From owner-freebsd-questions Fri Jun 14 8:32:38 2002 Delivered-To: freebsd-questions@freebsd.org Received: from chicken.orbitel.bg (chicken100.orbitel.bg [195.24.32.21]) by hub.freebsd.org (Postfix) with SMTP id D5D8937B42C for ; Fri, 14 Jun 2002 08:32:16 -0700 (PDT) Received: (qmail 15667 invoked from network); 14 Jun 2002 15:32:13 -0000 Received: from unknown (HELO procreditbank.com) (212.95.170.207) by chicken.orbitel.bg with SMTP; 14 Jun 2002 15:32:13 -0000 Received: from itaush [172.16.248.203] by Proxy+; Fri, 14 Jun 2002 18:00:39 +0300 for multiple recipients From: "Ivailo Tanusheff" To: "FreeBSD Questions" , "FreeBSD Security" Subject: IPFW + Squid Date: Fri, 14 Jun 2002 18:00:39 +0300 Message-ID: <006601c213b4$3f425cf0$cbf810ac@sof.procreditbank.bg> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Dear Sirs, I have the following configuration: {Internet} <-> {SQUID1 + Net1} <-64K line-> [SQUID2] <-> {Net2} I have the following problem: In Net1 I have an important server to which there are connecting some clients from Net2 trough http and the squid server. These clients have to be able to use most of the 64K line between the two networks. In Net2 there are many clients useing the squid server as a proxy and are making "bad" traffic. My question is - how may I configure ipfw to shape the traffic for the other users. I'd tried some ways of accomplishing that task, but it seems to me, that when using proxy server, the destination IP address is not in the IP header or I'm wrong. Can you help me? Id tried: su-2.05a# ipfw -a show 00500 0 0 pipe 1 ip from any to not out 00600 0 0 pipe 2 ip from any to not in 65535 397320 84804286 allow ip from any to any As you see - there is no hit of going out of the net1. Thank you in advantage, Ivo To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message