Re: pf and ALTQ - I Don't Understand

2007-05-11 Thread Drew Tomlinson
On 5/2/2007 6:45 AM Chris Smith said the following: On Sunday 08 April 2007, Drew Tomlinson wrote: OK, I've done some more digging and maybe I understand now. I was missing the fact that NAT occurs BEFORE filtering Why not tag the packets? Chris OK, why not? :) I l

Re: Best way to decrease DDoS with pf.

2007-05-18 Thread Drew Tomlinson
On 5/18/2007 9:54 AM Abdullah Ibn Hamad Al-Marri said the following: On 5/18/07, Kian Mohageri <[EMAIL PROTECTED]> wrote: On 5/18/07, Abdullah Ibn Hamad Al-Marri <[EMAIL PROTECTED]> wrote: > Thank you for the tip. > > Here what I'm using which fixed the issue. > > pass in on $ext_if proto tcp

Confused With pf Rule Evaluation

2007-02-18 Thread Drew Tomlinson
I have used ipfw2 on FBSD for about 6 years now. Then I started using a VoIP phone and began to fiddle with dummynet to shape the traffic. I had limited success and instead of fiddling further, I decided to migrate to pf and ALTQ. My network is fairly simple. I have a FreeBSD 6.1 box with t

Why Does This Packet Match This Rule?

2007-03-28 Thread Drew Tomlinson
I am having a heck of a time understanding how pf works and getting it to behave the way I want with my home network and ADSL connection. Basically I want to use ALTQ to prioritize traffic going out the interface connected to my ADSL modem. Here's my network: internal --- dc0 - FBSD router -

Re: Why Does This Packet Match This Rule?

2007-03-29 Thread Drew Tomlinson
On 3/28/2007 12:58 PM Greg Hennessy wrote: (and the rest). What am I missing? From the rule snippets posted, 'keep state' & 'keep state flags S/SA' comes to mind. You should endeavour to keep state on each and every rule and only establish tcp state on the 3 way handshake. Thank yo

Bacula and pf

2007-04-02 Thread Drew Tomlinson
I run Bacula v1.38 on my home network. Ever since I moved from ipfw2 to pf, backups fail intermittently on my router due to "broken network pipes" usually after somewhere around 10 MB - 12 MB has been transfered. Thus small incremental backups are successful but larger full backups are not.

Re: Bacula and pf

2007-04-03 Thread Drew Tomlinson
soever. Thanks, Drew - Original Message - From: "Drew Tomlinson" <[EMAIL PROTECTED]> To: Sent: Monday, April 02, 2007 5:15 PM Subject: Bacula and pf I run Bacula v1.38 on my home network. Ever since I moved from ipfw2 to pf, backups fail intermittently on my rou

Re: Bacula and pf

2007-04-03 Thread Drew Tomlinson
On 4/3/2007 9:11 AM Max Laier wrote: On Monday 02 April 2007 23:15, Drew Tomlinson wrote: I run Bacula v1.38 on my home network. Ever since I moved from ipfw2 to pf, backups fail intermittently on my router due to "broken network pipes" usually after somewhere around 10 MB - 12 M

Re: Bacula and pf

2007-04-03 Thread Drew Tomlinson
On 4/3/2007 8:37 AM Dave wrote: Hi, Ok, that's interesting. Can you send me your bacula configs for this client and the server box and your pf config? I'd like to compare them with mine, see if i can spot something subtle. Offhand though that's strange, i can think of several possibilities,

pf and ALTQ - I Don't Understand

2007-04-08 Thread Drew Tomlinson
I am struggling to get pf set up correctly. Specifically I don't understand why I don't see any packets in the "pfctl -vs queue" output for a queue I named "voip_out". I see the packets matching rule 61 & rule 62 when viewing the log with "tcpdump -nei pflog0": 2007-04-08 09:54:25.392552

Re: pf and ALTQ - I Don't Understand

2007-04-08 Thread Drew Tomlinson
On 4/8/2007 10:12 AM Drew Tomlinson said the following: I am struggling to get pf set up correctly. Specifically I don't understand why I don't see any packets in the "pfctl -vs queue" output for a queue I named "voip_out". I see the packets matching rule 61 &