Re: Relationship Between VLANs and Physical Interfaces in PF

2014-09-05 Thread Stuart Henderson
On 2014/09/05 03:49, Abel Abraham Camarillo Ojeda wrote: > On Wed, Aug 6, 2014 at 3:38 PM, Stuart Henderson wrote: > > 1. Don't use different _in and _out names, use syntax like "queue foo on > > em0" > > and "queue foo on em1". That way you assign packets to the correct queues on > > both interf

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-09-05 Thread Abel Abraham Camarillo Ojeda
On Wed, Aug 6, 2014 at 3:38 PM, Stuart Henderson wrote: > 1. Don't use different _in and _out names, use syntax like "queue foo on em0" > and "queue foo on em1". That way you assign packets to the correct queues on > both interfaces in one step with something like "match to port 53 queue fast". >

Re: pf new queue resolution (was Relationship Between VLANs and Physical Interfaces in PF)

2014-08-19 Thread Stuart Henderson
Daniel Melameth melameth.com> writes: > > On Wed, Aug 6, 2014 at 2:38 PM, Stuart Henderson spacehopper.org> wrote: > > In my (admittedly very limited) testing with the new queueing system, > > it hasn't done very well with low bandwidth queues (ADSL type speeds) that > > used to work OK with al

pf new queue resolution (was Relationship Between VLANs and Physical Interfaces in PF)

2014-08-06 Thread Daniel Melameth
On Wed, Aug 6, 2014 at 2:38 PM, Stuart Henderson wrote: > In my (admittedly very limited) testing with the new queueing system, > it hasn't done very well with low bandwidth queues (ADSL type speeds) that > used to work OK with altq (symptom, packets being assigned to queues as > expected, but rat

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-06 Thread Stuart Henderson
On 2014-08-04, Eric Dilmore wrote: > I just set up a new OpenBSD 5.5 gateway for a small nonprofit. The > gateway has one external interface and one internal, with the internal > network split into several VLANs: one for secure traffic, one for > guests, one for internal phones, and one for our ex

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-06 Thread Giancarlo Razzolini
On 06-08-2014 05:34, Henning Brauer wrote: > Your preferences are your preferences, you're free to do that - just > like you're free to stab a knife in your eye. Not sure I'd go with this analogy. Here in my country things are a little different. Not always the networks are correctly configured. Sp

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-06 Thread David Dahlberg
Am Dienstag, den 05.08.2014, 17:05 +0100 schrieb Andy: > Considering all this, there should never be a good reason to apply > queues to the VLAN interfaces at all? Well, there may be. For example a VLAN may indeed just represent a port on a switch elsewhere. Where a certain policy applies (e.g.

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-06 Thread Henning Brauer
* Giancarlo Razzolini [2014-08-05 18:36]: > On 05-08-2014 03:36, Henning Brauer wrote: > > the 90s are over. > Yep, I know Henning. Vlan's are pretty secure. But they add complexity > and if you use physical separation you can mitigate problems caused by > misconfiguration. Either on OpenBSD itsel

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-06 Thread Henning Brauer
* Andy [2014-08-05 18:06]: > Correct me if I'm wrong here Henning, but we have always used the approach > of only ever assigning queues to the physical interface (whether it has > VLANs or not), as this means that both the physical interfaces untagged > network, plus all the tagged networks on tha

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-05 Thread Giancarlo Razzolini
On 05-08-2014 03:36, Henning Brauer wrote: > the 90s are over. Yep, I know Henning. Vlan's are pretty secure. But they add complexity and if you use physical separation you can mitigate problems caused by misconfiguration. Either on OpenBSD itself or on the switches. As I said, my personal preferen

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-05 Thread Andy
On 05/08/14 10:23, Henning Brauer wrote: * David Dahlberg [2014-08-05 10:17]: Am Dienstag, den 05.08.2014, 08:36 +0200 schrieb Henning Brauer: queueing on vlan is pretty meaningless. however, classification can happen anywhere, so assign queues on your vlan interface and create them on the ph

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-05 Thread Henning Brauer
* David Dahlberg [2014-08-05 10:17]: > Am Dienstag, den 05.08.2014, 08:36 +0200 schrieb Henning Brauer: > > > queueing on vlan is pretty meaningless. > > > however, classification can happen anywhere, so assign queues on your > > vlan interface and create them on the physical one, things will Ju

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-05 Thread David Dahlberg
Am Dienstag, den 05.08.2014, 08:36 +0200 schrieb Henning Brauer: > queueing on vlan is pretty meaningless. > however, classification can happen anywhere, so assign queues on your > vlan interface and create them on the physical one, things will Just > Work (tm). Strangely, the following (simplif

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-05 Thread Peter Hessler
On 2014 Aug 04 (Mon) at 19:01:06 -0300 (-0300), Giancarlo Razzolini wrote: :On 04-08-2014 18:09, Eric Dilmore wrote: :> I just set up a new OpenBSD 5.5 gateway for a small nonprofit. The :> gateway has one external interface and one internal, with the internal :> network split into several VLANs: o

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-04 Thread Henning Brauer
* Giancarlo Razzolini [2014-08-05 00:02]: > On 04-08-2014 18:09, Eric Dilmore wrote: > > I just set up a new OpenBSD 5.5 gateway for a small nonprofit. The > > gateway has one external interface and one internal, with the internal > > network split into several VLANs: one for secure traffic, one f

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-04 Thread Giancarlo Razzolini
On 04-08-2014 19:17, Eric Dilmore wrote: > prio sounds great on paper, but I'm pretty sure they are a per-interface > priority queue. Could it still prioritize packets from the Asterisk vlan > above those from other vlans? Yes, it is per-interface. But the prio is applied on the dequeuing. You can

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-04 Thread Chris Cappuccio
Eric Dilmore [ericdilm...@gmail.com] wrote: > Thank you for the reply, Giancarlo. There are some things I'm not quite > sure about from your response, however. > > prio sounds great on paper, but I'm pretty sure they are a per-interface > priority queue. Could it still prioritize packets from the

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-04 Thread Eric Dilmore
Thank you for the reply, Giancarlo. There are some things I'm not quite sure about from your response, however. prio sounds great on paper, but I'm pretty sure they are a per-interface priority queue. Could it still prioritize packets from the Asterisk vlan above those from other vlans? Also, I w

Re: Relationship Between VLANs and Physical Interfaces in PF

2014-08-04 Thread Giancarlo Razzolini
On 04-08-2014 18:09, Eric Dilmore wrote: > I just set up a new OpenBSD 5.5 gateway for a small nonprofit. The > gateway has one external interface and one internal, with the internal > network split into several VLANs: one for secure traffic, one for > guests, one for internal phones, and one for o

Relationship Between VLANs and Physical Interfaces in PF

2014-08-04 Thread Eric Dilmore
I just set up a new OpenBSD 5.5 gateway for a small nonprofit. The gateway has one external interface and one internal, with the internal network split into several VLANs: one for secure traffic, one for guests, one for internal phones, and one for our external Asterisk phone server. I'm trying to