD --dst $NETWORK_RANGE -j ACCEPT
}
run_up() {
    if [ -n "$TUNTAP" ]; then
        if [ "$KNAME" != "" ]; then
            ipt -I FORWARD -i $DHCPIF -m coova --name $KNAME -j ACCEPT 
            ipt -I FORWARD -o $DHCPIF -m coova --name $KNAME --dest -j ACCEPT
        fi
        set_xt_coova_rules
    fi
    [ -e /etc/chilli/ipup.sh ] && . /etc/chilli/ipup.sh
}

Chilli Configuration:

tundev="tun4"
net="172.24.100.0/24"
dynip="172.24.100.0/24"
dns1="8.8.8.8"
dns2="8.8.4.4"
ipup="/etc/chilli/up.sh"
ipdown="/etc/chilli/down.sh"
radiusserver1="x.x.x.x"
radiusserver2="x.x.x.x"
radiussecret="xxxxx"
dhcpif="br-network4"
uamserver="https://example.com"
uamlisten="172.24.100.1"
uamallowed="example.com"
uamdomain=".example.com"
wwwdir="/etc/chilli/www"
wwwbin="/etc/chilli/wwwsh"
radiusnasid="x-x-x"
kname="chilli"

@brada4 @sevan @pparent76 could you guys please look into this and help if you find anything wrong?

Start by reviewing the custom /etc/chilli/up.sh rules and the provided Chilli configuration, then reproduce the download, upload-limiting, and kname="chilli" log behavior on OpenWrt 23.05.5 with the stated MT7621 setup. Done means identifying the cause of the reported throughput, bandwidth-limit, and error symptoms and validating the result with equivalent speed tests and logs.