• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Traffic shaping not working in Beta 4 for outbound queues?

Scheduled Pinned Locked Moved Traffic Shaping
45 Posts 10 Posters 21.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    dvserg
    last edited by May 18, 2006, 5:58 PM

    I'm tested shapping - all traffic shaped on default rules.
    I have ADSL (assymetric traffic speed). May be this have special options for rules?

    SquidGuardDoc EN  RU Tutorial
    Localization ru_PFSense

    1 Reply Last reply Reply Quote 0
    • S
      sullrich
      last edited by May 18, 2006, 5:58 PM

      @dvserg:

      I'm tested shapping - all traffic shaped on default rules.
      I have ADSL (assymetric traffic speed). May be this have special options for rules?

      No.  It asks for upload and download speeds during the wizard.

      1 Reply Last reply Reply Quote 0
      • D
        dvserg
        last edited by May 18, 2006, 6:35 PM

        hm..
        this my base config

         <shaper><schedulertype>hfsc</schedulertype>
        	 <queue><schedulertype><bandwidth>2</bandwidth>
        		<bandwidthtype>Mb</bandwidthtype>
        		<priority>0</priority>
        		<name>qwanRoot</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime><realtime3><realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue>on</parentqueue>
        		 <attachtoqueue><associatedrule><rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></attachtoqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></realtime3></realtime></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><schedulertype><bandwidth>256</bandwidth>
        		<bandwidthtype>Kb</bandwidthtype>
        		<priority>0</priority>
        		<name>qlanRoot</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime><realtime3><realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue>on</parentqueue>
        		 <attachtoqueue><associatedrule><rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></attachtoqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></realtime3></realtime></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><name>qwandef</name>
        		<attachtoqueue>qwanRoot</attachtoqueue>
        		<associatedrule>0</associatedrule>
        		<defaultqueue>true</defaultqueue>
        		<priority>3</priority>
        		<realtime>on</realtime>
        		<realtime3>1%</realtime3>
        		<bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<qlimit>500</qlimit></queue> 
        	 <queue><name>qlandef</name>
        		<priority>3</priority>
        		<attachtoqueue>qlanRoot</attachtoqueue>
        		<associatedrule>0</associatedrule>
        		<defaultqueue>true</defaultqueue>
        		<realtime>on</realtime>
        		<realtime3>1%</realtime3>
        		<bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<qlimit>500</qlimit></queue> 
        	 <queue><schedulertype><bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<priority>7</priority>
        		<name>qwanacks</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
        		<realtime3>1%</realtime3>
        		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qwanRoot</attachtoqueue>
        		 <associatedrule><ack>on</ack>
        		 <rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><schedulertype><bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<priority>7</priority>
        		<name>qlanacks</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
        		<realtime3>1%</realtime3>
        		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qlanRoot</attachtoqueue>
        		 <associatedrule><ack>on</ack>
        		 <rio><red><ecn><defaultqueue></defaultqueue></ecn></red></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><schedulertype><bandwidth>3</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<priority>6</priority>
        		<name>qRdpUp</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
        		<realtime3>3%</realtime3>
        		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qwanRoot</attachtoqueue>
        		 <associatedrule><rio><red>on</red>
        		<ecn>on</ecn>
        		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><schedulertype><bandwidth>3</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<priority>6</priority>
        		<name>qRdpDown</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
        		<realtime3>3%</realtime3>
        		 <realtime2><realtime1><upperlimit><upperlimit3><upperlimit2><upperlimit1><parentqueue><attachtoqueue>qlanRoot</attachtoqueue>
        		 <associatedrule><rio><red>on</red>
        		<ecn>on</ecn>
        		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></upperlimit3></upperlimit></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><name>qOthersUpH</name>
        		<attachtoqueue>qwanRoot</attachtoqueue>
        		<associatedrule>0</associatedrule>
        		<priority>6</priority>
        		<red>on</red>
        		<ecn>on</ecn>
        		<realtime>on</realtime>
        		<realtime3>1Kb</realtime3>
        		<bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype></queue> 
        	 <queue><name>qOthersDownH</name>
        		<attachtoqueue>qlanRoot</attachtoqueue>
        		<associatedrule>0</associatedrule>
        		<priority>6</priority>
        		<red>on</red>
        		<ecn>on</ecn>
        		<realtime>on</realtime>
        		<realtime3>1Kb</realtime3>
        		<bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype></queue> 
        	 <queue><name>qOthersUpL</name>
        		<attachtoqueue>qwanRoot</attachtoqueue>
        		<associatedrule>0</associatedrule>
        		<priority>2</priority>
        		<red>on</red>
        		<ecn>on</ecn>
        		<realtime>on</realtime>
        		<realtime3>1Kb</realtime3>
        		<bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<qlimit>500</qlimit></queue> 
        	 <queue><name>qOthersDownL</name>
        		<attachtoqueue>qlanRoot</attachtoqueue>
        		<associatedrule>0</associatedrule>
        		<priority>2</priority>
        		<red>on</red>
        		<ecn>on</ecn>
        		<realtime>on</realtime>
        		<realtime3>1Kb</realtime3>
        		<bandwidth>1</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<qlimit>500</qlimit></queue> 
        	 <queue><schedulertype><bandwidth>3</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<priority>2</priority>
        		<name>qwebUp</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
        		<realtime3>2Kb</realtime3>
        		 <realtime2><realtime1><upperlimit>on</upperlimit>
        		<upperlimit3>5%</upperlimit3>
        		 <upperlimit2><upperlimit1><parentqueue><attachtoqueue>qwanRoot</attachtoqueue>
        		 <associatedrule><rio><red>on</red>
        		<ecn>on</ecn>
        		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <queue><schedulertype><bandwidth>3</bandwidth>
        		<bandwidthtype>%</bandwidthtype>
        		<priority>2</priority>
        		<name>qwebDown</name>
        		 <borrow><linkshare><linkshare3><linkshare2><linkshare1><realtime>on</realtime>
        		<realtime3>2Kb</realtime3>
        		 <realtime2><realtime1><upperlimit>on</upperlimit>
        		<upperlimit3>5%</upperlimit3>
        		 <upperlimit2><upperlimit1><parentqueue><attachtoqueue>qlanRoot</attachtoqueue>
        		 <associatedrule><rio><red>on</red>
        		<ecn>on</ecn>
        		 <defaultqueue></defaultqueue></rio></associatedrule></parentqueue></upperlimit1></upperlimit2></realtime1></realtime2></linkshare1></linkshare2></linkshare3></linkshare></borrow></schedulertype></queue> 
        	 <rule><in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>22</port></destination> 
        		 <direction><iptos><tcpflags><descr>m_OtherH SSH inbound</descr>
        		<inqueue>qOthersUpH</inqueue>
        		<outqueue>qOthersDownH</outqueue></tcpflags></iptos></direction></any></rule> 
        	 <rule><in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>22</port></any></destination> 
        		 <direction><iptos><tcpflags><descr>m_OtherH SSH outbound</descr>
        		<inqueue>qOthersDownH</inqueue>
        		<outqueue>qOthersUpH</outqueue></tcpflags></iptos></direction></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network></destination> 
        		<descr>m_Other ICMP inbound</descr>
        		<protocol>icmp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any></any></destination> 
        		<descr>m_Other ICMP outbound</descr>
        		<protocol>icmp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>53-53</port></destination> 
        		<descr>m_Other DNS1 inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>53-53</port></any></destination> 
        		<descr>m_Other DNS1 outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>53-53</port></destination> 
        		<descr>m_Other DNS2 inbound</descr>
        		<protocol>udp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>53-53</port></any></destination> 
        		<descr>m_Other DNS2 outbound</descr>
        		<protocol>udp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>161-161</port></destination> 
        		<descr>m_Other SNMP2 inbound</descr>
        		<protocol>udp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>161-161</port></any></destination> 
        		<descr>m_Other SNMP2 outbound</descr>
        		<protocol>udp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>161-161</port></destination> 
        		<descr>m_Other SNMP inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>161-161</port></any></destination> 
        		<descr>m_Other SNMP outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>119-119</port></destination> 
        		<descr>m_Other NNTP1 inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>119-119</port></any></destination> 
        		<descr>m_Other NNTP1 outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>119-119</port></destination> 
        		<descr>m_Other NNTP2 inbound</descr>
        		<protocol>udp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>119-119</port></any></destination> 
        		<descr>m_Other NNTP2 outbound</descr>
        		<protocol>udp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network></destination> 
        		<descr>m_Other IPSEC inbound</descr>
        		<protocol>esp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any></any></destination> 
        		<descr>m_Other IPSEC outbound</descr>
        		<protocol>esp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>500-500</port></destination> 
        		<descr>m_Other IPSEC inbound</descr>
        		<protocol>udp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>500-500</port></any></destination> 
        		<descr>m_Other IPSEC outbound</descr>
        		<protocol>udp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network></destination> 
        		<descr>m_Other IPSEC inbound</descr>
        		<protocol>ah</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any></any></destination> 
        		<descr>m_Other IPSEC outbound</descr>
        		<protocol>ah</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>1723-1723</port></destination> 
        		<descr>m_Other PPTP inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>1723-1723</port></any></destination> 
        		<descr>m_Other PPTP outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>445-445</port></destination> 
        		<descr>m_Other SMB1 inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>445-445</port></any></destination> 
        		<descr>m_Other SMB1 outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>137-139</port></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other SMB2 inbound</descr>
        		<inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue></tcpflags></iptos></direction></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>137-139-137-139</port></any></destination> 
        		<descr>m_Other SMB2 outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>3389</port></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other MSRDP inbound</descr>
        		<inqueue>qRdpUp</inqueue>
        		<outqueue>qRdpDown</outqueue></tcpflags></iptos></direction></any></rule> 
        	 <rule><in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>3389</port></any></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other MSRDP outbound</descr>
        		<inqueue>qRdpDown</inqueue>
        		<outqueue>qRdpUp</outqueue></tcpflags></iptos></direction></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>6667-6670</port></destination> 
        		<descr>m_Other IRC inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>6667-6670</port></any></destination> 
        		<descr>m_Other IRC outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>80</port></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other HTTP inbound</descr>
        		<inqueue>qwebUp</inqueue>
        		<outqueue>qwebDown</outqueue></tcpflags></iptos></direction></any></rule> 
        	 <rule><in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>80</port></any></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other HTTP outbound</descr>
        		<inqueue>qwebDown</inqueue>
        		<outqueue>qwebUp</outqueue></tcpflags></iptos></direction></rule> 
        	 <rule><in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>443</port></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other HTTPS inbound</descr>
        		<inqueue>qwebUp</inqueue>
        		<outqueue>qwebDown</outqueue></tcpflags></iptos></direction></any></rule> 
        	 <rule><in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>443</port></any></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other HTTPS outbound</descr>
        		<inqueue>qwebDown</inqueue>
        		<outqueue>qwebUp</outqueue></tcpflags></iptos></direction></rule> 
        	 <rule><in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>3125-3129</port></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other Proxy inbound</descr>
        		<inqueue>qwebUp</inqueue>
        		<outqueue>qwebDown</outqueue></tcpflags></iptos></direction></any></rule> 
        	 <rule><in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<protocol>tcp</protocol>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>3125-3129</port></any></destination> 
        		 <direction><iptos><tcpflags><descr>m_Other Proxy outbound</descr>
        		<inqueue>qwebDown</inqueue>
        		<outqueue>qwebUp</outqueue></tcpflags></iptos></direction></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>143-143</port></destination> 
        		<descr>m_Other IMAP inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>143-143</port></any></destination> 
        		<descr>m_Other IMAP outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>110-110</port></destination> 
        		<descr>m_Other POP3 inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>110-110</port></any></destination> 
        		<descr>m_Other POP3 outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <rule><inqueue>qwandef</inqueue>
        		<outqueue>qlandef</outqueue>
        		<in-interface>wan</in-interface>
        		<out-interface>lan</out-interface>
        		<source>
        			 <any><destination><network>lan</network>
        			<port>25-25</port></destination> 
        		<descr>m_Other SMTP inbound</descr>
        		<protocol>tcp</protocol></any></rule> 
        	 <rule><inqueue>qlandef</inqueue>
        		<outqueue>qwandef</outqueue>
        		<in-interface>lan</in-interface>
        		<out-interface>wan</out-interface>
        		<source>
        			<network>lan</network>
        
        		 <destination><any><port>25-25</port></any></destination> 
        		<descr>m_Other SMTP outbound</descr>
        		<protocol>tcp</protocol></rule> 
        	 <enable></enable></shaper> 
        
        

        SquidGuardDoc EN  RU Tutorial
        Localization ru_PFSense

        1 Reply Last reply Reply Quote 0
        • S
          sullrich
          last edited by May 18, 2006, 6:41 PM

          You forgot to show /tmp/rules.debug ….

          1 Reply Last reply Reply Quote 0
          • D
            dvserg
            last edited by May 18, 2006, 6:57 PM

            # System Aliases 
            loopback = "{ lo0 }"
            lan = "{ xl0  carp0 bridge0 }"
            wan = "{ rl0  carp0 bridge0 ng0 }"
            # User Aliases 
            AdminLine = "{ 10.62.0.25 }"
            
            set loginterface rl0
            set loginterface xl0
            set optimization normal
            
            scrub on rl0 all random-id 
            altq on rl0 hfsc bandwidth 2Mb queue { qwanRoot }
            altq on xl0 hfsc bandwidth 256Kb queue { qlanRoot }
            
            queue qwanRoot bandwidth 2Mb priority 0 hfsc { qwandef, qwanacks, qRdpUp, qOthersUpH, qOthersUpL, qwebUp }
            queue qlanRoot bandwidth 256Kb priority 0 hfsc { qlandef, qlanacks, qRdpDown, qOthersDownH, qOthersDownL, qwebDown }
            queue qwandef bandwidth 1% priority 3 qlimit 500 hfsc (  default realtime 1% )
            queue qlandef bandwidth 1% priority 3 qlimit 500 hfsc (  default realtime 1% )
            queue qwanacks bandwidth 1% priority 7 hfsc (  realtime 1% )
            queue qlanacks bandwidth 1% priority 7 hfsc (  realtime 1% )
            queue qRdpUp bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
            queue qRdpDown bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
            queue qOthersUpH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
            queue qOthersDownH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
            queue qOthersUpL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
            queue qOthersDownL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
            queue qwebUp bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )
            queue qwebDown bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )
            
            # UPnPd rdr anchor
            rdr-anchor "upnpd/*"
            nat-anchor "pftpx/*"
            nat-anchor "natearly/*"
            nat-anchor "natrules/*"
            # FTP proxy
            rdr-anchor "pftpx/*"
            nat on $wan from 10.62.0.0/24 port 500 to any port 500 -> (rl0) port 500
            nat on $wan from 10.62.0.0/24 to any -> (rl0)
            #SSH Lockout Table
            table <sshlockout>persist
            
            # spam table 
            table <whitelist>persist
            table <blacklist>persist
            table <spamd>persist
            table <spamd-white>persist file "/var/db/whitelist.txt"
            rdr pass on rl0 proto tcp from <blacklist>to port smtp -> 127.0.0.1 port spamd
            rdr pass on rl0 proto tcp from <spamd>to port smtp -> 127.0.0.1 port spamd
            rdr pass on rl0 proto tcp from ! <spamd-white>to port smtp -> 127.0.0.1 port spamd
            
            # Load balancing anchor - slbd updates
            rdr-anchor "slb"
            
            # FTP Proxy/helper
            
            block in all tag unshaped label "SHAPER: first match rule"
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 22  keep state tagged unshaped tag qOthersUpH 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 22 keep state tagged qOthersUpH tag qOthersDownH
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 22  keep state tagged unshaped tag qOthersDownH 
            pass out on $wan proto tcp from any to any port 22 keep state tagged qOthersDownH tag qOthersUpH
            pass in on  $wan proto icmp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
            pass out on $lan proto icmp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
            pass in on  $lan proto icmp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
            pass out on $wan proto icmp from any to any keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 53 keep state tagged qlandef tag qwandef
            pass in on  $wan proto udp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
            pass out on $lan proto udp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
            pass in on  $lan proto udp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
            pass out on $wan proto udp from any to any port 53 keep state tagged qlandef tag qwandef
            pass in on  $wan proto udp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
            pass out on $lan proto udp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
            pass in on  $lan proto udp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
            pass out on $wan proto udp from any to any port 161 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 161 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 119 keep state tagged qlandef tag qwandef
            pass in on  $wan proto udp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
            pass out on $lan proto udp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
            pass in on  $lan proto udp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
            pass out on $wan proto udp from any to any port 119 keep state tagged qlandef tag qwandef
            pass in on  $wan proto esp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
            pass out on $lan proto esp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
            pass in on  $lan proto esp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
            pass out on $wan proto esp from any to any keep state tagged qlandef tag qwandef
            pass in on  $wan proto udp from any to 10.62.0.0/24 port 500  keep state tagged unshaped tag qwandef 
            pass out on $lan proto udp from any to 10.62.0.0/24 port 500 keep state tagged qwandef tag qlandef
            pass in on  $lan proto udp from 10.62.0.0/24 to any port 500  keep state tagged unshaped tag qlandef 
            pass out on $wan proto udp from any to any port 500 keep state tagged qlandef tag qwandef
            pass in on  $wan proto ah from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
            pass out on $lan proto ah from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
            pass in on  $lan proto ah from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
            pass out on $wan proto ah from any to any keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 1723  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 1723 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 1723  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 1723 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 445  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 445 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 445  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 445 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 137:139  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 137:139 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 137:139  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 137:139 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3389  keep state tagged unshaped tag qRdpUp 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 3389 keep state tagged qRdpUp tag qRdpDown
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3389  keep state tagged unshaped tag qRdpDown 
            pass out on $wan proto tcp from any to any port 3389 keep state tagged qRdpDown tag qRdpUp
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 6667:6670  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 6667:6670 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 6667:6670  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 6667:6670 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 80  keep state tagged unshaped tag qwebUp 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 80 keep state tagged qwebUp tag qwebDown
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 80  keep state tagged unshaped tag qwebDown 
            pass out on $wan proto tcp from any to any port 80 keep state tagged qwebDown tag qwebUp
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 443  keep state tagged unshaped tag qwebUp 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 443 keep state tagged qwebUp tag qwebDown
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 443  keep state tagged unshaped tag qwebDown 
            pass out on $wan proto tcp from any to any port 443 keep state tagged qwebDown tag qwebUp
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3125:3129  keep state tagged unshaped tag qwebUp 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 3125:3129 keep state tagged qwebUp tag qwebDown
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3125:3129  keep state tagged unshaped tag qwebDown 
            pass out on $wan proto tcp from any to any port 3125:3129 keep state tagged qwebDown tag qwebUp
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 143  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 143 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 143  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 143 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 110  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 110 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 110  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 110 keep state tagged qlandef tag qwandef
            pass in on  $wan proto tcp from any to 10.62.0.0/24 port 25  keep state tagged unshaped tag qwandef 
            pass out on $lan proto tcp from any to 10.62.0.0/24 port 25 keep state tagged qwandef tag qlandef
            pass in on  $lan proto tcp from 10.62.0.0/24 to any port 25  keep state tagged unshaped tag qlandef 
            pass out on $wan proto tcp from any to any port 25 keep state tagged qlandef tag qwandef
            
            anchor "ftpsesame/*" 
            anchor "firewallrules"
            
            # loopback
            anchor "loopback"
            pass in quick on $loopback all label "pass loopback"
            pass out quick on $loopback all label "pass loopback"
            
            # package manager early specific hook
            anchor "packageearly"
            
            # carp
            anchor "carp"
            # enable ftp-proxy
            
            anchor "ftpproxy"
            anchor "pftpx/*"
            pass in quick on xl0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost"
            pass in quick on xl0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost"
            pass in quick on rl0 inet proto tcp from port 20 to (rl0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection"
            
            # allow access to DHCP server on LAN
            anchor "dhcpserverlan"
            pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
            pass in quick on $lan proto udp from any port = 68 to 10.62.0.3 port = 67 label "allow access to DHCP server on LAN"
            pass out quick on $lan proto udp from 10.62.0.3 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
            
            pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan"
            
            # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
            antispoof for xl0
            # Support for allow limiting of TCP connections by establishment rate
            anchor "limitingesr"
            table <virusprot>block in quick from <virusprot>to any label "virusprot overload table"
            
            # let out anything from the firewall host itself and decrypted IPsec traffic
            pass out quick on rl0 all keep state label "let out anything from firewall host itself"
            # pass traffic from firewall -> out
            anchor "firewallout"
            pass out quick on rl0 all keep state tagged qwandef queue (qwandef, qwanacks) label "let out anything from firewall host itself"
            pass out quick on rl0 all keep state tagged qRdpUp queue (qRdpUp, qwanacks) label "let out anything from firewall host itself"
            pass out quick on rl0 all keep state tagged qOthersUpH queue (qOthersUpH, qwanacks) label "let out anything from firewall host itself"
            pass out quick on rl0 all keep state tagged qwebUp queue (qwebUp, qwanacks) label "let out anything from firewall host itself"
            pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"
            pass out quick on xl0 all keep state tagged qlandef queue (qlandef, qlanacks) label "let out anything from firewall host itself"
            pass out quick on xl0 all keep state tagged qRdpDown queue (qRdpDown, qlanacks) label "let out anything from firewall host itself"
            pass out quick on xl0 all keep state tagged qOthersDownH queue (qOthersDownH, qlanacks) label "let out anything from firewall host itself"
            pass out quick on xl0 all keep state tagged qwebDown queue (qwebDown, qlanacks) label "let out anything from firewall host itself"
            pass out quick on xl0 all keep state queue (qlandef, qlanacks) label "let out anything from firewall host itself"
            pass out quick on bridge0 all keep state label "let out anything from firewall host itself"
            
            # make sure the user cannot lock himself out of the webGUI or SSH
            anchor "anti-lockout"
            pass in quick from 10.62.0.0/24 to 10.62.0.3 keep state label "anti-lockout web rule"
            
            # SSH lockout
            block in log proto tcp from <sshlockout>to any port 22 label "sshlockout"
            
            # User-defined rules follow
            # Anchors for rules that might be matched by queues
            anchor qwanRoot tagged qwanRoot
            anchor qlanRoot tagged qlanRoot
            anchor qwandef tagged qwandef
            anchor qlandef tagged qlandef
            anchor qwanacks tagged qwanacks
            anchor qlanacks tagged qlanacks
            anchor qRdpUp tagged qRdpUp
            anchor qRdpDown tagged qRdpDown
            anchor qOthersUpH tagged qOthersUpH
            anchor qOthersDownH tagged qOthersDownH
            anchor qOthersUpL tagged qOthersUpL
            anchor qOthersDownL tagged qOthersDownL
            anchor qwebUp tagged qwebUp
            anchor qwebDown tagged qwebDown
            pass in log quick on $wan from any to any keep state  queue (qwandef, qwanacks)  label "USER_RULE: Default Wan -> any" 
            pass in log quick on $lan from any to any keep state  queue (qlandef, qlanacks)  label "USER_RULE: Default LAN -> any" 
            pass quick proto carp keep state
            pass quick proto pfsync
            # VPN Rules
            
            #---------------------------------------------------------------------------
            # default rules (just to be sure)
            #---------------------------------------------------------------------------
            block in log quick all label "Default block all just to be sure."
            block out log quick all label "Default block all just to be sure."</sshlockout></virusprot></virusprot></spamd-white></spamd></blacklist></spamd-white></spamd></blacklist></whitelist></sshlockout> 
            

            SquidGuardDoc EN  RU Tutorial
            Localization ru_PFSense

            1 Reply Last reply Reply Quote 0
            • B
              billm
              last edited by May 18, 2006, 7:09 PM

              queue qwebUp bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )
              queue qwebDown bandwidth 3% priority 2 hfsc (  red ecn upperlimit 5% realtime 2Kb )

              5% of 256K is really really slow (12Kbit aka 1KByte) - that's the limit you transmit web traffic OUT of your network.
              5% of 2Mbit is 102Kbit, also rather slow.

              –Bill

              pfSense core developer
              blog - http://www.ucsecurity.com/
              twitter - billmarquette

              1 Reply Last reply Reply Quote 0
              • L
                Leoandru
                last edited by May 18, 2006, 7:21 PM

                I see the problem.

                let out anything from the firewall host itself and decrypted IPsec traffic

                pass out quick on rl0 all keep state label "let out anything from firewall host itself"

                is by passing the queues. and shouldn't be there if the shaper is active. Hrm I'll poke at the code a little later.

                1 Reply Last reply Reply Quote 0
                • S
                  sullrich
                  last edited by May 18, 2006, 7:23 PM

                  @Leoandru:

                  I see the problem.

                  let out anything from the firewall host itself and decrypted IPsec traffic

                  pass out quick on rl0 all keep state label "let out anything from firewall host itself"

                  is by passing the queues. and shouldn't be there if the shaper is active. Hrm I'll poke at the code a little later.

                  That would be my fault.  We need this to allow pptp on wan client to work.  Any easy workarounds?

                  1 Reply Last reply Reply Quote 0
                  • L
                    Leoandru
                    last edited by May 18, 2006, 7:39 PM May 18, 2006, 7:37 PM

                    oh, ok.. It should be safe to remove that rule if the shaper is active since the shaper rules always creates a default pass out for each interface.

                    in his case

                    pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"

                    1 Reply Last reply Reply Quote 0
                    • S
                      sullrich
                      last edited by May 18, 2006, 7:48 PM

                      Okay, I have changed it to only install this rule if the traffic shaper is disabled.

                      If this is a full installation, please run from option 8 on the pfSense console:

                      cvs_sync.sh releng_1

                      1 Reply Last reply Reply Quote 0
                      • D
                        dvserg
                        last edited by May 19, 2006, 10:06 AM

                        @sullrich:

                        Okay, I have changed it to only install this rule if the traffic shaper is disabled.

                        If this is a full installation, please run from option 8 on the pfSense console:

                        cvs_sync.sh releng_1

                        How configure cvs_sync for update with existing firewall? (or http)

                        SquidGuardDoc EN  RU Tutorial
                        Localization ru_PFSense

                        1 Reply Last reply Reply Quote 0
                        • H
                          hoba
                          last edited by May 19, 2006, 10:22 AM

                          There is nothing to configure. Just make sure your pfSense is connected to the internet and can access/resolve pfsense.org as it will pull down the files from there. Then run the command from the shell. It will take some time. Don't use the webgui while it's updating.

                          1 Reply Last reply Reply Quote 0
                          • D
                            dvserg
                            last edited by May 19, 2006, 11:32 AM May 19, 2006, 11:23 AM

                            @hoba:

                            There is nothing to configure. Just make sure your pfSense is connected to the internet and can access/resolve pfsense.org as it will pull down the files from there. Then run the command from the shell. It will take some time. Don't use the webgui while it's updating.

                            ~~what different between internet access of webgui package_install and shell pkg_add?

                            In webgui packaged adding good without any trouble, but in shell

                            pkg_add cvsup-without-gui

                            can't connect to ftp…~~

                            cvs_sync.sh need to connect to cvs.pfsense.com only 5999 port or any?

                            SquidGuardDoc EN  RU Tutorial
                            Localization ru_PFSense

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by May 19, 2006, 3:04 PM

                              Make it easier on yourself and allow any.  It needs to connect to pfSense.com for packages as well.

                              Plus traffic from the firewall itself does not apply to the filter rules.

                              1 Reply Last reply Reply Quote 0
                              • D
                                dvserg
                                last edited by May 19, 2006, 5:55 PM

                                No. I can't see any effect after update  :(
                                Bandwidth not worked - only default and ACK

                                SquidGuardDoc EN  RU Tutorial
                                Localization ru_PFSense

                                1 Reply Last reply Reply Quote 0
                                • L
                                  Leoandru
                                  last edited by May 19, 2006, 6:17 PM May 19, 2006, 6:13 PM

                                  Look at the rules.. is the offending rule still there? the one I pointed out.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    sullrich
                                    last edited by May 19, 2006, 6:28 PM

                                    @dvserg:

                                    No. I can't see any effect after update  :(
                                    Bandwidth not worked - only default and ACK

                                    Did you reboot after running the command?

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      dvserg
                                      last edited by May 19, 2006, 6:38 PM

                                      Not. I nothing to find
                                      really worked in queue status : qwandef  qlandef  qlanacks
                                      other queues not have packets (0/pps)

                                      # System Aliases 
                                      loopback = "{ lo0 }"
                                      lan = "{ xl0  carp0 bridge0 }"
                                      wan = "{ rl0  carp0 bridge0 ng0 }"
                                      # User Aliases 
                                      AdminLine = "{ 10.62.0.25 }"
                                      
                                      set loginterface rl0
                                      set loginterface xl0
                                      set optimization normal
                                      
                                      scrub on rl0 all random-id 
                                      altq on rl0 hfsc bandwidth 2Mb queue { qwanRoot }
                                      altq on xl0 hfsc bandwidth 256Kb queue { qlanRoot }
                                      
                                      queue qwanRoot bandwidth 2Mb priority 0 hfsc { qwandef, qwanacks, qRdpUp, qOthersUpH, qOthersUpL, qwebUp }
                                      queue qlanRoot bandwidth 256Kb priority 0 hfsc { qlandef, qlanacks, qRdpDown, qOthersDownH, qOthersDownL, qwebDown }
                                      queue qwandef bandwidth 5% priority 3 hfsc (  default realtime 1% )
                                      queue qlandef bandwidth 5% priority 3 hfsc (  default realtime 1% )
                                      queue qwanacks bandwidth 5% priority 7 hfsc (  realtime 1% )
                                      queue qlanacks bandwidth 5% priority 7 hfsc (  realtime 1% )
                                      queue qRdpUp bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
                                      queue qRdpDown bandwidth 3% priority 6 hfsc (  red ecn realtime 3% )
                                      queue qOthersUpH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
                                      queue qOthersDownH bandwidth 1% priority 6 hfsc (  red ecn realtime 1Kb )
                                      queue qOthersUpL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
                                      queue qOthersDownL bandwidth 1% priority 2 qlimit 500 hfsc (  red ecn realtime 1Kb )
                                      queue qwebUp bandwidth 10% priority 2 hfsc (  red ecn realtime 5Kb )
                                      queue qwebDown bandwidth 40Kb priority 2 hfsc (  red ecn realtime 5Kb )
                                      
                                      # UPnPd rdr anchor
                                      rdr-anchor "upnpd/*"
                                      nat-anchor "pftpx/*"
                                      nat-anchor "natearly/*"
                                      nat-anchor "natrules/*"
                                      # FTP proxy
                                      rdr-anchor "pftpx/*"
                                      nat on $wan from 10.62.0.0/24 port 500 to any port 500 -> (rl0) port 500
                                      nat on $wan from 10.62.0.0/24 to any -> (rl0)
                                      #SSH Lockout Table
                                      table <sshlockout>persist
                                      
                                      # spam table 
                                      table <whitelist>persist
                                      table <blacklist>persist
                                      table <spamd>persist
                                      table <spamd-white>persist file "/var/db/whitelist.txt"
                                      rdr pass on rl0 proto tcp from <blacklist>to port smtp -> 127.0.0.1 port spamd
                                      rdr pass on rl0 proto tcp from <spamd>to port smtp -> 127.0.0.1 port spamd
                                      rdr pass on rl0 proto tcp from ! <spamd-white>to port smtp -> 127.0.0.1 port spamd
                                      
                                      # Load balancing anchor - slbd updates
                                      rdr-anchor "slb"
                                      
                                      # FTP Proxy/helper
                                      
                                      block in all tag unshaped label "SHAPER: first match rule"
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 22  keep state tagged unshaped tag qOthersUpH 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 22 keep state tagged qOthersUpH tag qOthersDownH
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 22  keep state tagged unshaped tag qOthersDownH 
                                      pass out on $wan proto tcp from any to any port 22 keep state tagged qOthersDownH tag qOthersUpH
                                      pass in on  $wan proto icmp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto icmp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto icmp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto icmp from any to any keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 53 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto udp from any to 10.62.0.0/24 port 53  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto udp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto udp from 10.62.0.0/24 to any port 53  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto udp from any to any port 53 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto udp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto udp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto udp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto udp from any to any port 161 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 161  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 161  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 161 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 119 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto udp from any to 10.62.0.0/24 port 119  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto udp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto udp from 10.62.0.0/24 to any port 119  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto udp from any to any port 119 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto esp from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto esp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto esp from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto esp from any to any keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto udp from any to 10.62.0.0/24 port 500  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto udp from any to 10.62.0.0/24 port 500 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto udp from 10.62.0.0/24 to any port 500  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto udp from any to any port 500 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto ah from any to 10.62.0.0/24  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto ah from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto ah from 10.62.0.0/24 to any  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto ah from any to any keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 1723  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 1723 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 1723  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 1723 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 445  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 445 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 445  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 445 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 137:139  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 137:139 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 137:139  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 137:139 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3389  keep state tagged unshaped tag qRdpUp 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 3389 keep state tagged qRdpUp tag qRdpDown
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3389  keep state tagged unshaped tag qRdpDown 
                                      pass out on $wan proto tcp from any to any port 3389 keep state tagged qRdpDown tag qRdpUp
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 6667:6670  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 6667:6670 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 6667:6670  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 6667:6670 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 80  keep state tagged unshaped tag qwebUp 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 80 keep state tagged qwebUp tag qwebDown
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 80  keep state tagged unshaped tag qwebDown 
                                      pass out on $wan proto tcp from any to any port 80 keep state tagged qwebDown tag qwebUp
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 443  keep state tagged unshaped tag qwebUp 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 443 keep state tagged qwebUp tag qwebDown
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 443  keep state tagged unshaped tag qwebDown 
                                      pass out on $wan proto tcp from any to any port 443 keep state tagged qwebDown tag qwebUp
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 3125:3129  keep state tagged unshaped tag qwebUp 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 3125:3129 keep state tagged qwebUp tag qwebDown
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 3125:3129  keep state tagged unshaped tag qwebDown 
                                      pass out on $wan proto tcp from any to any port 3125:3129 keep state tagged qwebDown tag qwebUp
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 143  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 143 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 143  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 143 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 110  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 110 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 110  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 110 keep state tagged qlandef tag qwandef
                                      pass in on  $wan proto tcp from any to 10.62.0.0/24 port 25  keep state tagged unshaped tag qwandef 
                                      pass out on $lan proto tcp from any to 10.62.0.0/24 port 25 keep state tagged qwandef tag qlandef
                                      pass in on  $lan proto tcp from 10.62.0.0/24 to any port 25  keep state tagged unshaped tag qlandef 
                                      pass out on $wan proto tcp from any to any port 25 keep state tagged qlandef tag qwandef
                                      
                                      anchor "ftpsesame/*" 
                                      anchor "firewallrules"
                                      
                                      # loopback
                                      anchor "loopback"
                                      pass in quick on $loopback all label "pass loopback"
                                      pass out quick on $loopback all label "pass loopback"
                                      
                                      # package manager early specific hook
                                      anchor "packageearly"
                                      
                                      # carp
                                      anchor "carp"
                                      # enable ftp-proxy
                                      
                                      anchor "ftpproxy"
                                      anchor "pftpx/*"
                                      pass in quick on xl0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost"
                                      pass in quick on xl0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost"
                                      pass in quick on rl0 inet proto tcp from port 20 to (rl0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection"
                                      
                                      # allow access to DHCP server on LAN
                                      anchor "dhcpserverlan"
                                      pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN"
                                      pass in quick on $lan proto udp from any port = 68 to 10.62.0.3 port = 67 label "allow access to DHCP server on LAN"
                                      pass out quick on $lan proto udp from 10.62.0.3 port = 67 to any port = 68 label "allow access to DHCP server on LAN"
                                      
                                      pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan"
                                      
                                      # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
                                      antispoof for xl0
                                      # Support for allow limiting of TCP connections by establishment rate
                                      anchor "limitingesr"
                                      table <virusprot>block in quick from <virusprot>to any label "virusprot overload table"
                                      # pass traffic from firewall -> out
                                      anchor "firewallout"
                                      pass out quick on rl0 all keep state tagged qwandef queue (qwandef, qwanacks) label "let out anything from firewall host itself"
                                      pass out quick on rl0 all keep state tagged qRdpUp queue (qRdpUp, qwanacks) label "let out anything from firewall host itself"
                                      pass out quick on rl0 all keep state tagged qOthersUpH queue (qOthersUpH, qwanacks) label "let out anything from firewall host itself"
                                      pass out quick on rl0 all keep state tagged qwebUp queue (qwebUp, qwanacks) label "let out anything from firewall host itself"
                                      pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"
                                      pass out quick on xl0 all keep state tagged qlandef queue (qlandef, qlanacks) label "let out anything from firewall host itself"
                                      pass out quick on xl0 all keep state tagged qRdpDown queue (qRdpDown, qlanacks) label "let out anything from firewall host itself"
                                      pass out quick on xl0 all keep state tagged qOthersDownH queue (qOthersDownH, qlanacks) label "let out anything from firewall host itself"
                                      pass out quick on xl0 all keep state tagged qwebDown queue (qwebDown, qlanacks) label "let out anything from firewall host itself"
                                      pass out quick on xl0 all keep state queue (qlandef, qlanacks) label "let out anything from firewall host itself"
                                      pass out quick on bridge0 all keep state label "let out anything from firewall host itself"
                                      
                                      # make sure the user cannot lock himself out of the webGUI or SSH
                                      anchor "anti-lockout"
                                      pass in quick from 10.62.0.0/24 to 10.62.0.3 keep state label "anti-lockout web rule"
                                      
                                      # SSH lockout
                                      block in log proto tcp from <sshlockout>to any port 22 label "sshlockout"
                                      
                                      # User-defined rules follow
                                      # Anchors for rules that might be matched by queues
                                      anchor qwanRoot tagged qwanRoot
                                      anchor qlanRoot tagged qlanRoot
                                      anchor qwandef tagged qwandef
                                      anchor qlandef tagged qlandef
                                      anchor qwanacks tagged qwanacks
                                      anchor qlanacks tagged qlanacks
                                      anchor qRdpUp tagged qRdpUp
                                      anchor qRdpDown tagged qRdpDown
                                      anchor qOthersUpH tagged qOthersUpH
                                      anchor qOthersDownH tagged qOthersDownH
                                      anchor qOthersUpL tagged qOthersUpL
                                      anchor qOthersDownL tagged qOthersDownL
                                      anchor qwebUp tagged qwebUp
                                      anchor qwebDown tagged qwebDown
                                      pass in log quick on $wan from any to any keep state  queue (qwandef, qwanacks)  label "USER_RULE: Default Wan -> any" 
                                      pass in log quick on $lan from any to any keep state  queue (qlandef, qlanacks)  label "USER_RULE: Default LAN -> any" 
                                      pass quick proto carp keep state
                                      pass quick proto pfsync
                                      # VPN Rules
                                      
                                      #---------------------------------------------------------------------------
                                      # default rules (just to be sure)
                                      #---------------------------------------------------------------------------
                                      block in log quick all label "Default block all just to be sure."
                                      block out log quick all label "Default block all just to be sure."</sshlockout></virusprot></virusprot></spamd-white></spamd></blacklist></spamd-white></spamd></blacklist></whitelist></sshlockout> 
                                      

                                      SquidGuardDoc EN  RU Tutorial
                                      Localization ru_PFSense

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        darrendavid
                                        last edited by May 19, 2006, 6:45 PM

                                        hey-

                                        same issue here. I want to see if a cvs_sync fixes it, but I'm on a soekris and / is mounted read-only… and of course i can't edit /etc/fstab because, well, / is mounted read-only. what's the trick for cvs_sync'ing on a WRAP box?

                                        thanks,
                                        darren

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sullrich
                                          last edited by May 19, 2006, 6:48 PM

                                          @darrendavid:

                                          hey-

                                          same issue here. I want to see if a cvs_sync fixes it, but I'm on a soekris and / is mounted read-only… and of course i can't edit /etc/fstab because, well, / is mounted read-only. what's the trick for cvs_sync'ing on a WRAP box?

                                          thanks,
                                          darren

                                          There is no trick.  This does not work with Embedded platforms.

                                          1 Reply Last reply Reply Quote 0
                                          17 out of 45
                                          • First post
                                            17/45
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received