Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 24 Apr 2015 10:45:08 +1000
From:      Olaf de Bree <odebree@gmail.com>
To:        freebsd-pf@freebsd.org
Subject:   pf state tracking??
Message-ID:  <CAAVr=y7NTJPsTT0xQVMuiNMn2jn6c7noTvsFvpKPvAFJpMd59w@mail.gmail.com>

next in thread | raw e-mail | index | archive | help
Hi all,

I'm hoping someone can help me with an issue i have with pf and tos
matching.

I wish to assign tos marked reply packets to an altq queue but i find that
when using the keep state option on a rule reply traffic is not inspected
and queued correctly because pf has a state for the request.

queuing should be performed out bound on the inside INT


EG

Client ----NO TOS----> Inside INT (PF) Outside INT
------------------------->Internet
           <-------------------------------TOS
MARKED---------------------------------

It works correctly when using no state but i would like to keep state so i
may also use dummy net pipes at patch from the pfsense project

Working

pass out on em0 inet from any to <beam50143> tos 0x60 no state label
"USER_RULE: Normal Beam 501 CVC 43" queue q50143n

Not working

pass out on em0 inet from any to <beam50143> tos 0x60 keep state label
"USER_RULE: Normal Beam 501 CVC 43" queue q50143n

Is there any way to override PF's behaviour to inspect the reply traffic
and classify it correctly

Thanks in advance
Olaf



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAAVr=y7NTJPsTT0xQVMuiNMn2jn6c7noTvsFvpKPvAFJpMd59w>