[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Understanding where dummynet fits into an ipfw ruleset
- To: Freddie Cash <fjwcash_(_at_)_gmail_(_dot_)_com>
- Subject: Re: Understanding where dummynet fits into an ipfw ruleset
- From: Chuck Swiger <cswiger_(_at_)_mac_(_dot_)_com>
- Date: Fri, 27 Jun 2008 14:37:24 -0700
- Cc: freebsd-net_(_at_)_freebsd_(_dot_)_org
On Jun 27, 2008, at 1:01 PM, Freddie Cash wrote:
Mainly, I'm wondering where to put the "ipfw queue" rules (the ones
that send the packets to dummynet), in relation to the packet
filtering rules, or if it even matters.
For instance, do the queue rules apply to all the rules in the set, or
only to rules that follow after the queue rules (numerically)?
That pretty depends on whether net.inet.ip.fw.one_pass sysctl is set:
Pass packet to a dummynet(4) ``pipe'' (for bandwidth
delay, etc.). See the TRAFFIC SHAPER (DUMMYNET)
Section for further information. The search terminates;
on exit from the pipe and if the sysctl(8) variable
net.inet.ip.fw.one_pass is not set, the packet is passed
the firewall code starting from the next rule.
Would I put the queue rules at the start of the ruleset or the end?
Or in the middle, just above the rules for the workstations? Do I add
them after all the bad packet checks and general deny rules that are
at the top of the ruleset?
Just wondering how the queue rules interact with the general packet
filter rules, since they can have the same parameters.
It's reasonable to place the dummynet queue and pipe statements
immediately after anti-spoofing checks, if net.inet.ip.fw.one_pass is
false; that way, all traffic is shaped, including stuff that is later
blocked by other IPFW statements. Since the inbound traffic has
already passed through your external link(s) anyway, you might as well
acknowledge that it has.
If net.inet.ip.fw.one_pass is true, then you definitely want to apply
your deny rules first, as once something matches a pipe rule, it's
going to be passed. The tradeoff is that the accounting/fairness of
traffic is less accurate but the firewall ruleset runs faster...
freebsd-net_(_at_)_freebsd_(_dot_)_org mailing list
To unsubscribe, send any mail to "freebsd-net-unsubscribe_(_at_)_freebsd_(_dot_)_org"
Visit your host, monkey.org