Traffic shaping not working in Beta 4 for outbound queues?
-
-
I see the problem.
let out anything from the firewall host itself and decrypted IPsec traffic
pass out quick on rl0 all keep state label "let out anything from firewall host itself"
is by passing the queues. and shouldn't be there if the shaper is active. Hrm I'll poke at the code a little later.
That would be my fault. We need this to allow pptp on wan client to work. Any easy workarounds?
-
oh, ok.. It should be safe to remove that rule if the shaper is active since the shaper rules always creates a default pass out for each interface.
in his case
pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself"
-
Okay, I have changed it to only install this rule if the traffic shaper is disabled.
If this is a full installation, please run from option 8 on the pfSense console:
cvs_sync.sh releng_1
-
Okay, I have changed it to only install this rule if the traffic shaper is disabled.
If this is a full installation, please run from option 8 on the pfSense console:
cvs_sync.sh releng_1
How configure cvs_sync for update with existing firewall? (or http)
-
There is nothing to configure. Just make sure your pfSense is connected to the internet and can access/resolve pfsense.org as it will pull down the files from there. Then run the command from the shell. It will take some time. Don't use the webgui while it's updating.
-
There is nothing to configure. Just make sure your pfSense is connected to the internet and can access/resolve pfsense.org as it will pull down the files from there. Then run the command from the shell. It will take some time. Don't use the webgui while it's updating.
~~what different between internet access of webgui package_install and shell pkg_add?
In webgui packaged adding good without any trouble, but in shell
pkg_add cvsup-without-gui
can't connect to ftp…~~
cvs_sync.sh need to connect to cvs.pfsense.com only 5999 port or any?
-
Make it easier on yourself and allow any. It needs to connect to pfSense.com for packages as well.
Plus traffic from the firewall itself does not apply to the filter rules.
-
No. I can't see any effect after update :(
Bandwidth not worked - only default and ACK -
Look at the rules.. is the offending rule still there? the one I pointed out.
-
No. I can't see any effect after update :(
Bandwidth not worked - only default and ACKDid you reboot after running the command?
-
Not. I nothing to find
really worked in queue status : qwandef qlandef qlanacks
other queues not have packets (0/pps)# System Aliases loopback = "{ lo0 }" lan = "{ xl0 carp0 bridge0 }" wan = "{ rl0 carp0 bridge0 ng0 }" # User Aliases AdminLine = "{ 10.62.0.25 }" set loginterface rl0 set loginterface xl0 set optimization normal scrub on rl0 all random-id altq on rl0 hfsc bandwidth 2Mb queue { qwanRoot } altq on xl0 hfsc bandwidth 256Kb queue { qlanRoot } queue qwanRoot bandwidth 2Mb priority 0 hfsc { qwandef, qwanacks, qRdpUp, qOthersUpH, qOthersUpL, qwebUp } queue qlanRoot bandwidth 256Kb priority 0 hfsc { qlandef, qlanacks, qRdpDown, qOthersDownH, qOthersDownL, qwebDown } queue qwandef bandwidth 5% priority 3 hfsc ( default realtime 1% ) queue qlandef bandwidth 5% priority 3 hfsc ( default realtime 1% ) queue qwanacks bandwidth 5% priority 7 hfsc ( realtime 1% ) queue qlanacks bandwidth 5% priority 7 hfsc ( realtime 1% ) queue qRdpUp bandwidth 3% priority 6 hfsc ( red ecn realtime 3% ) queue qRdpDown bandwidth 3% priority 6 hfsc ( red ecn realtime 3% ) queue qOthersUpH bandwidth 1% priority 6 hfsc ( red ecn realtime 1Kb ) queue qOthersDownH bandwidth 1% priority 6 hfsc ( red ecn realtime 1Kb ) queue qOthersUpL bandwidth 1% priority 2 qlimit 500 hfsc ( red ecn realtime 1Kb ) queue qOthersDownL bandwidth 1% priority 2 qlimit 500 hfsc ( red ecn realtime 1Kb ) queue qwebUp bandwidth 10% priority 2 hfsc ( red ecn realtime 5Kb ) queue qwebDown bandwidth 40Kb priority 2 hfsc ( red ecn realtime 5Kb ) # UPnPd rdr anchor rdr-anchor "upnpd/*" nat-anchor "pftpx/*" nat-anchor "natearly/*" nat-anchor "natrules/*" # FTP proxy rdr-anchor "pftpx/*" nat on $wan from 10.62.0.0/24 port 500 to any port 500 -> (rl0) port 500 nat on $wan from 10.62.0.0/24 to any -> (rl0) #SSH Lockout Table table <sshlockout>persist # spam table table <whitelist>persist table <blacklist>persist table <spamd>persist table <spamd-white>persist file "/var/db/whitelist.txt" rdr pass on rl0 proto tcp from <blacklist>to port smtp -> 127.0.0.1 port spamd rdr pass on rl0 proto tcp from <spamd>to port smtp -> 127.0.0.1 port spamd rdr pass on rl0 proto tcp from ! <spamd-white>to port smtp -> 127.0.0.1 port spamd # Load balancing anchor - slbd updates rdr-anchor "slb" # FTP Proxy/helper block in all tag unshaped label "SHAPER: first match rule" pass in on $wan proto tcp from any to 10.62.0.0/24 port 22 keep state tagged unshaped tag qOthersUpH pass out on $lan proto tcp from any to 10.62.0.0/24 port 22 keep state tagged qOthersUpH tag qOthersDownH pass in on $lan proto tcp from 10.62.0.0/24 to any port 22 keep state tagged unshaped tag qOthersDownH pass out on $wan proto tcp from any to any port 22 keep state tagged qOthersDownH tag qOthersUpH pass in on $wan proto icmp from any to 10.62.0.0/24 keep state tagged unshaped tag qwandef pass out on $lan proto icmp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef pass in on $lan proto icmp from 10.62.0.0/24 to any keep state tagged unshaped tag qlandef pass out on $wan proto icmp from any to any keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 53 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 53 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 53 keep state tagged qlandef tag qwandef pass in on $wan proto udp from any to 10.62.0.0/24 port 53 keep state tagged unshaped tag qwandef pass out on $lan proto udp from any to 10.62.0.0/24 port 53 keep state tagged qwandef tag qlandef pass in on $lan proto udp from 10.62.0.0/24 to any port 53 keep state tagged unshaped tag qlandef pass out on $wan proto udp from any to any port 53 keep state tagged qlandef tag qwandef pass in on $wan proto udp from any to 10.62.0.0/24 port 161 keep state tagged unshaped tag qwandef pass out on $lan proto udp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef pass in on $lan proto udp from 10.62.0.0/24 to any port 161 keep state tagged unshaped tag qlandef pass out on $wan proto udp from any to any port 161 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 161 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 161 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 161 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 161 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 119 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 119 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 119 keep state tagged qlandef tag qwandef pass in on $wan proto udp from any to 10.62.0.0/24 port 119 keep state tagged unshaped tag qwandef pass out on $lan proto udp from any to 10.62.0.0/24 port 119 keep state tagged qwandef tag qlandef pass in on $lan proto udp from 10.62.0.0/24 to any port 119 keep state tagged unshaped tag qlandef pass out on $wan proto udp from any to any port 119 keep state tagged qlandef tag qwandef pass in on $wan proto esp from any to 10.62.0.0/24 keep state tagged unshaped tag qwandef pass out on $lan proto esp from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef pass in on $lan proto esp from 10.62.0.0/24 to any keep state tagged unshaped tag qlandef pass out on $wan proto esp from any to any keep state tagged qlandef tag qwandef pass in on $wan proto udp from any to 10.62.0.0/24 port 500 keep state tagged unshaped tag qwandef pass out on $lan proto udp from any to 10.62.0.0/24 port 500 keep state tagged qwandef tag qlandef pass in on $lan proto udp from 10.62.0.0/24 to any port 500 keep state tagged unshaped tag qlandef pass out on $wan proto udp from any to any port 500 keep state tagged qlandef tag qwandef pass in on $wan proto ah from any to 10.62.0.0/24 keep state tagged unshaped tag qwandef pass out on $lan proto ah from any to 10.62.0.0/24 keep state tagged qwandef tag qlandef pass in on $lan proto ah from 10.62.0.0/24 to any keep state tagged unshaped tag qlandef pass out on $wan proto ah from any to any keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 1723 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 1723 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 1723 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 1723 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 445 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 445 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 445 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 445 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 137:139 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 137:139 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 137:139 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 137:139 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 3389 keep state tagged unshaped tag qRdpUp pass out on $lan proto tcp from any to 10.62.0.0/24 port 3389 keep state tagged qRdpUp tag qRdpDown pass in on $lan proto tcp from 10.62.0.0/24 to any port 3389 keep state tagged unshaped tag qRdpDown pass out on $wan proto tcp from any to any port 3389 keep state tagged qRdpDown tag qRdpUp pass in on $wan proto tcp from any to 10.62.0.0/24 port 6667:6670 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 6667:6670 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 6667:6670 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 6667:6670 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 80 keep state tagged unshaped tag qwebUp pass out on $lan proto tcp from any to 10.62.0.0/24 port 80 keep state tagged qwebUp tag qwebDown pass in on $lan proto tcp from 10.62.0.0/24 to any port 80 keep state tagged unshaped tag qwebDown pass out on $wan proto tcp from any to any port 80 keep state tagged qwebDown tag qwebUp pass in on $wan proto tcp from any to 10.62.0.0/24 port 443 keep state tagged unshaped tag qwebUp pass out on $lan proto tcp from any to 10.62.0.0/24 port 443 keep state tagged qwebUp tag qwebDown pass in on $lan proto tcp from 10.62.0.0/24 to any port 443 keep state tagged unshaped tag qwebDown pass out on $wan proto tcp from any to any port 443 keep state tagged qwebDown tag qwebUp pass in on $wan proto tcp from any to 10.62.0.0/24 port 3125:3129 keep state tagged unshaped tag qwebUp pass out on $lan proto tcp from any to 10.62.0.0/24 port 3125:3129 keep state tagged qwebUp tag qwebDown pass in on $lan proto tcp from 10.62.0.0/24 to any port 3125:3129 keep state tagged unshaped tag qwebDown pass out on $wan proto tcp from any to any port 3125:3129 keep state tagged qwebDown tag qwebUp pass in on $wan proto tcp from any to 10.62.0.0/24 port 143 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 143 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 143 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 143 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 110 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 110 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 110 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 110 keep state tagged qlandef tag qwandef pass in on $wan proto tcp from any to 10.62.0.0/24 port 25 keep state tagged unshaped tag qwandef pass out on $lan proto tcp from any to 10.62.0.0/24 port 25 keep state tagged qwandef tag qlandef pass in on $lan proto tcp from 10.62.0.0/24 to any port 25 keep state tagged unshaped tag qlandef pass out on $wan proto tcp from any to any port 25 keep state tagged qlandef tag qwandef anchor "ftpsesame/*" anchor "firewallrules" # loopback anchor "loopback" pass in quick on $loopback all label "pass loopback" pass out quick on $loopback all label "pass loopback" # package manager early specific hook anchor "packageearly" # carp anchor "carp" # enable ftp-proxy anchor "ftpproxy" anchor "pftpx/*" pass in quick on xl0 inet proto tcp from any to $loopback port 8021 keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on xl0 inet proto tcp from any to $loopback port 21 keep state label "FTP PROXY: Allow traffic to localhost" pass in quick on rl0 inet proto tcp from port 20 to (rl0) port > 49000 user proxy flags S/SA keep state label "FTP PROXY: PASV mode data connection" # allow access to DHCP server on LAN anchor "dhcpserverlan" pass in quick on $lan proto udp from any port = 68 to 255.255.255.255 port = 67 label "allow access to DHCP server on LAN" pass in quick on $lan proto udp from any port = 68 to 10.62.0.3 port = 67 label "allow access to DHCP server on LAN" pass out quick on $lan proto udp from 10.62.0.3 port = 67 to any port = 68 label "allow access to DHCP server on LAN" pass in quick on $wan proto udp from any port = 67 to any port = 68 label "allow dhcp client out wan" # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses) antispoof for xl0 # Support for allow limiting of TCP connections by establishment rate anchor "limitingesr" table <virusprot>block in quick from <virusprot>to any label "virusprot overload table" # pass traffic from firewall -> out anchor "firewallout" pass out quick on rl0 all keep state tagged qwandef queue (qwandef, qwanacks) label "let out anything from firewall host itself" pass out quick on rl0 all keep state tagged qRdpUp queue (qRdpUp, qwanacks) label "let out anything from firewall host itself" pass out quick on rl0 all keep state tagged qOthersUpH queue (qOthersUpH, qwanacks) label "let out anything from firewall host itself" pass out quick on rl0 all keep state tagged qwebUp queue (qwebUp, qwanacks) label "let out anything from firewall host itself" pass out quick on rl0 all keep state queue (qwandef, qwanacks) label "let out anything from firewall host itself" pass out quick on xl0 all keep state tagged qlandef queue (qlandef, qlanacks) label "let out anything from firewall host itself" pass out quick on xl0 all keep state tagged qRdpDown queue (qRdpDown, qlanacks) label "let out anything from firewall host itself" pass out quick on xl0 all keep state tagged qOthersDownH queue (qOthersDownH, qlanacks) label "let out anything from firewall host itself" pass out quick on xl0 all keep state tagged qwebDown queue (qwebDown, qlanacks) label "let out anything from firewall host itself" pass out quick on xl0 all keep state queue (qlandef, qlanacks) label "let out anything from firewall host itself" pass out quick on bridge0 all keep state label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webGUI or SSH anchor "anti-lockout" pass in quick from 10.62.0.0/24 to 10.62.0.3 keep state label "anti-lockout web rule" # SSH lockout block in log proto tcp from <sshlockout>to any port 22 label "sshlockout" # User-defined rules follow # Anchors for rules that might be matched by queues anchor qwanRoot tagged qwanRoot anchor qlanRoot tagged qlanRoot anchor qwandef tagged qwandef anchor qlandef tagged qlandef anchor qwanacks tagged qwanacks anchor qlanacks tagged qlanacks anchor qRdpUp tagged qRdpUp anchor qRdpDown tagged qRdpDown anchor qOthersUpH tagged qOthersUpH anchor qOthersDownH tagged qOthersDownH anchor qOthersUpL tagged qOthersUpL anchor qOthersDownL tagged qOthersDownL anchor qwebUp tagged qwebUp anchor qwebDown tagged qwebDown pass in log quick on $wan from any to any keep state queue (qwandef, qwanacks) label "USER_RULE: Default Wan -> any" pass in log quick on $lan from any to any keep state queue (qlandef, qlanacks) label "USER_RULE: Default LAN -> any" pass quick proto carp keep state pass quick proto pfsync # VPN Rules #--------------------------------------------------------------------------- # default rules (just to be sure) #--------------------------------------------------------------------------- block in log quick all label "Default block all just to be sure." block out log quick all label "Default block all just to be sure."</sshlockout></virusprot></virusprot></spamd-white></spamd></blacklist></spamd-white></spamd></blacklist></whitelist></sshlockout> -
hey-
same issue here. I want to see if a cvs_sync fixes it, but I'm on a soekris and / is mounted read-only… and of course i can't edit /etc/fstab because, well, / is mounted read-only. what's the trick for cvs_sync'ing on a WRAP box?
thanks,
darren -
hey-
same issue here. I want to see if a cvs_sync fixes it, but I'm on a soekris and / is mounted read-only… and of course i can't edit /etc/fstab because, well, / is mounted read-only. what's the trick for cvs_sync'ing on a WRAP box?
thanks,
darrenThere is no trick. This does not work with Embedded platforms.
-
i /knew/ you were going to say that. ;)
can you point me to the docs for building my own from cvs, if there are any?
thanks for all the work on this. it's looking grand.
cheers,
darren -
in other forums say thet ALTQ must be configured to 2 interface (because them work only with out traffic).
allike problem when one with interfaces not correctly set
in my rules this correct?ps pls don't kill me - i only newbe (2 mth with nix system) ;)
ps2 after update from cvs queue status graph work very stable (1.5 hr wisout stops)
-
hrm, I don't get it.. this really should be working. There were no major changes to the shaper since Beta3 and the rules look fine from here. even after looking at them many time over. I'll wait to see if the fix works for anyone else..
??? 'scratch head'
-
Tomorrow reupdate Beta 3 and test this config again :-
May be broken update to Beta 4 ? But any errors not view.
Goodnight ;D–-----------------------------------
Good day.
I do it whith Beta 3, but nothing news. Them i update Beta 4 and rebuild my bridge config new. If a take update from cvs - them continuing testing with Beta4.
Good day 2
Yesss !!! BRIDGE!!!
If i setup in LAN any dummy address - not WAN - my shaping get circus (bear's show)
I set LAN IP = WAN IP and mask LAN IP = 32 (what recomended Hoba in Firewall topic)
And my queue blinking all!!
I must begin full testing.
Write any result after this.
Bye -
Trafficshaper won't work in a bridge configuration. This is a limitation.
-
This is interested post about ALTQ & bridge (only this about openBSD).
http://www.csl.sony.co.jp/~kjc/altq-ml-2002/msg00551.htmlTheme "ALTQ and bridge" - dont have wide information in Inet. I looking very mach questions, but little answers :'(
Can this url help for you project?