On Jun 27, 2008, at 1:01 PM, Freddie Cash wrote:
Mainly, I'm wondering where to put the "ipfw queue" rules (the ones
that send the packets to dummynet), in relation to the packet
filtering rules, or if it even matters.
For instance, do the queue rules apply to all the rules in the set, or
only to rules that follow after the queue rules (numerically)?
That pretty depends on whether net.inet.ip.fw.one_pass sysctl is set:
pipe pipe_nr
Pass packet to a dummynet(4) ``pipe'' (for bandwidth
limitation,
delay, etc.). See the TRAFFIC SHAPER (DUMMYNET)
CONFIGURATION
Section for further information. The search terminates;
however,
on exit from the pipe and if the sysctl(8) variable
net.inet.ip.fw.one_pass is not set, the packet is passed
again to
the firewall code starting from the next rule.
Would I put the queue rules at the start of the ruleset or the end?
Or in the middle, just above the rules for the workstations? Do I add
them after all the bad packet checks and general deny rules that are
at the top of the ruleset?
Just wondering how the queue rules interact with the general packet
filter rules, since they can have the same parameters.
It's reasonable to place the dummynet queue and pipe statements
immediately after anti-spoofing checks, if net.inet.ip.fw.one_pass is
false; that way, all traffic is shaped, including stuff that is later
blocked by other IPFW statements. Since the inbound traffic has
already passed through your external link(s) anyway, you might as well
acknowledge that it has.
If net.inet.ip.fw.one_pass is true, then you definitely want to apply
your deny rules first, as once something matches a pipe rule, it's
going to be passed. The tradeoff is that the accounting/fairness of
traffic is less accurate but the firewall ruleset runs faster...
--
-Chuck
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
