Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread randall ehren
 Is there a way to limit incoming traffic (bandwidth) using
 ipfilter/ipfw or any such software tool?. I am running a mail
 server and I pay per GB transfered. If I have my ISP do the
 limiting, they charge extra $$ for it. I know I can limit
 incoming mail size via the mail server. But still doesn't
 prevent someone from sending a lot of mail or fill up
 a 100mbps line for 24 hrs/day.

you'll want to lookup information on dummynet:
 http://info.iet.unipi.it/~luigi/ip_dummynet/

you can use it to shape traffic and limit bandwidth.

 -randall

--
:// randall s. ehren :// voice 805.893.5632
:// systems administrator:// isber|survey|avss.ucsb.edu
:// institute for social, behavioral, and economic research


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



RE: incoming bandwidth limiting using ipfilter

2003-01-03 Thread charles pelletier
ipfilter won't allow you to limit bandwidth, ipfw will. 


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Hari Bhaskaran
Sent: Friday, January 03, 2003 2:36 PM
To: [EMAIL PROTECTED]
Subject: incoming bandwidth limiting using ipfilter


Hi,

Is there a way to limit incoming traffic (bandwidth) using
ipfilter/ipfw or any such software tool?. I am running a mail
server and I pay per GB transfered. If I have my ISP do the
limiting, they charge extra $$ for it. I know I can limit
incoming mail size via the mail server. But still doesn't
prevent someone from sending a lot of mail or fill up
a 100mbps line for 24 hrs/day.


I am not looking for a perfect solution, and I do realize
ddos attacks and such are still possible. I am only looking
for a reasonable solution.

Any help is appreciated

--
Hari Bhaskaran

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Murat Bicer
Is there anything that limits us from using ipfilter on top of this ipfw
b/w control?

 Is there a way to limit incoming traffic (bandwidth) using
 ipfilter/ipfw or any such software tool?. 

you'll want to lookup information on dummynet:
 http://info.iet.unipi.it/~luigi/ip_dummynet/

you can use it to shape traffic and limit bandwidth.
Murat Bicer
[EMAIL PROTECTED]

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread randall ehren
 Is there anything that limits us from using ipfilter on top of this ipfw
 b/w control?

doesn't appear so...

from http://home.earthlink.net/~jaymzh666/ipf/IPFfreebsd.html#12:

IPF and IPFW both have features I want to use, must I choose between them?

No. You can run them both on a single machine. However, you must take care to
ensure that one package's rules do not interfere with the other's. Note that
the packages get access to rules in the order in which they were loaded, e.g.
if IPFW is compiled in the kernel and IPF is loaded as a module, IPFW sees
packets before IPF.

 -randall

--
:// randall s. ehren :// voice 805.893.5632
:// systems administrator:// isber|survey|avss.ucsb.edu
:// institute for social, behavioral, and economic research


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Avleen Vig
On Fri, 3 Jan 2003, Murat Bicer wrote:

 Is there anything that limits us from using ipfilter on top of this ipfw
 b/w control?

Darren Reed, the owner of IPF is probably in the best position to answer
that question. I posed it a week ot two ago on the ipf mailing list.. I'm
waiting for a reply, not sure if it was seen amongst the flurry or mail on
the topic.

Darren could you answer this question please?
Maybe we could get Phil to add the answer to the FAQ.
Phil? :-)

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Hari Bhaskaran
On Fri, Jan 03, 2003 at 12:39:52PM -0800, randall ehren wrote:
 
 you'll want to lookup information on dummynet:
  http://info.iet.unipi.it/~luigi/ip_dummynet/

Does anyone know any hardware (of the size of a regular home
DSL router) that can give me a simple limit of X bps for two
IP addresses. I am running out of time and removing ipfilter
(which I use now) and adding ipfw, learning dummynet and then
figuring out will take time (at least 5 days with my FreeBSD IQ level).
I am also hoping it would be in  $500 range.


 
 you can use it to shape traffic and limit bandwidth.
 
  -randall
 

Any help is appreciated.

--
Hari Bhaskaran

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread randall ehren
 Does anyone know any hardware (of the size of a regular home
 DSL router) that can give me a simple limit of X bps for two
 IP addresses. I am running out of time and removing ipfilter
 (which I use now) and adding ipfw, learning dummynet and then
 figuring out will take time (at least 5 days with my FreeBSD IQ level).
 I am also hoping it would be in  $500 range.

just add IPFW, IPFIREWALL_DEFAULT_TO_ACCEPT, and DUMMYNET to your kernel, no
need to remove IPFILTER.

then just add whatever rules are needed for dummynet. IPFW should then leave
your packets alone for ipfilter to handle.

 -randall

--
:// randall s. ehren :// voice 805.893.5632
:// systems administrator:// isber|survey|avss.ucsb.edu
:// institute for social, behavioral, and economic research


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread randall ehren
  Is there anything that limits us from using ipfilter on top of this ipfw
  b/w control?

 Darren Reed, the owner of IPF is probably in the best position to answer
 that question. I posed it a week ot two ago on the ipf mailing list.. I'm
 waiting for a reply, not sure if it was seen amongst the flurry or mail on
 the topic.

 Darren could you answer this question please?
 Maybe we could get Phil to add the answer to the FAQ.

http://www.google.com/search?q=ipfilter+ipfw+together

 -- http://false.net/ipfilter/2000_02/0407.html

 -randall

--
:// randall s. ehren :// voice 805.893.5632
:// systems administrator:// isber|survey|avss.ucsb.edu
:// institute for social, behavioral, and economic research


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



RE: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Daniel Goepp
Here is another article that summarizes what you need to do, it's pretty
straight forward really.  I just did this recently on my server, and it
appears to work like a charm so far.

http://www.onlamp.com/pub/a/bsd/2001/07/26/Big_Scary_Daemons.html

Peace.

-Daniel


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of randall ehren
Sent: Friday, January 03, 2003 5:29 PM
To: Hari Bhaskaran
Cc: [EMAIL PROTECTED]
Subject: Re: incoming bandwidth limiting using ipfilter

 Does anyone know any hardware (of the size of a regular home
 DSL router) that can give me a simple limit of X bps for two
 IP addresses. I am running out of time and removing ipfilter
 (which I use now) and adding ipfw, learning dummynet and then
 figuring out will take time (at least 5 days with my FreeBSD IQ
level).
 I am also hoping it would be in  $500 range.

just add IPFW, IPFIREWALL_DEFAULT_TO_ACCEPT, and DUMMYNET to your
kernel, no
need to remove IPFILTER.

then just add whatever rules are needed for dummynet. IPFW should then
leave
your packets alone for ipfilter to handle.

 -randall

--
:// randall s. ehren :// voice 805.893.5632
:// systems administrator:// isber|survey|avss.ucsb.edu
:// institute for social, behavioral, and economic research


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Hari Bhaskaran

 Hari:

 I think you are going to find that rate-limiting at the box won't
 provide any fiscal relief.  The packets have already traversed your
 ISP's interface where the accounting is taking place.

 Mike

That's bad. But if the machine doesn't accept more than N packets/sec,
why would the ISP router forward any more packets to it? I wouldn't
know the internals, but isn't there any kind of flow control in the
protocol?

-- 
Hari Bhaskaran

(Mike, although I have cc-ed the list
I haven't included your email
anywhere in the reply)

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Avleen Vig
On Fri, 3 Jan 2003, randall ehren wrote:

  Darren could you answer this question please?
  Maybe we could get Phil to add the answer to the FAQ.

 http://www.google.com/search?q=ipfilter+ipfw+together
  -- http://false.net/ipfilter/2000_02/0407.html

This is what we settled with eventually, but the processing order for
packets when you're using both IPF and IPFW plus ipnat is seriously
f*rked.

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



RE: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Daniel Goepp
The question is, are they charging you for total bandwidth used, or some
real time rate limit?  When you use bandwidth shaping, you can reduce
your rate, but that will just spread things out.  So if they are
charging you for total bytes moved, then you would have to do some math
to figure out what that breaks down to in Mbps, and put a throttle in to
that rate.  I'm not sure what Mike means by packets already traversing
the network.  If you shape your bandwidth, it's not like all those
packets just pile up at your server's front door, waiting to get in.
The IP protocol will pause within itself to not exceed your defined
bandwidth.

-Daniel


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Hari Bhaskaran
Sent: Friday, January 03, 2003 6:24 PM
To: [EMAIL PROTECTED]
Subject: Re: incoming bandwidth limiting using ipfilter


 Hari:

 I think you are going to find that rate-limiting at the box won't
 provide any fiscal relief.  The packets have already traversed your
 ISP's interface where the accounting is taking place.

 Mike

That's bad. But if the machine doesn't accept more than N packets/sec,
why would the ISP router forward any more packets to it? I wouldn't
know the internals, but isn't there any kind of flow control in the
protocol?

-- 
Hari Bhaskaran

(Mike, although I have cc-ed the list
I haven't included your email
anywhere in the reply)

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread randall ehren
  http://www.google.com/search?q=ipfilter+ipfw+together
   -- http://false.net/ipfilter/2000_02/0407.html

 This is what we settled with eventually, but the processing order for
 packets when you're using both IPF and IPFW plus ipnat is seriously
 f*rked.

not to stray too far, but if IPFW is set to allow all incoming packets and is
only used for shaping, and you have ipfilter handling nat, then it seems it
would just be:

 network card -- IPFW (traffic shape) -- IPF (filter+nat) -- userland

 i guess an internally NAT address would go back out as:
  IPF -- IPFW -- network card

 doesn't seem that bad...

 -randall

--
:// randall s. ehren :// voice 805.893.5632
:// systems administrator:// isber|survey|avss.ucsb.edu
:// institute for social, behavioral, and economic research


To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Konstantin Borovik
May be /usr/ports/sysutils/ipa is the answer to your problem.

Quote from port description:

ipa(8) allows to make IP accounting (network accounting) based on
FreeBSD IPv4/v6 Firewall (including IPFW2), OpenBSD Packet Filter and
IP Filter accounting rules on FreeBSD, NetBSD and OpenBSD.

It supports limits for accounting rules and limits events as limit is
reached, reached limit is expired, etc. It understands time intervals
like end of day, end of week, end of month, etc.

ipastat(8) is a viewer for IP accounting database made by ipa(8).

WWW: http://www.simon.org.ua/ipa/

- Andrey Simonenko
[EMAIL PROTECTED]
[EMAIL PROTECTED]


 Hi,
 
 Is there a way to limit incoming traffic (bandwidth) using
 ipfilter/ipfw or any such software tool?. I am running a mail
 server and I pay per GB transfered. If I have my ISP do the
 limiting, they charge extra $$ for it. I know I can limit
 incoming mail size via the mail server. But still doesn't
 prevent someone from sending a lot of mail or fill up
 a 100mbps line for 24 hrs/day.
 
 
 I am not looking for a perfect solution, and I do realize
 ddos attacks and such are still possible. I am only looking
 for a reasonable solution.
 
 Any help is appreciated
 
 --
 Hari Bhaskaran
 
 To Unsubscribe: send mail to [EMAIL PROTECTED]
 with unsubscribe freebsd-questions in the body of the message
 

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message



Re: incoming bandwidth limiting using ipfilter

2003-01-03 Thread Avleen Vig
On Fri, 3 Jan 2003, randall ehren wrote:

 not to stray too far, but if IPFW is set to allow all incoming packets and is
 only used for shaping, and you have ipfilter handling nat, then it seems it
 would just be:
  network card -- IPFW (traffic shape) -- IPF (filter+nat) -- userland
  i guess an internally NAT address would go back out as:
   IPF -- IPFW -- network card

We actually found it goes:

Internal Net - NIC - IPF+NAT - IPFW - World
World - IPF+NAT - IPFW - NIC - Internal net

After seeing this, I didn't even bother to see what the interal side of
the router processed as. I'm sure it would have given me a headache trying
to set up the runs.

Suffice to say, IPF+NAT always sees the packets first (at least on the
outer side of the router)

To Unsubscribe: send mail to [EMAIL PROTECTED]
with unsubscribe freebsd-questions in the body of the message