Date: Wed, 08 Apr 2015 10:37:41 +0200 From: Marek Salwerowicz <marek_sal@wp.pl> To: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: ipfw / dummynet does not hit the rules? Message-ID: <5524E8D5.8000109@wp.pl>
next in thread | raw e-mail | index | archive | help
Hi all,
I have simple VM ('freeC') with 3 NICs:
- em0 connected to NAT (acces to SSH)
- em1 connected to "segment 1"
- em2 connected to "segment 2"
there are 2 other VMs:
- freeA connected to "segment 1", 10.0.0.1/24
- freeB connected to "segment 2", 10.0.0.2/24
Idea:
Create a L2 bridge on freeC (em1-em2) and control the bandwidth / rtt
using dummynet.
Setup of freeC:
root@freeC:~ # uname -a
FreeBSD freeC 10.1-RELEASE-p9 FreeBSD 10.1-RELEASE-p9 #0: Tue Apr 7
01:09:46 UTC 2015
root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64
root@freeC:~ #
root@freeC:~ # cat /boot/loader.conf
dummynet_load="YES"
if_bridge_load="YES"
root@freeC:~ # cat /etc/rc.conf
hostname="freeC"
ifconfig_em0="DHCP"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em1 addm em2 up"
ifconfig_em1="up"
ifconfig_em2="up"
firewall_enable="YES"
firewall_type="open"
root@freeC:~ # cat /etc/sysctl.conf
net.link.bridge.ipfw=1
net.inet.ip.fw.verbose=1
net.inet.ip.fw.verbose_limit=5
net.inet.ip.fastforwarding=0
net.inet.ip.dummynet.io_fast=0
freeA is able to ping freeB and vice-versa.
Now I'd like to limit bandwidth and add delay:
root@freeC:~ # ipfw pipe 1 config bw 400Mbit/s delay 100ms
root@freeC:~ # ipfw pipe 1 show
00001: 400.000 Mbit/s 100 ms burst 0
q131073 50 sl. 0 flows (1 buckets) sched 65537 weight 0 lmax 0 pri 0
droptail
sched 65537 type FIFO flags 0x0 0 buckets 0 active
root@freeC:~ # ipfw add 2000 pipe 1 all from any to any
root@freeC:~ # ipfw show
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 0 0 deny ip from any to ::1
00500 0 0 deny ip from ::1 to any
00600 0 0 allow ipv6-icmp from :: to ff02::/16
00700 0 0 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 0 0 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 0 0 allow ipv6-icmp from any to any ip6 icmp6types 1
01000 0 0 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136
02000 41 5164 pipe 1 ip from any to any
65000 540 51995 allow ip from any to any
65535 2 400 deny ip from any to any
freeA is still pining freeB with RTT~0,2 ms (I expected 200ms)
Another try with "layer2" rule:
root@freeC:~ # ipfw show
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 0 0 deny ip from any to ::1
00500 0 0 deny ip from ::1 to any
00600 0 0 allow ipv6-icmp from :: to ff02::/16
00700 0 0 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 0 0 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 0 0 allow ipv6-icmp from any to any ip6 icmp6types 1
01000 0 0 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136
02000 0 0 pipe 1 ip from any to any layer2
65000 621 60067 allow ip from any to any
65535 2 400 deny ip from any to any
root@freeC:~ #
Boxes freeA and freeB are still pinging with RTT ~0.2ms
Please note the counters - they are not increasing.
Is this a bug or am I doing sth wrong?
Best regards,
--
Marek Salwerowicz
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5524E8D5.8000109>