From owner-freebsd-net@FreeBSD.ORG Wed Apr 8 09:04:41 2015 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E6C45891 for ; Wed, 8 Apr 2015 09:04:40 +0000 (UTC) Received: from mx3.wp.pl (mx3.wp.pl [212.77.101.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.wp.pl", Issuer "RapidSSL SHA256 CA - G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6D53266D for ; Wed, 8 Apr 2015 09:04:39 +0000 (UTC) Received: (wp-smtpd smtp.wp.pl 4379 invoked from network); 8 Apr 2015 10:37:56 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wp.pl; s=1024a; t=1428482276; bh=p/Ojzj6FT+2JyoeRcmI5TTNaT+xK12XIcEuwm3dhuMc=; h=From:To:Subject; b=dD+IkN1EIQ51iy5V45PiSpHpmLAq3P+n6uvdrnHhkbuR0u3Jo23oDbOZIEJrutiAl eXhtnizdjewHqmIL1JqdlK8SU13LLpZ+jiXvy9wfjhF2HljFPELWsCtGYutvpBEbj0 J2srGEB/iJsqTWheRsoBB/j2AVCvOqa2teTeSOrY= Received: from pb-d-128-141-172-176.cern.ch (HELO [128.141.172.176]) (marek_sal@[128.141.172.176]) (envelope-sender ) by smtp.wp.pl (WP-SMTPD) with ECDHE-RSA-AES256-SHA encrypted SMTP for ; 8 Apr 2015 10:37:56 +0200 Message-ID: <5524E8D5.8000109@wp.pl> Date: Wed, 08 Apr 2015 10:37:41 +0200 From: Marek Salwerowicz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 MIME-Version: 1.0 To: "freebsd-net@freebsd.org" Subject: ipfw / dummynet does not hit the rules? Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-WP-AV: skaner antywirusowy poczty Wirtualnej Polski S. A. X-WP-SPAM: NO 0000000 [YdPU] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Apr 2015 09:04:41 -0000 Hi all, I have simple VM ('freeC') with 3 NICs: - em0 connected to NAT (acces to SSH) - em1 connected to "segment 1" - em2 connected to "segment 2" there are 2 other VMs: - freeA connected to "segment 1", 10.0.0.1/24 - freeB connected to "segment 2", 10.0.0.2/24 Idea: Create a L2 bridge on freeC (em1-em2) and control the bandwidth / rtt using dummynet. Setup of freeC: root@freeC:~ # uname -a FreeBSD freeC 10.1-RELEASE-p9 FreeBSD 10.1-RELEASE-p9 #0: Tue Apr 7 01:09:46 UTC 2015 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 root@freeC:~ # root@freeC:~ # cat /boot/loader.conf dummynet_load="YES" if_bridge_load="YES" root@freeC:~ # cat /etc/rc.conf hostname="freeC" ifconfig_em0="DHCP" sshd_enable="YES" # Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable dumpdev="AUTO" cloned_interfaces="bridge0" ifconfig_bridge0="addm em1 addm em2 up" ifconfig_em1="up" ifconfig_em2="up" firewall_enable="YES" firewall_type="open" root@freeC:~ # cat /etc/sysctl.conf net.link.bridge.ipfw=1 net.inet.ip.fw.verbose=1 net.inet.ip.fw.verbose_limit=5 net.inet.ip.fastforwarding=0 net.inet.ip.dummynet.io_fast=0 freeA is able to ping freeB and vice-versa. Now I'd like to limit bandwidth and add delay: root@freeC:~ # ipfw pipe 1 config bw 400Mbit/s delay 100ms root@freeC:~ # ipfw pipe 1 show 00001: 400.000 Mbit/s 100 ms burst 0 q131073 50 sl. 0 flows (1 buckets) sched 65537 weight 0 lmax 0 pri 0 droptail sched 65537 type FIFO flags 0x0 0 buckets 0 active root@freeC:~ # ipfw add 2000 pipe 1 all from any to any root@freeC:~ # ipfw show 00100 0 0 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 0 0 deny ip from 127.0.0.0/8 to any 00400 0 0 deny ip from any to ::1 00500 0 0 deny ip from ::1 to any 00600 0 0 allow ipv6-icmp from :: to ff02::/16 00700 0 0 allow ipv6-icmp from fe80::/10 to fe80::/10 00800 0 0 allow ipv6-icmp from fe80::/10 to ff02::/16 00900 0 0 allow ipv6-icmp from any to any ip6 icmp6types 1 01000 0 0 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136 02000 41 5164 pipe 1 ip from any to any 65000 540 51995 allow ip from any to any 65535 2 400 deny ip from any to any freeA is still pining freeB with RTT~0,2 ms (I expected 200ms) Another try with "layer2" rule: root@freeC:~ # ipfw show 00100 0 0 allow ip from any to any via lo0 00200 0 0 deny ip from any to 127.0.0.0/8 00300 0 0 deny ip from 127.0.0.0/8 to any 00400 0 0 deny ip from any to ::1 00500 0 0 deny ip from ::1 to any 00600 0 0 allow ipv6-icmp from :: to ff02::/16 00700 0 0 allow ipv6-icmp from fe80::/10 to fe80::/10 00800 0 0 allow ipv6-icmp from fe80::/10 to ff02::/16 00900 0 0 allow ipv6-icmp from any to any ip6 icmp6types 1 01000 0 0 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136 02000 0 0 pipe 1 ip from any to any layer2 65000 621 60067 allow ip from any to any 65535 2 400 deny ip from any to any root@freeC:~ # Boxes freeA and freeB are still pinging with RTT ~0.2ms Please note the counters - they are not increasing. Is this a bug or am I doing sth wrong? Best regards, -- Marek Salwerowicz