packet order, ipf or ipfw

[Max Laier]

On Wednesday 28 July 2004 23:23, Charlie Schluting wrote:
> Hello..
>
> I'm running ipf because I like it ...but now I need to use ipfw's pipe
> feature. I was thinking that I could just run both, and keep all my
> rules in ipf, then in ipfw: limit bandwidth for a few vlans, then allow
> all.
>
> It didn't work (no rate-limiting happened).. and I'm thinking that ipf
> is passing the packets and bypassing ipfw? Or something..
>
> So, what is the order, if I'm running ipf AND ipfw at the same time?
> Will it work at all in this manner?

On the output path (which is the only meaningful for bandwidth limitation) the 
order is:
	PFIL_HOOKS (== ipf / pf) before
	ipfw

Note however, that ipfw will see translated packets! i.e. if you have any 
translation/NAT/redirect rules in ipf you need to account for that with your 
ipfw rules.

Another alternative (on FreeBSD-current) would be pf+ALTQ, btw ;)

-- 
/"\  Best regards,			| mlaier at freebsd.org
\ /  Max Laier				| ICQ #67774661
 X   http://pf4freebsd.love2party.net/	| mlaier at EFnet
/ \  ASCII Ribbon Campaign		| Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: signature
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20040728/39387f45/attachment.bin