From owner-freebsd-security@FreeBSD.ORG Tue Feb 15 17:08:49 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8879816A4CE; Tue, 15 Feb 2005 17:08:49 +0000 (GMT) Received: from f23.mail.ru (f23.mail.ru [194.67.57.149]) by mx1.FreeBSD.org (Postfix) with ESMTP id A489843D49; Tue, 15 Feb 2005 17:08:48 +0000 (GMT) (envelope-from vip3r@inbox.ru) Received: from mail by f23.mail.ru with local id 1D16Br-000F4G-00; Tue, 15 Feb 2005 20:08:47 +0300 Received: from [194.105.194.164] by win.mail.ru with HTTP; Tue, 15 Feb 2005 20:08:47 +0300 From: Mikhail To: freebsd-security@freebsd.org Mime-Version: 1.0 X-Mailer: mPOP Web-Mail 2.19 X-Originating-IP: [194.105.194.164] Date: Tue, 15 Feb 2005 20:08:47 +0300 Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 8bit Message-Id: cc: freebsd-ipfw@freebsd.org Subject: weird queue keep-state behavior X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Mikhail List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Feb 2005 17:08:49 -0000 I'm just one of those weirdos, who wanna make a powerfull queues shaper (not QoS but near) with ipfw2 on their freebsd 4.x-stable. My server is using frequently used configuration with NAT+FW ADSL router with one external ip on external network interface (we're using ADSL modem in bringe mode). I've configured single pipe, configured queues to use that pipe, add queues with different weights distinct on destination ports. //i'm doing nat with that rules: 03400 divert 8668 ip from { 192.168.132.0/24,192.168.10.0/24,172.16.1.0/24,10.10.10.0/24 or me } to any out via bfe0 03600 divert 8668 ip from any to me in via bfe0 //here are defined queues 09600 queue 1 udp from me to any dst-port 53,123 out via bfe0 keep-state 09800 queue 2 tcp from any 1024-65535 to any out via bfe0 iptos lowdelay iplen 32-68 established 10000 queue 2 tcp from any 1024-65535 to any out via bfe0 iptos lowdelay established 10200 queue 2 tcp from any 1024-65535 to any out via bfe0 iptos lowdelay setup keep-state 10400 queue 3 tcp from any 1024-65535 to any dst-port 22,194,5190,23 out via bfe0 iplen 32-68 established 10600 queue 3 tcp from any 1024-65535 to any dst-port 22,194,5190,23 out via bfe0 established 10800 queue 3 tcp from any 1024-65535 to any dst-port 22,194,5190,23 out via bfe0 setup keep-state 11000 queue 4 tcp from any 1024-65535 to any dst-port 21,80,8080,443,8101,8081 out via bfe0 iplen 32-68 established 11200 queue 4 tcp from any 1024-65535 to any dst-port 21,80,8080,443,8101,8081 out via bfe0 established 11400 queue 4 tcp from any 1024-65535 to any dst-port 21,80,8080,443,8101,8081 out via bfe0 setup keep-state 11600 queue 5 tcp from any 1024-65535 to any out via bfe0 iplen 32-68 established 11800 queue 5 tcp from any 1024-65535 to any out via bfe0 established 12000 queue 5 tcp from any 1024-65535 to any out via bfe0 setup keep-state 12200 queue 6 udp from any 1024-65535 to any out via bfe0 keep-state 12400 allow tcp from any to 192.168.132.0/24,192.168.10.0/24,172.16.1.0/24,10.10.10.0/24 in via bfe0 established //last rule is for weird packets that natd is pushing to the stack When client is downloading file via passive ftp from nat'ed internal network he has ${ADSL_INBOUND_SPEED} speed (55KByte/s) Here is the problem: When i ssh'ing to server and starting the SAME connection with wget i'm having only 14KByte/s. Hitting many times "ipfw show" i've discovered that in the first case counters of 12000 rule are incrementing slowly and counters of rule 12400 are incrementing very fast. In the second case only counters of rule number 12000 are incrementing relative to the first case fast. So here is the question: Should I remove "keep-state" statement and use stateless firewall with adding "esatablished" rules or this is bug (that tracking state of data flow in queue in both directions is bad, because in that case we limiting speed of inbound connection and outbound too (last is desired)). Thanks beforehand. PS: I can post here my rc.firewall on demand or exec what you want me to exec.