/share/examples/pf/faq-example3

https://bitbucket.org/freebsd/freebsd-head/ · #! · 117 lines · 92 code · 25 blank · 0 comment · 0 complexity · 487b4f9000a07fc7b1cf3048b499d280 MD5 · raw file

  1. # $FreeBSD$
  2. # $OpenBSD: faq-example3,v 1.4 2006/10/07 04:48:01 mcbride Exp $
  3. #
  4. # Company Network
  5. # http://www.openbsd.org/faq/pf/queueing.html#example2
  6. #
  7. # enable queueing on the external interface to queue packets going out
  8. # to the Internet. use the cbq scheduler so that the bandwidth use of
  9. # each queue can be controlled. the max outgoing bandwidth is 1.5Mbps.
  10. altq on fxp0 cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext }
  11. # define the parameters for the child queues.
  12. # std_ext - the standard queue. also the default queue for
  13. # outgoing traffic on fxp0.
  14. # www_ext - container queue for WWW server queues. limit to
  15. # 500Kbps.
  16. # www_ext_http - http traffic from the WWW server; higher priority.
  17. # www_ext_misc - all non-http traffic from the WWW server.
  18. # boss_ext - traffic coming from the boss's computer.
  19. queue std_ext bandwidth 500Kb cbq(default borrow)
  20. queue www_ext bandwidth 500Kb { www_ext_http, www_ext_misc }
  21. queue www_ext_http bandwidth 50% priority 3 cbq(red borrow)
  22. queue www_ext_misc bandwidth 50% priority 1 cbq(borrow)
  23. queue boss_ext bandwidth 500Kb priority 3 cbq(borrow)
  24. # enable queueing on the internal interface to control traffic coming
  25. # from the Internet or the DMZ. use the cbq scheduler to control the
  26. # bandwidth of each queue. bandwidth on this interface is set to the
  27. # maximum. traffic coming from the DMZ will be able to use all of this
  28. # bandwidth while traffic coming from the Internet will be limited to
  29. # 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to fxp1).
  30. altq on dc0 cbq bandwidth 100% queue { net_int, www_int }
  31. # define the parameters for the child queues.
  32. # net_int - container queue for traffic from the Internet. bandwidth
  33. # is 1.0Mbps.
  34. # std_int - the standard queue. also the default queue for outgoing
  35. # traffic on dc0.
  36. # it_int - traffic to the IT Dept network; reserve them 500Kbps.
  37. # boss_int - traffic to the boss's PC; assign a higher priority.
  38. # www_int - traffic from the WWW server in the DMZ; full speed.
  39. queue net_int bandwidth 1.0Mb { std_int, it_int, boss_int }
  40. queue std_int bandwidth 250Kb cbq(default borrow)
  41. queue it_int bandwidth 500Kb cbq(borrow)
  42. queue boss_int bandwidth 250Kb priority 3 cbq(borrow)
  43. queue www_int bandwidth 99Mb cbq(red borrow)
  44. # enable queueing on the DMZ interface to control traffic destined for
  45. # the WWW server. cbq will be used on this interface since detailed
  46. # control of bandwidth is necessary. bandwidth on this interface is set
  47. # to the maximum. traffic from the internal network will be able to use
  48. # all of this bandwidth while traffic from the Internet will be limited
  49. # to 500Kbps.
  50. altq on fxp1 cbq bandwidth 100% queue { internal_dmz, net_dmz }
  51. # define the parameters for the child queues.
  52. # internal_dmz - traffic from the internal network.
  53. # net_dmz - container queue for traffic from the Internet.
  54. # net_dmz_http - http traffic; higher priority.
  55. # net_dmz_misc - all non-http traffic. this is also the default queue.
  56. queue internal_dmz bandwidth 99Mb cbq(borrow)
  57. queue net_dmz bandwidth 500Kb { net_dmz_http, net_dmz_misc }
  58. queue net_dmz_http bandwidth 50% priority 3 cbq(red borrow)
  59. queue net_dmz_misc bandwidth 50% priority 1 cbq(default borrow)
  60. # ... in the filtering section of pf.conf ...
  61. main_net = "192.168.0.0/24"
  62. it_net = "192.168.1.0/24"
  63. int_nets = "{ 192.168.0.0/24, 192.168.1.0/24 }"
  64. dmz_net = "10.0.0.0/24"
  65. boss = "192.168.0.200"
  66. wwwserv = "10.0.0.100"
  67. # default deny
  68. block on { fxp0, fxp1, dc0 } all
  69. # filter rules for fxp0 inbound
  70. pass in on fxp0 proto tcp from any to $wwwserv port { 21, \
  71. > 49151 } queue www_ext_misc
  72. pass in on fxp0 proto tcp from any to $wwwserv port 80 \
  73. queue www_ext_http
  74. # filter rules for fxp0 outbound
  75. pass out on fxp0 from $int_nets to any
  76. pass out on fxp0 from $boss to any queue boss_ext
  77. # filter rules for dc0 inbound
  78. pass in on dc0 from $int_nets to any
  79. pass in on dc0 from $it_net to any queue it_int
  80. pass in on dc0 from $boss to any queue boss_int
  81. pass in on dc0 proto tcp from $int_nets to $wwwserv port { 21, 80, \
  82. > 49151 } queue www_int
  83. # filter rules for dc0 outbound
  84. pass out on dc0 from dc0 to $int_nets
  85. # filter rules for fxp1 inbound
  86. pass in on fxp1 proto { tcp, udp } from $wwwserv to any port 53
  87. # filter rules for fxp1 outbound
  88. pass out on fxp1 proto tcp from any to $wwwserv port { 21, \
  89. > 49151 } queue net_dmz_misc
  90. pass out on fxp1 proto tcp from any to $wwwserv port 80 queue net_dmz_http
  91. pass out on fxp1 proto tcp from $int_nets to $wwwserv port { 80, \
  92. 21, > 49151 } queue internal_dmz