Telephones across several branches are rarely complicated in terms of addresses and almost always complicated in terms of expectations. A VLAN of their own keeps it tidy; priority makes it better inside your own router; and the moment the phone system lives at a provider, your influence stops at the front door.
The VLAN
Take one row in the site's VLAN table for voice. The number is the same everywhere, the address differs per location because each location on the network board has its own address range.
| VLAN | Used for | Isolated | Internet | Head office | Branch Zwolle |
|---|---|---|---|---|---|
| 10 | Workstations | no | yes | 10.10.10.0/24 | 10.21.10.0/24 |
| 50 | Handsets | no | yes | 10.10.50.0/24 | 10.21.50.0/24 |
Do not mark voice as isolated. An isolated VLAN may only reach the WAN interfaces, and in the generated configuration a site tunnel counts as LAN. With the phone system at the head office, the handsets in the branch could never reach it. If you do want separation, use the matrix under Firewall and tick per network what is allowed.
The desk socket
The classic arrangement is a phone with a pass-through socket: the handset hangs on the switch port and the PC hangs behind the handset. The phone tags its own traffic with the voice VLAN and passes the PC's traffic through untagged. That port is a trunk with an untagged VLAN underneath.
The tool can do this, but not from the board. Set a port to trunk on the board and it tags every VLAN in the site and leaves no untagged network. For a desk port you do it in the device itself:
- Click the switch in the site and open the VLANs section.
- Find the port in the port assignment and set the mode to trunk.
- Choose the workstation VLAN, 10, as the untagged VLAN (pvid).
- Under VLAN membership tick 50 only. The pvid does not belong there: it leaves untagged by definition.
In the script that becomes a bridge port with frame-types=admit-all, pvid=10 and ingress filtering on, plus an entry in the bridge VLAN table with VLAN 10 untagged and VLAN 50 tagged on that port. Check it after pasting with /interface bridge vlan print.
Ports you connected to another device with a cable on the board become trunks with every VLAN tagged and no untagged network. That is exactly right for uplinks between switches and exactly wrong for a desk port. Use the board for the uplinks and the device's own port assignment for the workstations.
Priority: what the tool writes
Set QoS to Priorities via queue tree and the tool builds two things. First, mangle rules that decide once per connection what it is: DSCP 46 (EF) and 34 (AF41) for voice and video, UDP 5060 and 5061 for SIP, and small UDP packets in the RTP range 10000 to 20000. That decision is taken on the first packet and stored as a connection mark; after that it is one comparison per packet. This is deliberate: the older pattern, which examined every packet again, brought a hAP ac to its knees.
Then a queue tree with three classes per direction. Voice gets priority 1 and a guaranteed share of the line: ten percent of the download and twenty percent of the upload. The rest may borrow up to the full line rate. Enter a download and upload figure slightly below your real line speed, roughly 90 to 95 percent, or the modem holds the queue instead of the router and the priorities do nothing.
What QoS cannot do
- Steer incoming traffic. Your download queue only works because the router itself stays below the line rate. If the congestion sits at your provider, there is nothing to manage.
- Shape two uplinks at once. The upload queue hangs on the first WAN interface. With a second line the tool says so: that second line is not shaped. Once failover switches over, you have no priority.
- Prioritise over the tunnel. The queues hang on the bridge and on WAN, not on a tunnel interface. Traffic towards a phone system at the head office is caught on the uplink because it passes there, but there is no separate queue for the tunnel.
- Set DSCP. The rules read DSCP, they do not write it. If your handset or phone system marks nothing, only the match on SIP and on small UDP packets is left. So set DSCP on the handsets, or add a mangle rule of your own.
- Run for free. QoS switches FastTrack off. On the older generation (hAP ac, hEX and relatives) that puts the router somewhere around 200 to 300 Mbit/s regardless of what you type; the tool warns about it from 200 Mbit/s and suggests CAKE or fq_codel as the lighter alternative.
The ordinary limits are per LAN, not per VLAN: the queue's target is the bridge. To give the voice network a queue of its own, put its subnet in the Limits per host/network list with priority 1.
When the phone system lives at the provider
With a hosted phone system every call crosses the uplink. What you can still do, in the order that it helps:
- Keep the upload below the line rate and give voice priority 1. This is the one measure that genuinely does something.
- Ask the provider which ports and addresses the phone system uses, and narrow the RTP range in the mangle rules to that range if you need to.
- No double NAT. A provider box in front that also does NAT breaks SIP in ways nobody wants to debug; see Double NAT.
- Break out locally per branch. Sending calls through the tunnel to the head office and onto the internet there is twice the latency and one more thing that can fail.
Further reading: Keep phone calls clear when the line is busy, QoS and bandwidth and VLANs.