Bidirectional queueing in post-ALTQ era
Charleroi Vogt <[email protected]> Wed, 03 Feb 2016 00:26:48 -0500
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_89978_1137991193.1454477208473 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Regarding bi-directional queueing through a single gateway/firewall machine... 1) One method discussed previously was to attach queues of the same name to the internal if and external if, and the state entry would be associated with queues of the same name regardless of interface. If a 1-to-1 mapping of outbound queue to inbound queue was acceptable, then as of 2011 this method was suggested: http://marc.info/?t=129472965800001&r=1&w=2 Is this still true as of OpenBSD 5.8? 2) If the desired inbound queue classification doesn't line up 1-to-1 with the outbound classification, then can making the state policy if-bound be used? E.g., # queue and macro definitions not shown # trivial illustrative example only, no real filtering/classification shown set state-policy if-bound pass in on $int_if no state pass out on $ext_if keep state set queue some_outbound_queue pass out on $int_if keep state set queue an_inbound_queue If this makes sense, I presume once the state entry on $int_if is created by the session return packets flowing in the direction of the internal network(s), that subsequent outbound packets belonging to the same session will match the state entry as they cross $int_if despite the first rule indicating "no state"? Thank you. ------=_Part_89978_1137991193.1454477208473 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>= <meta content=3D"text/html;charset=3DUTF-8" http-equiv=3D"Content-Type"></h= ead><body ><div style=3D'font-size:10pt;font-family:Verdana,Arial,Helvetica= ,sans-serif;'><div><br></div><div>Regarding bi-directional queueing through= a single gateway/firewall machine...<br></div><div><br></div><div>1) One m= ethod discussed previously was to attach queues of the same name to the int= ernal if and external if, and the state entry would be associated with queu= es of the same name regardless of interface. If a 1-to-1 mapping of o= utbound queue to inbound queue was acceptable, then as of 2011 this method = was suggested:<br></div><div><br></div><div>http://marc.info/?t=3D129472965= 800001&r=3D1&w=3D2<br></div><div><br></div><div>Is this still true = as of OpenBSD 5.8?<br></div><div><br></div><div>2) If the desired inbound q= ueue classification doesn't line up 1-to-1 with the outbound classification= , then can making the state policy if-bound be used? E.g.,<br></div><= div><br></div><div># queue and macro definitions not shown<br></div><div># = trivial illustrative example only, no real filtering/classification shown<b= r></div><div>set state-policy if-bound<br></div><div>pass in on $int_if no = state<br></div><div>pass out on $ext_if keep state set queue some_outbound_= queue<br></div><div>pass out on $int_if keep state set queue an_inbound_que= ue<br></div><div><br></div><div>If this makes sense, I presume once the sta= te entry on $int_if is created by the session return packets flowing in the= direction of the internal network(s), that subsequent outbound packets bel= onging to the same session will match the state entry as they cross $int_if= despite the first rule indicating "no state"?<br></div><div><br></div><div= >Thank you.<br></div></div></body></html> ------=_Part_89978_1137991193.1454477208473--