From owner-freebsd-net@FreeBSD.ORG  Wed Jul 28 21:48:37 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 364A716A4CE
	for <freebsd-net@freebsd.org>; Wed, 28 Jul 2004 21:48:37 +0000 (GMT)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
	[212.227.126.186])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 988E243D2F
	for <freebsd-net@freebsd.org>; Wed, 28 Jul 2004 21:48:36 +0000 (GMT)
	(envelope-from max@love2party.net)
Received: from [212.227.126.205] (helo=mrelayng.kundenserver.de)
	by moutng.kundenserver.de with esmtp (Exim 3.35 #1)
	id 1BpwHW-0005NP-00; Wed, 28 Jul 2004 23:48:14 +0200
Received: from [84.128.138.215] (helo=donor.laier.local)
	by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128)
	(Exim 3.35 #1)
	id 1BpwHV-0007Ho-00; Wed, 28 Jul 2004 23:48:14 +0200
From: Max Laier <max@love2party.net>
To: freebsd-net@freebsd.org
Date: Wed, 28 Jul 2004 23:46:06 +0200
User-Agent: KMail/1.6.2
References: <41081955.5090204@schluting.com>
In-Reply-To: <41081955.5090204@schluting.com>
MIME-Version: 1.0
Content-Type: multipart/signed;
  protocol="application/pgp-signature";
  micalg=pgp-sha1;
  boundary="Boundary-02=_k6BCBGtCo3x0Re0";
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <200407282346.12412.max@love2party.net>
X-Provags-ID: kundenserver.de abuse@kundenserver.de
	auth:61c499deaeeba3ba5be80f48ecc83056
cc: Charlie Schluting <charlie@schluting.com>
Subject: Re: packet order, ipf or ipfw
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Jul 2004 21:48:37 -0000


--Boundary-02=_k6BCBGtCo3x0Re0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Wednesday 28 July 2004 23:23, Charlie Schluting wrote:
> Hello..
>
> I'm running ipf because I like it ...but now I need to use ipfw's pipe
> feature. I was thinking that I could just run both, and keep all my
> rules in ipf, then in ipfw: limit bandwidth for a few vlans, then allow
> all.
>
> It didn't work (no rate-limiting happened).. and I'm thinking that ipf
> is passing the packets and bypassing ipfw? Or something..
>
> So, what is the order, if I'm running ipf AND ipfw at the same time?
> Will it work at all in this manner?

On the output path (which is the only meaningful for bandwidth limitation) =
the=20
order is:
	PFIL_HOOKS (=3D=3D ipf / pf) before
	ipfw

Note however, that ipfw will see translated packets! i.e. if you have any=20
translation/NAT/redirect rules in ipf you need to account for that with you=
r=20
ipfw rules.

Another alternative (on FreeBSD-current) would be pf+ALTQ, btw ;)

=2D-=20
/"\  Best regards,			| mlaier@freebsd.org
\ /  Max Laier				| ICQ #67774661
 X   http://pf4freebsd.love2party.net/	| mlaier@EFnet
/ \  ASCII Ribbon Campaign		| Against HTML Mail and News

--Boundary-02=_k6BCBGtCo3x0Re0
Content-Type: application/pgp-signature
Content-Description: signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQBBCB6kXyyEoT62BG0RAjq6AJ9PUcHLf2Jw8i5KCyIezhZdPWo7pwCdFW9g
3/eQj7sJpyuwebYw7HgtXLo=
=6Q3v
-----END PGP SIGNATURE-----

--Boundary-02=_k6BCBGtCo3x0Re0--