ipfw - accessing DMZ from LAN , pipes

[Freddie Cash]

Apologies if the formatting below gets messed up, writing this on my phone.

On Nov 28, 2011 2:36 PM, "Marek Salwerowicz" <marek_sal at wp.pl> wrote:
> I am confused about one thing - I wanted to set up pipes for my DMZ hosts
(not to allow my hosts to consume all the bandwidth).
> When I set up the pipes at the beginning of my firewall (before
configuring the NAT) - the  whole traffic is blocked.
> When I set up the pipes ad the end of firewall - they don't work (even
'ipfw show' shows no packets coming through 'pipe' rules).
>
> Where should be the pipe rules placed?

This is something I've never really received a satisfactory answer to. I
believe you have to put your pipe/queue rules in place of your final allow
rules. IOW, the pipe/queue rules are the final rule that a packet touches
in the ruleset.

For example, for outgoing HTTP traffic, you would allow the packet coming
in on the internal interface. Then you NAT the packet as it goes out the
external interface. And, finally, you send the NAT'd packet to the
pipe/queue, instead of allowing the NAT'd packet out the external interface.

However, I have not actually implemented pipes/queue on any of my NAT
firewalls, just on my routing firewalls. I have plans to test that at some
point this school year.

> Does it matter if I do first 'ipfw add pipe 1...' and then 'ipfw pipe 1
config...' ?

All of the examples in the man page,  handbook, and online show the 'add
pipe' rules first, then the 'pipe config' rules. But that seems backward to
me. So I always do my 'pipe config' rules first. Afterlife, how do you send
a packet to a pipe that doesn't exist yet? :)

Freddie
fjwcash at gmail.com