|
After reading this article by Daniel Hartmeier, I've applied the same concepts to FreeBSD. The end result is that you can max out your outbound bandwidth without (majorly) affecting your incoming bandwidth.
First, ensure you have firewalling and Dummynet compiled into your kernel. To do so, add the following lines to your kernel and recompile:
options IPFIREWALL
options IPDIVERT
options DUMMYNET
options HZ=1000
Now, create a firewall file as /etc/firewall.rules with the following rules (adjusting rules 1000+ to your tastes). I use /usr/bin/cpp as the preprocessor.
#define internet_if rl0
/* Set this to just below your outbound bandwidth */
#define internet_bw 248Kbit/s
#define nat 1
/* Remove the line below to enable NAT */
#undef nat
#ifdef nat
add 50 divert natd all from any to any via internet_if
#endif
/* Set up dummynet pipes */
pipe 1 config bw internet_bw
queue 1 config pipe 1 weight 100
queue 2 config pipe 1 weight 1 mask all
/* UDP and TCP ACKs get high weights */
add 100 queue 1 udp from any to any out via internet_if
add 101 skipto 1000 udp from any to any out via internet_if
add 110 queue 1 tcp from any to any out via internet_if tcpflags ack
add 111 skipto 1000 tcp from any to any out via internet_if tcpflags ack
/* Other IP traffic gets low weights */
add 120 queue 2 ip from any to any out via internet_if
/* Firewall rules begin here */
add 1000 allow all from any to any
Now, edit /etc/sysctl.conf and add the following line:
net.inet.ip.fw.one_pass=0
You're now ready to go, reboot to load the new firewall & dummynet code (if you haven't already done so) and issue the following command to test out the new firewall rules:
ipfw -f flush && ipfw -p /usr/bin/cpp /etc/firewall.rules
Once you are satisfied with the configuration, make it permanent by added the following lines to /etc/rc.conf:
firewall_enable="YES"
firewall_type="/etc/firewall.rules"
firewall_flags="-p /usr/bin/cpp"
|