From owner-freebsd-pf@FreeBSD.ORG Thu Dec 1 16:28:32 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7746416A41F for ; Thu, 1 Dec 2005 16:28:32 +0000 (GMT) (envelope-from marceloc@espoltel.net) Received: from jupiter.espoltel.net (jupiter.espoltel.net [200.49.240.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1E85A43D5C for ; Thu, 1 Dec 2005 16:28:28 +0000 (GMT) (envelope-from marceloc@espoltel.net) Received: from hefesto ([69.65.149.194]) by jupiter.espoltel.net (8.12.10/8.12.10) with ESMTP id jB1GPUlH021812; Thu, 1 Dec 2005 11:25:31 -0500 Message-Id: <200512011625.jB1GPUlH021812@jupiter.espoltel.net> From: "Marcelo Celleri" To: "'Jon Simola'" Date: Thu, 1 Dec 2005 11:27:40 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: AcX2C9/QmaqhbXccSMeQPFtz+nTdiQAh2FsA In-Reply-To: <8eea04080511301614t65037325h44106d2336f7a9f8@mail.gmail.com> X-Antivirus: avast! (VPS 0548-1, 01/12/2005), Outbound message X-Antivirus-Status: Clean X-ESPOLTEL-MailScanner-Information: Please contact the ISP for more information X-ESPOLTEL-MailScanner: Found to be clean Cc: freebsd-pf@freebsd.org Subject: RE: PF + ALTQ... help please!! X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2005 16:28:32 -0000 I tried to change the rules to what you tell me, but now the outgoing traffic from em1 to my clients it's not restricted...Look at this address, there is a diagram of my case and what I'm trying to do: http://host-242-33.espoltel.net/diagram.jpg It's important the order of the rules? Which it could be for my needs?=20 -----Mensaje original----- De: jsimola@gmail.com [mailto:jsimola@gmail.com] En nombre de Jon Simola Enviado el: Mi=E9rcoles, 30 de Noviembre de 2005 19:14 Para: Marcelo Celleri CC: freebsd-pf@freebsd.org Asunto: Re: PF + ALTQ... help please!! On 11/30/05, Marcelo Celleri wrote: > int_if=3D"em1" > > altq on $int_if bandwidth 100Mb cbq queue { std, uees, lnaval, marcelo, ... } > queue std bandwidth 10.0Mb cbq(default) > #Then for each one of the subqueues: > queue marcelo bandwidth 128Kb cbq { gold, silver, default } > queue gold bandwidth 70% priority 3 cbq(borrow red) > queue silver bandwidth 20% priority 2 cbq(borrow red) > queue default bandwidth 10% cbq(borrow) > #These are the rules: > > pass in on $int_if from any to xxx.xxx.xxx.xxx keep state queue default > pass in on $int_if proto { tcp } from any port { 25,110 } to xxx.xxx.xxx.xxx > keep state queue silver > pass in on $int_if proto { tcp } from any port { 22,53,80,443 } to > xxx.xxx.xxx.xxx keep state queue gold You cannot duplicate the gold/silver/default queue names, just in case you're doing that. The other problem is that you're trying to queue on an inbound interface. Going back to my example: # External interface -> OC3 altq on em0 cbq bandwidth 100Mb queue { default_ext, throttle_ext } queue default_ext bandwidth 40Mb qlimit 1000 priority 5 cbq(default red ecn) queue throttle_ext bandwidth 64Kb priority 1 cbq(red ecn) # Internal interface -> LAN clients altq on em1 cbq bandwidth 100Mb queue { default_int, throttle_int } queue default_int bandwidth 40Mb qlimit 1000 priority 5 cbq(default red ecn) queue throttle_int bandwidth 64Kb priority 1 cbq(red ecn) The queueing rule for this is: pass out on em0 from to any queue throttle_ext Or you can specify a queue on the outbound interface (em0) with a rule on the inbound (em1), for a basically similar effect: pass in on em1 from to any queue throttle_ext Hope that helps a bit. -- Jon Simola Systems Administrator ABC Communications --=20 Este mensaje ha sido analizado por el antivirus de ESPOLTEL S.A. en busca de virus y otros contenidos peligrosos, y se considera que est=E1 limpio.