Re: limiting outbound throughput from an IP using altq
- Original Message - From: "Stuart Henderson" <[EMAIL PROTECTED]> Sent: Friday, December 15, 2006 12:05 AM Subject: Re: limiting outbound throughput from an IP using altq > On 2006/12/14 16:33, rootrider wrote: > > Traffic is being assigned to the nick_int queue, and inbound > > (from the internet to the lan) traffic is being limited... to my > > surprise. That doesn't even make any sense to me. > > Use the same name for queues on each interface, e.g. > > altq on $ext_if cbq bandwidth 950Kb queue { nick, other } > queue nick on $ext_ifbandwidth 1% priority 1 cbq > queue other on $ext_if bandwidth 99% priority 7 cbq(default, borrow) > > altq on $int_if cbq bandwidth 8Mb queue { nick, other } > queue nick on $int_ifbandwidth 1% priority 1 cbq > queue other on $int_if bandwidth 99% priority 7 cbq(default) > > 'pass...keep state queue foo_in' rules mean that packets matching the > state (i.e. in _both_ directions) are assigned to queue foo_in, which is > not what you want. Using 'queue..on $if1' and 'queue...on $if2' creates > two queues with the same name so that a single 'pass' rule assigns > packets to the queue for whichever interface is relevant. > > (thanks to Henning on the pf mailing list for the tip about this). well, I tried this.. even plugged the exact text in here and used that as my sole altq configuration. I got the exact same result I had before: unlimited upload speed and download speed limited to 80 kbps. I've got to be missing something somewhere... Isn't there anyone with a working pf.conf that limits upload speed of an IP? -- Joel [rootrider]
limiting outbound throughput from an IP using altq
OpenBSD 3.9 i386, using pf/altq I have a nat/firewall box running here, with our cable internet (6mbps/1mbps) on the external interface and our lan (100mbps) on the internal interface. I'm attempting to assign outbound traffic from an internal IP (10.0.0.243 in this case) to 1% of the total queue. I feel like I'm missing something really obvious here. If anyone can tell me what I'm doing wrong I would *really* appreciate it. Traffic is being assigned to the nick_int queue, and inbound (from the internet to the lan) traffic is being limited... to my surprise. That doesn't even make any sense to me. No traffic is being assigned to nick_ext at all.. everything is showing up on the default queue (other) instead. I'm using 'pfctl -vvs queue' to check whether any traffic is being assigned to a queue and using my own IP for $nick_net to test. related text from my pf.conf: = ext_if = xl1 int_if = xl0 nick_net= "10.0.0.243" set block-policy drop set state-policy if-bound altq on $ext_if cbq bandwidth 950Kb queue { nick_ext, other } queue nick_ext bandwidth 1% priority 1 cbq queue other bandwidth 99% priority 7 cbq(default, borrow) altq on $int_if cbq bandwidth 8Mb queue { all_in, nick_int } queue all_in bandwidth 99% priority 7 cbq(default) queue nick_intbandwidth 1% priority 1 cbq nat on $ext_if from $int_if:network to any -> ($ext_if) block drop all pass in on $int_if from $int_if:network to any keep state pass out on $int_if from any to $int_if:network keep state queue all_in pass out on $ext_if from any to any keep state queue other pass in quick on $int_if from $nick_net to any keep state queue nick_int pass out quick on $ext_if from $nick_net to any keep state queue nick_ext = Have I set this up completely wrong or am I just missing something? I've assigned traffic based on the external interface's local port successfully before, but if I take that same rule and specify an internal IP then no traffic is assigned at all. -- Joel [rootrider]