Understanding where dummynet fits into an ipfw ruleset

[Chuck Swiger]

On Jun 27, 2008, at 1:01 PM, Freddie Cash wrote:
> Mainly, I'm wondering where to put the "ipfw queue" rules (the ones
> that send the packets to dummynet), in relation to the packet
> filtering rules, or if it even matters.
>
> For instance, do the queue rules apply to all the rules in the set, or
> only to rules that follow after the queue rules (numerically)?

That pretty depends on whether net.inet.ip.fw.one_pass sysctl is set:

      pipe pipe_nr
              Pass packet to a dummynet(4) ``pipe'' (for bandwidth  
limitation,
              delay, etc.).  See the TRAFFIC SHAPER (DUMMYNET)  
CONFIGURATION
              Section for further information.  The search terminates;  
however,
              on exit from the pipe and if the sysctl(8) variable
              net.inet.ip.fw.one_pass is not set, the packet is passed  
again to
              the firewall code starting from the next rule.

> Would I put the queue rules at the start of the ruleset or the end?
> Or in the middle, just above the rules for the workstations?  Do I add
> them after all the bad packet checks and general deny rules that are
> at the top of the ruleset?
>
> Just wondering how the queue rules interact with the general packet
> filter rules, since they can have the same parameters.

It's reasonable to place the dummynet queue and pipe statements  
immediately after anti-spoofing checks, if net.inet.ip.fw.one_pass is  
false; that way, all traffic is shaped, including stuff that is later  
blocked by other IPFW statements.  Since the inbound traffic has  
already passed through your external link(s) anyway, you might as well  
acknowledge that it has.

If net.inet.ip.fw.one_pass is true, then you definitely want to apply  
your deny rules first, as once something matches a pipe rule, it's  
going to be passed.  The tradeoff is that the accounting/fairness of  
traffic is less accurate but the firewall ruleset runs faster...

-- 
-Chuck