From owner-freebsd-pf@freebsd.org Mon Jul 29 18:38:08 2019 Return-Path: Delivered-To: freebsd-pf@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 2F767B1F4B for ; Mon, 29 Jul 2019 18:38:08 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 107D78ED6A; Mon, 29 Jul 2019 18:38:08 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from venus.codepro.be (venus.codepro.be [5.9.86.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mx1.codepro.be", Issuer "Let's Encrypt Authority X3" (verified OK)) (Authenticated sender: kp) by smtp.freebsd.org (Postfix) with ESMTPSA id C3874148E2; Mon, 29 Jul 2019 18:38:07 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from [10.10.132.2] (ptr-8rh08jyg0nestgh19od.18120a2.ip6.access.telenet.be [IPv6:2a02:1811:240e:402:18f4:f54e:bc1c:a83d]) (Authenticated sender: kp) by venus.codepro.be (Postfix) with ESMTPSA id 068053EAA5; Mon, 29 Jul 2019 20:38:05 +0200 (CEST) From: "Kristof Provost" To: "mike tancsa" Cc: "Paul Webster" , freebsd-pf@freebsd.org Subject: Re: pf and dummynet Date: Mon, 29 Jul 2019 20:38:03 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: In-Reply-To: <8e58346b-5540-b47e-e446-1a5bb11743d3@sentex.net> References: <5d3f305f.1c69fb81.90047.531f@mx.google.com> <20190729175134.GE10541@vega.codepro.be> <8e58346b-5540-b47e-e446-1a5bb11743d3@sentex.net> MIME-Version: 1.0 X-Rspamd-Queue-Id: 107D78ED6A X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.98 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.996,0]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; TAGGED_RCPT(0.00)[]; NEURAL_HAM_SHORT(-0.99)[-0.988,0]; ASN(0.00)[asn:11403, ipnet:96.47.64.0/20, country:US] Content-Type: text/plain; charset=utf-8; format=flowed; markup=markdown Content-Transfer-Encoding: 8bit X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 18:38:08 -0000 On 29 Jul 2019, at 20:22, mike tancsa wrote: > On 7/29/2019 1:51 PM, Kristof Provost wrote: >> >> Also beware of gotchas with things like IPv6 fragment handling or >> route-to. >> >> I do not consider mixing firewalls to be a supported configuration. >> If >> it breaks you get to keep the pieces. > > Thanks, I was worried about that!  Is there a way to get altq to > limit > inbound traffic directed to a server ?  I would prefer not mixing and > matching, but I dont see any other way other than going to ipfw which > I > would rather not > I don’t know. I’m not very familiar with altq. In general I’d expect quality of service and bandwidth limits to only be effective in the upstream direction (when going from a fast link to a slow one). There’s no good way to limit how much traffic other machines send to you. Regards, Kristof From owner-freebsd-pf@freebsd.org Mon Jul 29 19:32:38 2019 Return-Path: Delivered-To: freebsd-pf@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id CD076B370F for ; Mon, 29 Jul 2019 19:32:38 +0000 (UTC) (envelope-from mike@sentex.net) Received: from pyroxene.sentex.ca (unknown [IPv6:2607:f3e0:0:3::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "pyroxene.sentex.ca", Issuer "Let's Encrypt Authority X3" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 43221690AE; Mon, 29 Jul 2019 19:32:38 +0000 (UTC) (envelope-from mike@sentex.net) Received: from [IPv6:2607:f3e0:0:4:346a:6987:6201:ec77] ([IPv6:2607:f3e0:0:4:346a:6987:6201:ec77]) by pyroxene.sentex.ca (8.15.2/8.15.2) with ESMTPS id x6TJWaST068466 (version=TLSv1.2 cipher=AES128-SHA bits=128 verify=NO); Mon, 29 Jul 2019 15:32:36 -0400 (EDT) (envelope-from mike@sentex.net) Subject: Re: pf and dummynet To: Kristof Provost Cc: Paul Webster , freebsd-pf@freebsd.org References: <5d3f305f.1c69fb81.90047.531f@mx.google.com> <20190729175134.GE10541@vega.codepro.be> <8e58346b-5540-b47e-e446-1a5bb11743d3@sentex.net> From: mike tancsa Message-ID: Date: Mon, 29 Jul 2019 15:32:36 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Rspamd-Queue-Id: 43221690AE X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; spf=pass (mx1.freebsd.org: domain of mike@sentex.net designates 2607:f3e0:0:3::18 as permitted sender) smtp.mailfrom=mike@sentex.net X-Spamd-Result: default: False [-1.44 / 15.00]; ARC_NA(0.00)[]; RDNS_NONE(1.00)[]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; R_SPF_ALLOW(-0.20)[+ip6:2607:f3e0::/32]; NEURAL_HAM_LONG(-0.98)[-0.976,0]; TAGGED_RCPT(0.00)[]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[sentex.net]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MX_GOOD(-0.01)[cached: smtp.sentex.ca]; NEURAL_HAM_SHORT(-0.96)[-0.959,0]; NEURAL_HAM_MEDIUM(-0.97)[-0.974,0]; IP_SCORE(-1.72)[ipnet: 2607:f3e0::/32(-4.94), asn: 11647(-3.57), country: CA(-0.09)]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:11647, ipnet:2607:f3e0::/32, country:CA]; HFILTER_HOSTNAME_UNKNOWN(2.50)[]; MID_RHS_MATCH_FROM(0.00)[]; FREEMAIL_CC(0.00)[googlemail.com] X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 19:32:38 -0000 On 7/29/2019 2:38 PM, Kristof Provost wrote: > > On 29 Jul 2019, at 20:22, mike tancsa wrote: > > On 7/29/2019 1:51 PM, Kristof Provost wrote: > > Also beware of gotchas with things like IPv6 fragment handling or > route-to. > > I do not consider mixing firewalls to be a supported > configuration. If > it breaks you get to keep the pieces. > > Thanks, I was worried about that!  Is there a way to get altq to limit > inbound traffic directed to a server ?  I would prefer not mixing and > matching, but I dont see any other way other than going to ipfw > which I > would rather not > > I don’t know. I’m not very familiar with altq. > > In general I’d expect quality of service and bandwidth limits to only > be effective in the upstream direction (when going from a fast link to > a slow one). There’s no good way to limit how much traffic other > machines send to you. > Another problem is that altq doesnt seem to work with all NICs.  Although cxgbe is listed in the man page still # grep cxl /etc/pf.conf altq on cxl0 cbq bandwidth 2000Mb queue { zrepl,  default } # pfctl -f /etc/pf.conf pfctl: cxl0: driver does not support altq # # man altq | grep -i cxgb      bce(4), bfe(4), bge(4), bxe(4), cas(4), cxgbe(4), dc(4), de(4), ed(4),     ---Mike