Date: Mon, 29 Jul 2019 20:38:03 +0200 From: "Kristof Provost" <kp@FreeBSD.org> To: "mike tancsa" <mike@sentex.net> Cc: "Paul Webster" <paul.g.webster@googlemail.com>, freebsd-pf@freebsd.org Subject: Re: pf and dummynet Message-ID: <F1B54673-B728-44D3-B3E9-F8A356A78C4A@FreeBSD.org> In-Reply-To: <8e58346b-5540-b47e-e446-1a5bb11743d3@sentex.net> References: <d68129cd-40a4-e065-32c3-3f574eca537e@sentex.net> <5d3f305f.1c69fb81.90047.531f@mx.google.com> <20190729175134.GE10541@vega.codepro.be> <8e58346b-5540-b47e-e446-1a5bb11743d3@sentex.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 29 Jul 2019, at 20:22, mike tancsa wrote: > On 7/29/2019 1:51 PM, Kristof Provost wrote: >> >> Also beware of gotchas with things like IPv6 fragment handling or >> route-to. >> >> I do not consider mixing firewalls to be a supported configuration. >> If >> it breaks you get to keep the pieces. > > Thanks, I was worried about that! Is there a way to get altq to > limit > inbound traffic directed to a server ? I would prefer not mixing and > matching, but I dont see any other way other than going to ipfw which > I > would rather not > I don’t know. I’m not very familiar with altq. In general I’d expect quality of service and bandwidth limits to only be effective in the upstream direction (when going from a fast link to a slow one). There’s no good way to limit how much traffic other machines send to you. Regards, Kristof From owner-freebsd-pf@freebsd.org Mon Jul 29 19:32:38 2019 Return-Path: <owner-freebsd-pf@freebsd.org> Delivered-To: freebsd-pf@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id CD076B370F for <freebsd-pf@mailman.nyi.freebsd.org>; Mon, 29 Jul 2019 19:32:38 +0000 (UTC) (envelope-from mike@sentex.net) Received: from pyroxene.sentex.ca (unknown [IPv6:2607:f3e0:0:3::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "pyroxene.sentex.ca", Issuer "Let's Encrypt Authority X3" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 43221690AE; Mon, 29 Jul 2019 19:32:38 +0000 (UTC) (envelope-from mike@sentex.net) Received: from [IPv6:2607:f3e0:0:4:346a:6987:6201:ec77] ([IPv6:2607:f3e0:0:4:346a:6987:6201:ec77]) by pyroxene.sentex.ca (8.15.2/8.15.2) with ESMTPS id x6TJWaST068466 (version=TLSv1.2 cipher=AES128-SHA bits=128 verify=NO); Mon, 29 Jul 2019 15:32:36 -0400 (EDT) (envelope-from mike@sentex.net) Subject: Re: pf and dummynet To: Kristof Provost <kp@FreeBSD.org> Cc: Paul Webster <paul.g.webster@googlemail.com>, freebsd-pf@freebsd.org References: <d68129cd-40a4-e065-32c3-3f574eca537e@sentex.net> <5d3f305f.1c69fb81.90047.531f@mx.google.com> <20190729175134.GE10541@vega.codepro.be> <8e58346b-5540-b47e-e446-1a5bb11743d3@sentex.net> <F1B54673-B728-44D3-B3E9-F8A356A78C4A@FreeBSD.org> From: mike tancsa <mike@sentex.net> Message-ID: <bf5273a4-d674-e1d9-7bc4-36bef769b42a@sentex.net> Date: Mon, 29 Jul 2019 15:32:36 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <F1B54673-B728-44D3-B3E9-F8A356A78C4A@FreeBSD.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Rspamd-Queue-Id: 43221690AE X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; spf=pass (mx1.freebsd.org: domain of mike@sentex.net designates 2607:f3e0:0:3::18 as permitted sender) smtp.mailfrom=mike@sentex.net X-Spamd-Result: default: False [-1.44 / 15.00]; ARC_NA(0.00)[]; RDNS_NONE(1.00)[]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; R_SPF_ALLOW(-0.20)[+ip6:2607:f3e0::/32]; NEURAL_HAM_LONG(-0.98)[-0.976,0]; TAGGED_RCPT(0.00)[]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[sentex.net]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MX_GOOD(-0.01)[cached: smtp.sentex.ca]; NEURAL_HAM_SHORT(-0.96)[-0.959,0]; NEURAL_HAM_MEDIUM(-0.97)[-0.974,0]; IP_SCORE(-1.72)[ipnet: 2607:f3e0::/32(-4.94), asn: 11647(-3.57), country: CA(-0.09)]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:11647, ipnet:2607:f3e0::/32, country:CA]; HFILTER_HOSTNAME_UNKNOWN(2.50)[]; MID_RHS_MATCH_FROM(0.00)[]; FREEMAIL_CC(0.00)[googlemail.com] X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" <freebsd-pf.freebsd.org> List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-pf>, <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe> List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>; List-Post: <mailto:freebsd-pf@freebsd.org> List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help> List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-pf>, <mailto:freebsd-pf-request@freebsd.org?subject=subscribe> X-List-Received-Date: Mon, 29 Jul 2019 19:32:38 -0000 On 7/29/2019 2:38 PM, Kristof Provost wrote: > > On 29 Jul 2019, at 20:22, mike tancsa wrote: > > On 7/29/2019 1:51 PM, Kristof Provost wrote: > > Also beware of gotchas with things like IPv6 fragment handling or > route-to. > > I do not consider mixing firewalls to be a supported > configuration. If > it breaks you get to keep the pieces. > > Thanks, I was worried about that! Is there a way to get altq to limit > inbound traffic directed to a server ? I would prefer not mixing and > matching, but I dont see any other way other than going to ipfw > which I > would rather not > > I don’t know. I’m not very familiar with altq. > > In general I’d expect quality of service and bandwidth limits to only > be effective in the upstream direction (when going from a fast link to > a slow one). There’s no good way to limit how much traffic other > machines send to you. > Another problem is that altq doesnt seem to work with all NICs. Although cxgbe is listed in the man page still # grep cxl /etc/pf.conf altq on cxl0 cbq bandwidth 2000Mb queue { zrepl, default } # pfctl -f /etc/pf.conf pfctl: cxl0: driver does not support altq # # man altq | grep -i cxgb bce(4), bfe(4), bge(4), bxe(4), cas(4), cxgbe(4), dc(4), de(4), ed(4), ---Mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?F1B54673-B728-44D3-B3E9-F8A356A78C4A>