kern/46564: IPFilter and IPFW processing order is not sensible>

Pawel Malachowski pawmal at unia.3lo.lublin.pl
Tue May 6 13:47:17 PDT 2003


Hello,

	Here is some example:

(private IPs)LAN---(fxp1)BOX(fxp0)---Internet

There are:
. dummynet running on fxp0
. ipnat running on fxp0

Right now outgoing packets on fxp0 go through ipnat and then through
dummynet. It is not possible to shape this traffic on per-user
basis (for example with src-ip mask) cause after ipnatting all packets
have the same source IP. Possible sollutions are:
. use dummynet on fxp0
	This is not so good idea if I have a huge number of
	local NICs and subnets cause I have to make exceptions
	(ipfw skip) for local traffic.
	It is very easy and natural to use dummynet on fxp0
	interface for bandwith limitaion of `Internet' traffic.
. use natd instead of ipnat
	Sucessfully tested, but I simply prefer ipnat. :)

So, probably packets flow should be:
	incoming: IPFilter -> IPFW
	outgoing: IPFW -> IPFilter

This code is `for private use' and is quite bad but does that (4.8):
http://unia.3lo.lublin.pl/~pawmal/freebsd/ip_output-ipfw-ipf.diff

I know submitter tried something similar on his own, too.

However, allowing user to decide about order (using sysctls?) would
be the best solution.


regards,
-- 
Pawel Malachowski



More information about the freebsd-bugs mailing list