From owner-freebsd-net@FreeBSD.ORG Mon May 1 09:12:20 2006 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A6BE716A401; Mon, 1 May 2006 09:12:20 +0000 (UTC) (envelope-from dimas@dataart.com) Received: from relay1.dataart.com (fobos.marketsite.ru [62.152.84.30]) by mx1.FreeBSD.org (Postfix) with ESMTP id 337D543D48; Mon, 1 May 2006 09:12:20 +0000 (GMT) (envelope-from dimas@dataart.com) Received: from e1.universe.dart.spb ([192.168.10.44]) by relay1.dataart.com with esmtp (Exim 4.22) id 1FaUS2-000Fp9-DU; Mon, 01 May 2006 13:12:18 +0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 1 May 2006 13:10:55 +0400 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: ALTQ on GIF Interface - how much trouble to impliment? thread-index: AcZsx2PN/GaEvc52T6uBwdqTePzFewANcz+Q From: "Dmitry Andrianov" To: "J. Buck Caldwell" , , Cc: Subject: RE: ALTQ on GIF Interface - how much trouble to impliment? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 May 2006 09:12:20 -0000 Well, I'm not sure FAQ will help you because you probably aready read it. But since you ask these things... :=3D) ... I suppose you need to = use traffic queueing on your internal (LAN) interfaces. http://www.openbsd.org/faq/pf/queueing.html has examples of doing that. Also, http://www.openbsd.org/faq/pf/tagging.html has examples of using tagging. But the general idea is straightforward: pass in on $int_if to $central_office_net tag VPN keep state pass in on $int_if to $central_office_net proto tcp tag port { 80, 443 } VPN_HTTP keep state pass in on $int_if to $central_office_net proto tcp tag port { 3306, 1443 } VPN_DB keep state ... pass in on $int_if tagged VPN_HTTP keep state queue XXX pass in on $int_if tagged VPN_DB keep state queue YYY pass in on $int_if tagged VPN keep state queue XXX I think limiting "out" traffic on internal interface is meaningless - I would limit it as "in" traffic on another VPN endpoint instead. -----Original Message----- From: owner-freebsd-pf@freebsd.org [mailto:owner-freebsd-pf@freebsd.org] On Behalf Of J. Buck Caldwell Sent: Monday, May 01, 2006 6:33 AM To: freebsd-pf@freebsd.org; freebsd-net@freebsd.org Subject: ALTQ on GIF Interface - how much trouble to impliment? I'm in desperate need to do some traffic prioritization using pf and ALTQ over a GIF tunnel. I asked this question some time ago on freebsd-stable, and was told to use tags - but either I'm doing it wrong, or it just doesn't work (probably, I'm doing it wrong). Either way, supporting ALTQ over GIF would be a far preferable solution. Here's the problem. I have a corporate office with a 4.5mb/sec connection, and several branches with 3m-down/768k-up cable connections. Each endpoint has a FreeBSD 5.4 or 6.x (migrating all to 6.x) box providing NAT, DNS, DHCP etc - and connecting to the other endpoints via GIF tunnels, encrypted point-to-point with IPSec. While prioritizing the actual tunnel traffic (via "pass out quick on $ext_if queue(gif_out, pri_out) proto { ipencap, esp } all keep state") does actually send the GIF/IPSEC traffic out at a higher priority, what I need to do is to actually prioritize the traffic inside the tunnel. For example - the tunnel carries between the branches and the corporate office, such as Lotus Notes, telnet/ssh sessions, and database queries.=20 What I need to do is prioritize the traffic so that, say, Notes traffic goes out before Web traffic, but the database traffic is highest priority (just under empty ACKs and such). Currently, ALTQ support is not available in the GIF interface driver.=20 How difficult would it be to implement? I've done a little reading of the man pages and source code, and while I am a decent Windows programmer (C, not visual basic, get that look off your face), I've never done any coding for FreeBSD, and wouldn't know quite where to start. If this is something that can be done relatively easily, I would be willing to test, and possibly to help code, but I'll need pointers.=20 Otherwise, I'd love to get some help on figuring out how tagging works so I can get it operating correctly. _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"