lkml.org 
[lkml]   [1997]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Generic IP Firewalling Chains
    Date
    From

    Hi Paul,

    > We (Michael Neuling and I) have finally released our patch for
    > more sophisticated IP firewalling; it's different enough from the
    .
    .
    > byte counters. I have two questions for those in the know:

    > 2) Does anyone actually use TOS setting? Why is it that ip_fw.c

    Yes, I *do* use it. Especially the "Minimum Delay" is important for
    me. I switch it on for "interactive" packets in my upstream (Linux)
    router. I'm behind a 33k6 modem link. Linux prioritizes packets
    in 3 queues. This way I get acceptable interactive performance
    while doing bulk downloads at the same time. (It could even be better
    if there wasn't such a big queue in the serial driver, but latency
    is kept down 1.5 seconds now).

    > mangles the TOS rules so that "minimise cost" can never be effected?

    No it works correctly (I wrote the code :-)

    Greetings,
    Rob van Nieuwkerk


    Some (TOS-related) pieces from my firewall script:
    ------------------------------------------------------------------
    ANYWHERE="0.0.0.0/0"

    TOS_MIN_DELAY="0x00 0x10"
    TOS_MAX_THROUGHPUT="0x00 0x08"
    TOS_MAX_RELIABILITY="0x00 0x04"
    TOS_MIN_COST="0x00 0x02"

    MIN_DELAY_TCP_PORTS="ftp telnet login ntp"
    MIN_DELAY_UDP_PORTS="domain ntp tftp"
    MAX_THROUGHPUT_TCP_PORTS="ftp-data"
    MAX_THROUGHPUT_UDP_PORTS=""
    MAX_RELIABILITY_TCP_PORTS=""
    MAX_RELIABILITY_UDP_PORTS="snmp"
    MIN_COST_TCP_PORTS="nntp"
    MIN_COST_UDP_PORTS=""

    ########################## Output rules
    # Type Of Service correction
    ipfwadm -O -a accept -b -P tcp -S $ANYWHERE $MIN_DELAY_TCP_PORTS -t $TOS_MIN_DELAY
    ipfwadm -O -a accept -b -P udp -S $ANYWHERE $MIN_DELAY_UDP_PORTS -t $TOS_MIN_DELAY
    ipfwadm -O -a accept -b -P tcp -S $ANYWHERE $MAX_THROUGHPUT_TCP_PORTS -t $TOS_MAX_THROUGHPUT
    ipfwadm -O -a accept -b -P udp -S $ANYWHERE $MAX_RELIABILITY_UDP_PORTS -t $TOS_MAX_RELIABILITY
    ipfwadm -O -a accept -b -P tcp -S $ANYWHERE $MIN_COST_TCP_PORTS -t $TOS_MIN_COST
    ------------------------------------------------------------------



    verdi /home/robn 24 % /sbin/ipfwadm -Ole
    IP firewall output rules, default policy: accept
    pkts bytes type prot opt tosa tosx ifname ifaddress source destination ports
    338 15540 acc tcp b--- 0x01 0x10 any any anywhere anywhere ftp,telnet,login,ntp -> any
    6695 878K acc udp b--- 0x01 0x10 any any anywhere anywhere domain,ntp,tftp -> any
    12933 517K acc tcp b--- 0x01 0x08 any any anywhere anywhere ftp-data -> any
    0 0 acc udp b--- 0x01 0x04 any any anywhere anywhere snmp -> any
    1402 56192 acc tcp b--- 0x01 0x02 any any anywhere anywhere nntp -> any

    \
     
     \ /
      Last update: 2005-03-22 13:40    [W:0.021 / U:0.656 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site