Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 10 Aug 2003 18:10:49 +0200
From:      jeremie le-hen <>
Subject:   Packets going through multiple queues
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
Hi folks,

let's imagine I want to schedule traffic going out through tun0.

First of all, in order to avoid filling modem buffers (and so having queue
delays in the modem), let's define the main pipe, through which all traffic
will go through:

	ipfw pipe 1 config bw 125Kbit/s

Now I create a queue for interactive traffic, such as SSH, with a high weight:

	ipfw queue 10 config weight 100 pipe 1 mask all

And another one for the rest of the traffic:

	ipfw queue 20 config weight 1 pipe 1

And finally the rules which will make packets going in our queues (in order
to simplify, don't take care about the TOS field, though we should in real

	ipfw add 100 queue 10 tcp from any to any 22 out via tun0
	ipfw add 101 queue 10 tcp from any 22 to any out via tun0
	ipfw add 200 queue 20 all from any to any out via tun0

This configuration works perfectly with net.inet.ip.fw.one_pass set to 1; once
an outgoing packet has matched one of this three rules, it will just stop
any further rule checking.

But now, imagine I want to limit my outgoing mail traffic, and be sure it will
not exceed 4KBytes/s. But although outgoing SMTP packets will have to go
though a particular pipe in order to achieve this, I still want to take them
in account in my traffic prioritizing. This means that net.inet.ip.fw.one_pass
must be set to 0.

If I simply configure my pipe and add a rule like this:

	ipfw pipe 2 config bw 4KBytes/s
	ipfw add 500 pipe 2 tcp from any to any 25 out via tun0

This seems to work, but in fact SSH traffic now goes through both queues 10
and 20, and I'm not sure about the efficiency of this method, I'm afraid to
loose all traffic prioritizing benefits.

One tricky way to avoid the behavior would be to add "skipto" rules after
each "queue" rules, with exactly the same rule body, but this clearly adds
a great overhead. Furthermore, my real traffic prioritizing framework uses
6 queues and number of rules, and adding "skipto" rules as I described here
is just a hard and time-wasting work.

At this point, I wonder if I missed something in ipfw(8) syntax or if the
latter is simply not enough powerful to achieve this easily.

Thanks for your advices.
Jeremie aka TtZ/TataZ

Want to link to this message? Use this URL: <>