Natd + dummynet

Grégoire Leroy gregoire.leroy at retenodus.net
Mon Jul 4 12:47:09 UTC 2011


Hi,

I try to use dummynet with natd, but I don't understand where I must write 
pipes/queues lines.

I want to use fair queueing on my sdsl line, and I don't understand if I must 
write rules :
1) before the firsts lines of nat
2) Between nat and chek-state
3) before allow/deny
4) After allow/deny
5) After lasts natd lines.

I wonder also if pipes rules replace allow rules : if a packet is accepted in 
a pipe, it's also allowed, isn't it ?

My rules are : 

# Les paquets autorises sont nattes -> important
$cmd 55300 divert 8868 ip from any to any in via $adsl1_if
$cmd 55301 divert 8869 ip from any to any in via $adsl2_if
$cmd 55302 divert 8870 ip from any to any in via $sdsl_if

# On accepte les paquets autorises par keep-state
$cmd 55320 check-state

... some deny/allow/skipto lines ...

#nat everything that get's here, should be ok as local allowed in first
$cmd 61000 divert 8868 ip from $interne to any in
$cmd 61100 divert 8868 ip from $interne to any out
$cmd 61300 allow all from any to any

$cmd 62000 divert 8869 ip from $interne to any out
$cmd 62500 divert 8869 ip from $interne to any in
$cmd 62700 allow all from any to any
$cmd 63000 divert 8870 ip from $interne_all to any out
$cmd 63500 divert 8870 ip from $interne_all to any in
$cmd 63600 allow all from any to any

#policy route to send traffic to correct isp
$cmd 61200 fwd $isp1 ip from $adsl1_ip to any
$cmd 62550 fwd $isp2 ip from $adsl2_ip to any
$cmd 63700 fwd $isp3 ip from $sdsl_ip to any

$cmd 65534 allow all from any to any

Tkanks for your help,
Grégoire Leroy


More information about the freebsd-ipfw mailing list