Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to do traffic shaping with FreeBSD, here are my rules

su-3.2# ipfw show | grep pipe
08380 1514852  125523804 pipe 1 tcp from any to any dst-port 80
su-3.2# ipfw pipe 1 show
00001:   2.000 Mbit/s    0 ms   50 sl. 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 tcp     64.237.55.83/60598    72.21.81.133/80    6520267 1204533020  0    0 1216
su-3.2# 

first of all why when I run ipfw pipe 1 show i get same source and destination ip, that doesnt seem like ever change yet total packets/bytes increasing

and most important question, after donig all that I'm looking at my MRTG stats and I see i'm very well over 2Mbit/s limit.

what am I doing wrong?

here is config file

flush
pipe flush
pipe 1 config bw 2Mbit/s
add 100 allow ip from any to any via lo0
add 200 deny ip from any to 127.0.0.0/8
add 300 deny ip from 127.0.0.0/8 to any
add 8380 pipe 1 tcp from any to any src-port www uid daemon
add 8380 pipe 1 tcp from any to any dst-port www uid daemon
add 65000 pass all from any to any
share|improve this question
    
post config please. –  SaveTheRbtz Oct 7 '09 at 18:24
    
What are you want to do ? –  adopilot Feb 3 '10 at 6:26
1  
traffic doesn't get shaped, i get peaks way over 2Mbit/s –  alexus Feb 3 '10 at 15:38
    
traffic that matches rule 8380? or overall traffic on interface? –  gelraen Jan 21 '11 at 13:17

2 Answers 2

You restrict http traffic to 2Mb/s, but you let all other traffic pass through. So you can still have 50Mb/s of FTP traffic for example which won't be limited

I used to set policy this way:

# flush all rules
ipfw -f flush

ipfw pipe 1 config bw 256Kbits/s
ipfw pipe 2 config bw 512Kbits/s
ipfw pipe 10 config bw 1Mbits/s
ipfw pipe 50 config bw 20Mbits/s
ipfw pipe 60 config bw 20Mbits/s
ipfw pipe 100 config bw 100Mbits/s


ipfw add 1 pipe 50 ip from X.X.X.X/21 to any out
ipfw add 2 pipe 60 ip from any to X.X.X.X/21 in

So you have 20Mb/s to inside and 20Mb/s to outside. If you only use one pipe, then it's 20Mb/s shared, so 10Mb/s.

Your shapping must include all traffic at the end, so there is no flow without traffic shapping

share|improve this answer
    
I'm okay to share same pipe, that's not the problem at all! the problem is it doesn't get limited at all it goes beyond that point! instead of 2mbps, i see peaks that are way higher then that! –  alexus Feb 9 '10 at 16:03

If you're tied to ipfw have a look at this site - They talk about OS X traffic shaping, but ipfw is ipfw and it should get you going. (Basically it looks like you're missing the queues on your pipe, which if I remember right makes the traffic shaping break down).

If you aren't married to ipfw you can do this (and lots of other QOS & Queueing stuff) more easily with pf and ALTQ (One reference, there are tons more available including the pf queueing docs)

General Note: Queueing/Shaping tends to work best when applied to outbound traffic (so if you want to limit the inbound traffic on your ISP interface you may have better luck throttling the outbound traffic on your inside interface)

share|improve this answer
    
while this all very good references, this isn't an answer for my question. –  alexus Feb 3 '10 at 15:41
    
Your first question (as I understood it) is "what am I doing wrong?" - The answer is in parentheses in my first paragraph above. –  voretaq7 Feb 3 '10 at 16:35
    
Your second ("most important") question is why is your bandwidth utilization still high - Two part answer: your queueing code is broken (seen first paragraph), and if you're trying to limit incoming stuff it's "too late" -- it already came down the pipe & had to be received for your box to queue it (pf docs & "General Note" paragraph in the above) –  voretaq7 Feb 3 '10 at 16:37
    
dummynet pipes provides 'hard' limit for traffic flow, while queues provides fair priority-based sharing between flows. So pipe is enough to limit bandwidth usage. Note about shaping only outgoing traffic does not apply to dummynet, it was designed to emulate links with given parameters and perfectly simulates shaping of incoming traffic as shaping on outgoing interface of virtual just-before-us router. –  gelraen Jan 21 '11 at 13:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.