[lkml]   [1997]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Generic IP Firewalling Chains

    Hi Paul,

    > We (Michael Neuling and I) have finally released our patch for
    > more sophisticated IP firewalling; it's different enough from the
    > byte counters. I have two questions for those in the know:

    > 2) Does anyone actually use TOS setting? Why is it that ip_fw.c

    Yes, I *do* use it. Especially the "Minimum Delay" is important for
    me. I switch it on for "interactive" packets in my upstream (Linux)
    router. I'm behind a 33k6 modem link. Linux prioritizes packets
    in 3 queues. This way I get acceptable interactive performance
    while doing bulk downloads at the same time. (It could even be better
    if there wasn't such a big queue in the serial driver, but latency
    is kept down 1.5 seconds now).

    > mangles the TOS rules so that "minimise cost" can never be effected?

    No it works correctly (I wrote the code :-)

    Rob van Nieuwkerk

    Some (TOS-related) pieces from my firewall script:

    TOS_MIN_DELAY="0x00 0x10"
    TOS_MAX_THROUGHPUT="0x00 0x08"
    TOS_MAX_RELIABILITY="0x00 0x04"
    TOS_MIN_COST="0x00 0x02"

    MIN_DELAY_TCP_PORTS="ftp telnet login ntp"
    MIN_DELAY_UDP_PORTS="domain ntp tftp"

    ########################## Output rules
    # Type Of Service correction
    ipfwadm -O -a accept -b -P tcp -S $ANYWHERE $MIN_DELAY_TCP_PORTS -t $TOS_MIN_DELAY
    ipfwadm -O -a accept -b -P udp -S $ANYWHERE $MIN_DELAY_UDP_PORTS -t $TOS_MIN_DELAY
    ipfwadm -O -a accept -b -P tcp -S $ANYWHERE $MAX_THROUGHPUT_TCP_PORTS -t $TOS_MAX_THROUGHPUT
    ipfwadm -O -a accept -b -P tcp -S $ANYWHERE $MIN_COST_TCP_PORTS -t $TOS_MIN_COST

    verdi /home/robn 24 % /sbin/ipfwadm -Ole
    IP firewall output rules, default policy: accept
    pkts bytes type prot opt tosa tosx ifname ifaddress source destination ports
    338 15540 acc tcp b--- 0x01 0x10 any any anywhere anywhere ftp,telnet,login,ntp -> any
    6695 878K acc udp b--- 0x01 0x10 any any anywhere anywhere domain,ntp,tftp -> any
    12933 517K acc tcp b--- 0x01 0x08 any any anywhere anywhere ftp-data -> any
    0 0 acc udp b--- 0x01 0x04 any any anywhere anywhere snmp -> any
    1402 56192 acc tcp b--- 0x01 0x02 any any anywhere anywhere nntp -> any

     \ /
      Last update: 2005-03-22 13:40    [W:0.023 / U:5.832 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site