Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-14 Thread Karl O. Pinc
On 01/14/2011 04:48:48 AM, Stuart Henderson wrote: > I'm not sure what the 3.9 docs said, this is what the current OS has > to say about "queue...on" in pf.conf(5): > > on >Specifies the interface the queue operates on. If not > given, it >operates on all matching i

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-14 Thread Stuart Henderson
On 2011/01/14 00:24, Bonnie Packet wrote: > Bingo! Thank you Kelley and (especially again) StuartH. > > Seems I was confused because the "queue" directives will work without > specifying an explicit interfaceso I assumed it just used the > interface given in the most recent "altq" given above

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-14 Thread Bonnie Packet
Bingo! Thank you Kelley and (especially again) StuartH. Seems I was confused because the "queue" directives will work without specifying an explicit interfaceso I assumed it just used the interface given in the most recent "altq" given above it. But that's not the case - and it seems it works

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-12 Thread Kelley Reynolds
From the faq: The syntax for the queue directive is: queue name [on interface] bandwidth bw [priority pri] [qlimit qlim] \ scheduler ( sched_options ) { queue_list } Specify on which interface you are assigning each queue. queue bob on fxp0 queue bob on fxp1 Kelley Reynolds Presiden

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-12 Thread Stuart Henderson
On 2011/01/12 08:40, Bonnie Packet wrote: > altq on $int_if cbq bandwidth 5000Kb queue { std, slow, fast, tcpack } > queue std bandwidth 1200Kb priority 1 cbq(default borrow) you're looking for this format: queue std on $int_if bandwidth 1200Kb priority 1 cbq(default borrow) ..etc.. I don't reca

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-12 Thread Bonnie Packet
If you look at the posting from yesterday, you'll see the attempted setup is on two different interfaces, yes. That's been the case from the start. However, when I try to do the setup suggested by folks here several times now (same queue name repeated on another interface) pf complains bitterly an

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-12 Thread Jason Healy
On Jan 11, 2011, at 1:35 AM, Bonnie Packet wrote: > Note that I know PF reasonably well and have altq queuing / rate > limiting working perfectly already in ONE direction (right now, the > high-bandwidth download side) - I just can't figure out how to get it > working in both directions, up and do

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Bonnie Packet
On Jan 11, 2:44=A0pm, s...@spacehopper.org (Stuart Henderson) wrote: > On 2011/01/11 12:46, Bonnie Packet wrote: > > > =A0 =A0 =A0 =A0 the question is how to manage it simultaneously with th= e > > download direction when those packets already part of an established, > > stateful TCP connection tha

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Stuart Henderson
On 2011/01/11 12:46, Bonnie Packet wrote: > the question is how to manage it simultaneously with the > download direction when those packets already part of an established, > stateful TCP connection that bypasses the firewall rules. the PF state is associated with queue by name - you can u

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Kelley Reynolds
All you need to do is specify the queue to be the same name in inbound and outbound. Once you label a state/packet as part of a queue, it's sticky. If it's on the way out interface A and it has a queue named 'bob' and you've assigned it to the 'bob' queue, it'll be queued. If you create a queue

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Karl O. Pinc
On 01/11/2011 01:17:02 PM, Kyle Lanclos wrote: > Karl O. Pinc wrote: > > There are may proofs that throttling TCP works, starting > > with the original paper (Van Jacoson) in 1988 through > > to the many products today that _do_ manage to reserve enough > > inbound bandwidth that, e.g., VOIP works

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Bonnie Packet
Although I respect the theoretical argument that "you can't shape/ limit inbound packets", my observations agree with those of with Karl that it's simply not true in the real world. If you read my original posting, I am effectively limiting inbound traffic as far as the user is concerned (inbound =

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Kyle Lanclos
Karl O. Pinc wrote: > There are may proofs that throttling TCP works, starting > with the original paper (Van Jacoson) in 1988 through > to the many products today that _do_ manage to reserve enough > inbound bandwidth that, e.g., VOIP works reliably. I once > promised on this list to setup a test

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Karl O. Pinc
On 01/11/2011 09:23:48 AM, Daniel Staal wrote: > > On Tue, January 11, 2011 1:35 am, Bonnie Packet wrote: > The problem with trying to throttle incoming bandwidth is that no > matter > what you do, you have already received the packets. As long as your > internal network is faster than the exte

Re: Working example of bi-directional asymmetric ALTQ + NAT ruleset?

2011-01-11 Thread Daniel Staal
On Tue, January 11, 2011 1:35 am, Bonnie Packet wrote: > I have an 12mbit down/1mbit up ADSL connection, an OpenBSD router- > firewall, and several Net-hungry roommates connecting through it. > So...I want to give each roomie a guaranteed bandwidth allotment, but > not let them hog the ADSL pipe i