From owner-freebsd-pf@FreeBSD.ORG Thu May 17 14:14:38 2007 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id D753E16A406 for ; Thu, 17 May 2007 14:14:38 +0000 (UTC) (envelope-from llt@recol.com) Received: from mta1.recol.net (mta1.recol.net [64.207.103.6]) by mx1.freebsd.org (Postfix) with ESMTP id B3A0513C465 for ; Thu, 17 May 2007 14:14:38 +0000 (UTC) (envelope-from llt@recol.com) Received: from TRAN (lan.recol.net [207.51.84.209]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) by mta1.recol.net (Postfix) with ESMTP id 39B6B3A3889 for ; Thu, 17 May 2007 09:49:25 -0400 (EDT) Message-ID: <005001c7988a$2e7ed000$d101010a@recol.us> From: "Lan Tran" To: Date: Thu, 17 May 2007 09:49:25 -0400 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3028 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028 Subject: pf+altq for bandwidth control X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 May 2007 14:14:38 -0000 Hello, Is pf and altq a right combo for bandwidth limiting? What I'm trying to do is limit each IP or block of IPs to predefined bandwidth. I'm not doing traffic shaping, just wanting to prevent servers from hogging all the bandwidth. My setup is as follow: LAN {test server} -> xl1 {FreeBSD} xl0 -> router -> net xl0 and xl1 are functioning as a transparent bridge. kernel has pf and altq compiled. pf.conf: ext_if = "xl0" int_if = "xl1" pc = "any" set loginterface $ext_if # to net altq on $ext_if cbq bandwidth 100Mb queue { std_ext, test_ext } queue std_ext bandwidth 3Mb qlimit 1000 priority 5 cbq(default red ecn) queue test_ext bandwidth 2Mb priority 1 cbq(red ecn) pass out on $ext_if from $pc to any keep state queue test_ext --- The problem I'm having is that all outbound traffic from "test server" matches the "queue std_ext" instead of "queue test_ext" rule. It appears the cbq(default) child rule is overriding the other rule. What am I missing? LT