Ian Smith wrote: On Thu, 22 Jan 2009 08:10:09 +0100 (CET) > > > > So far I've got those rules: > > > > in_if="em0" > > out_if="em1" > > management_if="em2" > > in_ip="100.100.100.1" > > out_ip="200.200.200.1" > > management_ip="172.16.0.201" > > client1_subnet="192.168.5.0/26" > > client2_subnet="192.168.6.0/26" > > server_subnet="192.168.7.0/24" > > > > download_bandwidth="6144Kbit/s" > > upload_bandwidth="1024Kbit/s" > > delay="0" > > queue_size="10" > > 10 slots ie packets is likely too small a queue size at these rates. > You want to check the dropped packet stats from 'ipfw pipe show' re > that; see the section in ipfw(8) about calculating sizes / delays. >
I had a look at the ipfw howto on the freebsd site [1], but I'm not 100% sure how to choose a "good" value for the queue size. If I choose the default (50 packets) it means that it takes approx. 100ms (600kbits / 6144kbits) to fill the queue. So the question is: Which value to choose for the queue? > I suggest using 'in recv' and 'out xmit' rather than via for these, for > the sake of clarity. 'in recv' and 'in via' come to the same thing, as > only the receive interface is known on inbound packets, but 'out via' > applies to packets that were *received* on the specified interface as > well as those going out on that interface after routing, which can lead > to surprising results sometimes, and being more specific never hurts .. Thanks for the hint. I'll change that. > > But when I have a look at the pipes with 'ipfw show' I can only see > > packets go through the pipe 50 and nothing goes through the other pipes > > (which makes sense actually since IPFW work that way?). > > IPFW works that way if you (likely) have net.inet.ip.fw.one_pass=1 .. so > that packets exiting from pipes aren't seen by the firewall again. If > you set one_pass=0, packets are reinjected into the firewall at the rule > following the pipe (or queue) action, which is what you want to do here. Actually this is also described in the manpage of ipfw(8). Shame on me ;-) > And you'll surely need a much larger queue for this pipe, at 100Mbit/s. > As already asked above: How do I know the queue is large or small enough for my needs? > cheers, Ian Regards, Sebastian [1] http://www.freebsd-howto.com/HOWTO/Ipfw-HOWTO _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"