|
Hi Jason,
I'm working with altq at 3.2-STABLE and since 3.2-CURRENT
merged altq into pf, I'm wondering if there is a way to insert dynamic altq
rules (like authpf). Do you (or anybody at the list) know if it's possible to
work with that.
Thanks,
Rossi.
----- Original Message -----
Sent: Thursday, December 12, 2002 8:05
PM
Subject: pf + bridge + qos by tos
hello Daniel, and pf ppl
I've been playing
with -current (syncing almost daily) and qos mostly
trying to get the qos
to play nice with tos rules. IE strait from the
example:
This
is in a bridge enviornment. I have 3 interfaces on the box 2 for the
bridge and one setup on our internal side for simple manamgent. Here
is
the diagram:
|----{pix}--10.0.1.0/24----|
|
|
cisco 2600 -----|
|------------|
|
{xl0}
|---{rl0}sexy obsd
bridge{rl1}--|
|
|
real worlds
/28
Everything with qos seems to work like i want except using tos
in my rules
to apply to the filter. I have tried and tried to get
this to work and
waited to see if anyone else reported this. What
happens is if i pull off
the tos from the rule then it matches and qos
works great. but if i have
tos on the rules everything seems to go
to the bucket bin "std". I figure
I must have some logic wrong or
rule wrong or i am trying to qos on the
wrong interface. please
help. here is my
rules
ext_if
= "rl0"
int_if =
"rl1"
man_if =
"xl0"
man_ip =
"10.0.1.249/32"
noc_hosts =
"216.201.43.115/32"
employee_hosts = "216.201.43.116/32"
set
limit states 20000
set limit frags 20000
scrub in on $ext_if
all fragment crop
altq on $ext_if cbq bandwidth 200Kb queue { std,
http, mail, ssh, ftp, icmp }
queue std bandwidth 10%
cbq(default)
queue http bandwidth 50% priority 2 cbq(borrow red) {
employees, noc }
queue noc bandwidth 10% cbq
queue employees
bandwidth 15%
queue mail bandwidth 10% priority 0 cbq(borrow ecn)
queue
ssh bandwidth 20% cbq(borrow) { ssh_interactive, ssh_bulk }
queue
ssh_interactive priority 7
queue ssh_bulk priority 0
queue ftp
bandwidth 10% priority 0 cbq { ftp_noc, ftp_employees }
queue ftp_noc
bandwidth 80% cbq(borrow red)
queue ftp_employees bandwidth
10%
queue icmp bandwidth 10% priority 4 cbq (borrow red) {icmp_noc,
icmp_employees }
queue icmp_noc bandwidth 90%
queue icmp_employees
bandwidth 10%
#block return out on $ext_if inet all queue
std
block in log on $ext_if all
block in log on $man_if all
pass out
log on $man_if inet proto { tcp, udp, icmp } from $man_ip to any keep
state
pass out log on $ext_if inet proto { tcp, udp, icmp } from any to any
keep state queue std
pass out log on $ext_if inet proto { tcp, udp } from
$noc_hosts to any port 80 flags S/SAPFU keep state queue noc
pass out log
on $ext_if inet proto tcp from $employee_hosts to any port 80 flags S/SAPFU
keep state queue employees
pass out log on $ext_if inet proto tcp from
$noc_hosts to any port 21 flags S/SAPFU keep state queue ftp_noc
pass out
log on $ext_if inet proto tcp from $employee_hosts to any port 21 flags
S/SAPFU keep state queue ftp_employee
pass out on $ext_if inet proto icmp
from $noc_hosts to any icmp-type 8 code 0 keep state queue
icmp_noc
pass out on $ext_if inet proto icmp from $employee_hosts to any
icmp-type 8 code 0 keep state queue icmp_employees
#priority for
interactive sessions
pass out log-all quick on $ext_if inet proto tcp from
$noc_hosts to any port 22 flags S/SAPFU tos 0x10 keep state queue
ssh_interactive
#less priority for scp/sftp/...
pass out log-all
quick on $ext_if inet proto tcp from $noc_hosts to any port 22 flags
S/SAPFU tos 0x08 keep state queue ssh_bulk
pass out on $ext_if inet
proto tcp from any to any port 25 keep state
queue mail
pass in on
$man_if inet proto tcp from any to any port 22 keep
state
----------------------------------------------------------------------------------
venom#
pfctl -s rules
scrub in on rl0 all fragment crop
block drop in log on
rl0 all
block drop in log on xl0 all
pass out log on xl0 inet proto
tcp from 10.0.1.249 to any keep state
pass out log on xl0 inet proto udp
from 10.0.1.249 to any keep state
pass out log on xl0 inet proto icmp from
10.0.1.249 to any keep state
pass out log on rl0 inet proto tcp all keep
state queue std
pass out log on rl0 inet proto udp all keep state queue
std
pass out log on rl0 inet proto icmp all keep state queue std
pass
out log on rl0 inet proto tcp from 216.201.43.115 to any port = www
flags
S/FSPAU keep state queue noc
pass out log on rl0 inet proto udp from
216.201.43.115 to any port = www
keep state queue noc
pass out log on
rl0 inet proto tcp from 192.168.1.203 to any port = www
flags S/FSPAU keep
state queue employees
pass out log on rl0 inet proto tcp from
216.201.43.115 to any port = ftp
flags S/FSPAU keep state queue
ftp_noc
pass out log on rl0 inet proto tcp from 192.168.1.203 to any port =
ftp
flags S/FSPAU keep state queue ftp_employee
pass out on rl0 inet
proto icmp from 216.201.43.115 to any icmp-type
echoreq code 0 keep state
queue icmp_noc
pass out on rl0 inet proto icmp from 192.168.1.203 to any
icmp-type
echoreq code 0 keep state queue icmp_employees
pass out
log-all quick on rl0 inet proto tcp from 216.201.43.115 to any
port = ssh
flags S/FSPAU tos 0x10 keep state queue ssh_interactive
pass out log-all
quick on rl0 inet proto tcp from 216.201.43.115 to any
port = ssh flags
S/FSPAU tos 0x08 keep state queue ssh_bulk
pass out on rl0 inet proto tcp
from any to any port = smtp keep state
queue mail
pass in on xl0 inet
proto tcp from any to any port = ssh keep state
-------------------------------------------------------------------------
I
create a ssh to a work box from .115
Dec 12 16:52:54.499295 rule
7/0(match): pass out on rl0: 216.201.43.115.32771 > 209.143.0.10.53:
[udp sum ok] 58999+ AAAA? midus.bright.net. (34) (DF) (ttl 64, id
44571)
Dec 12 16:52:54.523633 rule 6/0(match): pass out on rl0:
216.201.43.115.32786 > 216.255.50.23.22: S [tcp sum ok]
561425143:561425143(0) win 5840 <mss 1460,sackOK,timestamp 138161
0,nop,wscale 0> (DF) (ttl 64, id 18097)
As you can see it creates
state on rule 6 because no tos happens till
after session
establishment. my question how do get pf rules to work with
qos and
tos. should i apply the rule to the int_if ? If i pull the tos
off the rules it works fine but then i can't say scp traffic gets x% and
ssh interactive gets y%. please help as i am sure i am doing some
thing
wrong.
venom# pfctl -vsr
scrub in on rl0 all fragment
crop
[ Evaluations: 77 Packets:
0 Bytes:
0 States:
0
]
block drop in log on rl0 all
[
Evaluations: 77 Packets:
4 Bytes:
256 States:
0
]
block drop in log on xl0 all
[
Evaluations: 75 Packets:
0 Bytes:
0 States:
0
]
pass out log on xl0 inet proto tcp from
10.0.1.249 to any keep state
[ Evaluations:
2 Packets:
0 Bytes:
0 States:
0
]
pass out log on xl0 inet proto udp from
10.0.1.249 to any keep state
[ Evaluations:
0 Packets:
0 Bytes:
0 States:
0
]
pass out log on xl0 inet proto icmp
from 10.0.1.249 to any keep state
[ Evaluations:
0 Packets:
0 Bytes:
0 States:
0
]
pass out log on rl0 inet proto tcp all
keep state queue std
[ Evaluations:
77 Packets:
39 Bytes:
5023 States:
1
]
pass out log on rl0 inet proto udp all
keep state queue std
[ Evaluations:
2 Packets:
6 Bytes:
625 States:
1
]
pass out log on rl0 inet proto icmp all
keep state queue std
[ Evaluations:
2 Packets:
0 Bytes:
0 States:
0
]
pass out log on rl0 inet proto tcp from
216.201.43.115 to any port = www
flags S/FSPAU keep state queue noc
[
Evaluations: 2 Packets:
0 Bytes:
0 States:
0
]
pass out log on rl0 inet proto udp from
216.201.43.115 to any port = www
keep state queue noc
[ Evaluations:
1 Packets:
0 Bytes:
0 States:
0
]
pass out log on rl0 inet proto tcp from
192.168.1.203 to any port = www
flags S/FSPAU keep state queue
employees
[ Evaluations: 0
Packets: 0 Bytes:
0 States:
0
]
pass out log on rl0 inet proto tcp from
216.201.43.115 to any port = ftp
flags S/FSPAU keep state queue
ftp_noc
[ Evaluations: 2
Packets: 0 Bytes:
0 States:
0
]
pass out log on rl0 inet proto tcp from
192.168.1.203 to any port = ftp
flags S/FSPAU keep state queue
ftp_employee
[ Evaluations:
0 Packets:
0 Bytes:
0 States:
0
]
pass out on rl0 inet proto icmp from
216.201.43.115 to any icmp-type
echoreq code 0 keep state queue
icmp_noc
[ Evaluations: 2
Packets: 0 Bytes:
0 States:
0
]
pass out on rl0 inet proto icmp from
192.168.1.203 to any icmp-type
echoreq code 0 keep state queue
icmp_employees
[ Evaluations:
0 Packets:
0 Bytes:
0 States:
0
]
pass out log-all quick on rl0 inet
proto tcp from 216.201.43.115 to any
port = ssh flags S/FSPAU tos 0x10
keep state queue ssh_interactive
[ Evaluations:
2 Packets:
0 Bytes:
0 States:
0
]
pass out log-all quick on rl0 inet
proto tcp from 216.201.43.115 to any
port = ssh flags S/FSPAU tos 0x08
keep state queue ssh_bulk
[ Evaluations:
1 Packets:
0 Bytes:
0 States:
0
]
pass out on rl0 inet proto tcp from any
to any port = smtp keep state
queue mail
[ Evaluations:
1 Packets:
0 Bytes:
0 States:
0
]
pass in on xl0 inet proto tcp from any
to any port = ssh keep state
[ Evaluations:
76 Packets:
0 Bytes:
0 States:
0
]
Thanks pf crew!!
Jason
houx
|
