IPFW transparent VS dummynet rules

[Ian Smith]

On Sat, 7 Jan 2012, budsz wrote:
 > Hi folks,
 > 
 > I already found the mistake of my ruleset sequence on my box, for ex:
 > 
 > ${fwcmd} add 30 fwd ${ipproxy},${portproxy} tcp from ${ipclproxy} to
 > any dst-port ${porthttp} in via ${ifint0}
 > 
 > ${fwcmd} add 52 pipe 2 ip from any to ${ipclient} via ${ifint0}
 > ${fwcmd} add 53 pipe 3 ip from ${ipclient} to any via ${ifint0}
 > ${fwcmd} pipe 2 config bw ${bwcldown} mask dst-ip 0xffffffff
 > ${fwcmd} pipe 3 config bw ${bwclup} mask src-ip 0xffffffff
 > 
 > With this ruleset sequence, the limiter didn't work but fwd rules working.
 > If I switching like:
 > 
 > ${fwcmd} add 52 pipe 2 ip from any to ${ipclient} via ${ifint0}
 > ${fwcmd} add 53 pipe 3 ip from ${ipclient} to any via ${ifint0}
 > ${fwcmd} pipe 2 config bw ${bwcldown} mask dst-ip 0xffffffff
 > ${fwcmd} pipe 3 config bw ${bwclup} mask src-ip 0xffffffff
 > 
 > ${fwcmd} add 70 fwd ${ipproxy},${portproxy} tcp from ${ipclproxy} to
 > any dst-port ${porthttp} in via ${ifint0}
 > 
 > The limiter working but fwd didn't work. Anyone have a clue for fix
 > this dilemma?

Quoting ipfw(8):

     fwd | forward ipaddr | tablearg[,port]
             Change the next-hop on matching packets to ipaddr, which can be
             an IP address or a host name.  The next hop can also be supplied
             by the last table looked up for the packet by using the tablearg
             keyword instead of an explicit address.  The search terminates if
             this rule matches.

Note particularly the last sentence.  You'll have to do your dummynet 
piping first, if it is to apply also to forwarded packets.

(sysctl)
      net.inet.ip.fw.one_pass: 1
             When set, the packet exiting from the dummynet pipe or from
             ng_ipfw(4) node is not passed though the firewall again.  Other-
             wise, after an action, the packet is reinjected into the firewall
             at the next rule.

It seems that you may have one_pass set to 1.  Set to 0, packets will 
continue through the ruleset on exit from pipe/s, so to your fwd rule.

cheers, Ian