Date: Thu, 08 Nov 2001 05:27:05 +0100 From: alex <ml-freebsd-ipfw@phobgate.de> To: Michael Loftis <mloftis@wgops.com>, freebsd-ipfw@FreeBSD.ORG Subject: Re: IPF -- IPFILTER/IPNAT + DUMMYNET? Message-ID: <1627830.1005197225@[192.168.2.94]> In-Reply-To: <3BE9DDEC.14FBBC5@wgops.com> References: <3BE9DDEC.14FBBC5@wgops.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Michael, I'm new to ipfilter, but i use ipfw for bandwith limiting for a few months now. I compiled my Kernel with ipfw and ipfilter, now what I think i found out, is: packages run first through ipfilter, then ipfw (ifboth compiled into kernel, may vary if ipfw ist compiled in and ipfilter loaded as module) What I use, is: ipfw pipe 1 config bw 100KByte/s ipfw pipe 2 config bw 100KByte/s ipfw add pipe 1 ip from any to any out ipfw add pipe 2 ip from any to any in This is a nice duplex 100KB/sec pipe (100KB/sec in both directions) and works well, on my box :) Before this pipe rules i do some "allow all from x to y" for unlimited bandwith to our own network, i use the bandwith limiting rules just for the rest of packages for outgoing connections to the internet. if you want to limit bandwidth depend on device, let's say you want only 16KB/sec (dual ISDN) on rl0, this should work: ipfw pipe 1 config bw 16KByte/s ipfw pipe 2 config bw 16KByte/s ipfw add pipe 1 ip from any to any out xmit rl0 ipfw add pipe 2 ip from any to any in recv rl0 should limit bandwith on all packages entering system or leaving system via rl0 device. And you should have a "allow all from any to any" rule as the last rule in ipfw, otherwise the packages are droped by ipfw (assuming you do all the allow/deny filtering in ipfilter). Hope this helps, alex --On Mittwoch, 7. November 2001 17:20 -0800 Michael Loftis <mloftis@wgops.com> wrote: > OK :) HAte to bother this list with it but couldn't find out how the > interaction would work but what I was wondering is could I stick a > DUMMYNET rate limiter pipe in the path for output on a ipfilter based > firewall... If so whats the logical diagram it would follow... > > IE is it soemthing like > > INPUT<->IPNAT<->IPF<->DUMMYNET/PIPE<->IFACE<->OUTPUT > ? > > The reason I ask is I'd like to posibly utilise the rate limiter at some > point. I've had 0 success making ipfw work in any configuration, and > ipnat+ipf is a little strange but it works (NAT seems to happen before > IPFilter, which is a little odd.... but hey, whatever.) Any > clues/helps? The machine is a multi-homed and multi-ip-ed machine. > > Michael > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-ipfw" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1627830.1005197225>