Date: Wed, 28 Jun 2006 00:56:13 -0500 From: "Travis H." <solinym@gmail.com> To: "Florent Thiery" <Florent.Thiery@int-evry.fr> Cc: Olivier PAUL <Olivier.Paul@int-evry.fr>, Soufiane BENJILLALI <Soufiane.Benjillali@int-evry.fr>, freebsd-pf@freebsd.org Subject: Re: Anti-DoS QoS with altq Message-ID: <d4f1333a0606272256x1de67bb0t92a7cf16e22ad41@mail.gmail.com> In-Reply-To: <449AE9B9.1030703@int-evry.fr> References: <449AE9B9.1030703@int-evry.fr>
next in thread | previous in thread | raw e-mail | index | archive | help
On 6/22/06, Florent Thiery <Florent.Thiery@int-evry.fr> wrote:
> I'm wondering how to make altq use 2 queues defined as follow
> - the first one is the "attackers" queue, and should be defined by a
> static file containing ip adresses, filled by another program. RED
> should be used on this queue (every client in this queue should have the
> same priority)
table <attackers> file
pass in quick on $wan_if from <attackers> to $web_server port { 80
8080 } queue attacks
Then write a small script to add them to the attackers table.
> - the second one is the "normal clients" queue, which should have the
> best effort possible (again, every client in this queue should have the
> same priority) ; i don't know which scheduler to use...
pass in quick on $wan_if from any to $web_server port { 80 8080 } queue normal
> I don't know how to manage the
> - the ip file part (altq-file interconnection)
altq on $wan_if priq bandwidth $upstream_bw queue { attacker, normal }
queue attacker priority 0 priq(red)
queue normal priority 7 priq(default)
Note that you can only queue on outbound connections.
Well, you can assign queues on inbound packets, but it only
matters when they're queued up to go out (inbound packets
get processed almost immediately if the CPU is fast enough).
> - how to benchmark.... store and plot the results... (i guess it will be
> shell scripting, watch grep wc pipes etc... )
gnuplot
> Thanks in advance for your help. If there is an IRC channel or anybody
> ok to discuss with me (messaging or mail), please contact me.
I charge reasonable rates, but bear in mind that firewall rules can
take a long time to debug and tweak and tune, and I charge by the
hour.
--
"I sometimes have delusions of adequacy" -- Woody Allen
Security "guru" for rent or hire - http://www.lightconsulting.com/~travis/ -><-
GPG fingerprint: 9D3F 395A DAC5 5CCC 9066 151D 0A6B 4098 0C55 1484
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?d4f1333a0606272256x1de67bb0t92a7cf16e22ad41>