From owner-freebsd-pf@FreeBSD.ORG Mon Nov 29 19:01:40 2004 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7050F16A4CE for ; Mon, 29 Nov 2004 19:01:40 +0000 (GMT) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.186]) by mx1.FreeBSD.org (Postfix) with ESMTP id CAA9743D62 for ; Mon, 29 Nov 2004 19:01:39 +0000 (GMT) (envelope-from max@love2party.net) Received: from [212.227.126.162] (helo=mrelayng.kundenserver.de) by moutng.kundenserver.de with esmtp (Exim 3.35 #1) id 1CYqmI-0000WQ-00; Mon, 29 Nov 2004 20:01:38 +0100 Received: from [217.83.4.92] (helo=donor.laier.local) by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1CYqmI-00085l-00; Mon, 29 Nov 2004 20:01:38 +0100 From: Max Laier To: freebsd-pf@freebsd.org Date: Mon, 29 Nov 2004 20:01:59 +0100 User-Agent: KMail/1.7.1 References: <20041128235145.942843@mzk> In-Reply-To: <20041128235145.942843@mzk> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart6225242.WpBz4xAVmt"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200411292002.10067.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de auth:61c499deaeeba3ba5be80f48ecc83056 Subject: Re: PF strange problem. X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical discussion and general questions about packet filter (pf) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Nov 2004 19:01:40 -0000 --nextPart6225242.WpBz4xAVmt Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Sunday 28 November 2004 22:51, mzk wrote: > First sorry my English and sorry my other mistakes, but that is my first > post in mailing list ever. :-) Today i understood my pf doesn't work > properly. For each host of my network i have 4 rules, 2 out (from int_if) > and 2 in like: > > pass out quick on $int_if from to $host queue peering_host_in > pass out quick on $int_if from any to $host queue host_in > pass in quick on $int_if proto { tcp, udp } from $host to port > $ports > pass in quick on $int_if proto { tcp, udp } from $host to any port=20 > $ports Okay, first of all some generic notes: 1) Consider stateful rules. It will not only make the firewall faster but w= ill=20 also make sure that all outgoing traffic of a "connection" is enqueued to t= he=20 same queue. This simplifies the ruleset a lot. 2) Use "$pfctl -vv -tpeering -Ttest [someip]" to verify that the table real= ly=20 contains what you think it does. > The problem is, that the first `peering` rule works like the second one -> > it pass everything from anyone using the peering_host_in queue. If i > comment it, the second rule works, but that's not the idea. So my > international connection (the second rules) is overloaded and i could not > make good QoS. I am using GENERIC with these options, added by me -> I don't really get what you are saying here. Sorry. Can you try to rephrase= ,=20 please? Maybe you can also include the rules in question with match-counter= s:=20 "$pfctl -vvsr" and the queue stats: "$pfctl -vsq" Both are also good tools= =20 for debugging the ruleset. I hope these pointers help, and am really sorry that I don't fully understa= nd=20 what the problem is. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart6225242.WpBz4xAVmt Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQBBq3IxXyyEoT62BG0RAphcAJwJIUhWbJtXUXt/NfDI483nCH8ZeQCdGfhI xKW7rkZARD1QNgDQ1q+mG3U= =PzFK -----END PGP SIGNATURE----- --nextPart6225242.WpBz4xAVmt--