From owner-freebsd-ipfw@FreeBSD.ORG Fri Nov 21 04:24:58 2008 Return-Path: Delivered-To: freebsd-ipfw@FreeBSD.ORG Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E2FC7106564A for ; Fri, 21 Nov 2008 04:24:58 +0000 (UTC) (envelope-from security@jim-liesl.org) Received: from smtp2.mc.surewest.net (qsmtp.mc.surewest.net [66.60.130.145]) by mx1.freebsd.org (Postfix) with SMTP id C2C668FC18 for ; Fri, 21 Nov 2008 04:24:58 +0000 (UTC) (envelope-from security@jim-liesl.org) Received: (qmail 25602 invoked from network); 20 Nov 2008 19:58:02 -0800 Received: by simscan 1.1.0 ppid: 25599, pid: 25600, t: 0.0795s scanners: regex: 1.1.0 attach: 1.1.0 Received: from unknown (HELO smtp.jim-liesl.org) (66.60.173.44) by smtp2 with SMTP; 20 Nov 2008 19:58:02 -0800 Received: from smtp.jim-liesl.org (localhost.static.surewest.net [127.0.0.1]) by smtp.jim-liesl.org (Postfix) with ESMTP id 465AE5DBB; Thu, 20 Nov 2008 19:58:17 -0800 (PST) Received: from [IPv6:::1] (daemon.static.surewest.net [192.168.1.15]) by smtp.jim-liesl.org (Postfix) with ESMTP id BDD0B5DB8; Thu, 20 Nov 2008 19:58:16 -0800 (PST) Message-ID: <492631D7.30909@jim-liesl.org> Date: Thu, 20 Nov 2008 19:58:15 -0800 From: security User-Agent: Thunderbird 2.0.0.17 (Windows/20080914) MIME-Version: 1.0 To: freebsd-net@FreeBSD.org, freebsd-ipfw@FreeBSD.ORG X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP Cc: Subject: ipfw/dummynet question X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Nov 2008 04:24:59 -0000 context is 7.1-beta2 I'm using a FreeBSD box as a router and IPFW/dummynet to simulate 3 WAN connections. The three networks are actually on the same lan, but have aliased ip's on the router's NIC (router on a stick). I've set up bi-directional pipes for each "net" that enforce various impairments. What I'm trying to do is have all traffic to or from "net-a" simulate a 30Mbit link, "net-b" a 20Mbit, and "net-c" a 10Mbit one. Traffic coming from elsewhere would not be touched until it was outbound for one of the 3 nets, and like wise, traffic coming from the 3 nets and going elsewhere would only be touched coming in. Traffic who's src and dst don't match at all would fall through. An example would be traffic from "net-a" going to "net-c" gets passed into the router like it's on a 30Mbit link, but heads out (after routing) like it's on a 10 Mbit link Question: Am I on the right path or have I made some stupid assumption(s)? I realize I have a few extra rules that could be optimized out, but this is probably good for the sake of readability. Another question, is each ip flow treated like it has it's own dedicated bw, or do all flows that match a pipe share the b/w ? thx jim (assume one_pass is set) ${fwcmd} add 10 skipto 100 ip from any to any in ${fwcmd} add 20 skipto 500 ip from any to any out ${fwcmd} add 100 pipe 1 ip from net-a to any ${fwcmd} add 200 pipe 2 ip from net-b to any ${fwcmd} add 300 pipe 3 ip from net-c to any ${fwcmd} add 400 skipto 65535 ip from any to any ${fwcmd} pipe 1 config bw 30Mbit/s ${fwcmd} pipe 2 config bw 20Mbit/s ${fwcmd} pipe 3 config bw 10Mbit/s ${fwcmd} add 500 pipe 4 ip from any to net-a ${fwcmd} add 600 pipe 5 ip from any to net-b ${fwcmd} add 700 pipe 6 ip from any to net-c ${fwcmd} pipe 4 config bw 30Mbit/s ${fwcmd} pipe 5 config bw 20Mbit/s ${fwcmd} pipe 6 config bw 10Mbit/s ${fwcmd} add 1000 skipto 65535 ip from any to any