142a227f8SMax Laier# $OpenBSD: faq-example2,v 1.4 2006/10/07 04:48:01 mcbride Exp $ 29d7ccc0fSMax Laier 39d7ccc0fSMax Laier# 49d7ccc0fSMax Laier# Small, Home Network 59d7ccc0fSMax Laier# http://www.openbsd.org/faq/pf/queueing.html#example1 69d7ccc0fSMax Laier# 79d7ccc0fSMax Laier 89d7ccc0fSMax Laier 99d7ccc0fSMax Laier# enable queueing on the external interface to control traffic going to 109d7ccc0fSMax Laier# the Internet. use the priq scheduler to control only priorities. set 119d7ccc0fSMax Laier# the bandwidth to 610Kbps to get the best performance out of the TCP 129d7ccc0fSMax Laier# ACK queue. 139d7ccc0fSMax Laier 149d7ccc0fSMax Laieraltq on fxp0 priq bandwidth 610Kb queue { std_out, ssh_im_out, dns_out, \ 159d7ccc0fSMax Laier tcp_ack_out } 169d7ccc0fSMax Laier 179d7ccc0fSMax Laier# define the parameters for the child queues. 189d7ccc0fSMax Laier# std_out - the standard queue. any filter rule below that does not 199d7ccc0fSMax Laier# explicitly specify a queue will have its traffic added 209d7ccc0fSMax Laier# to this queue. 219d7ccc0fSMax Laier# ssh_im_out - interactive SSH and various instant message traffic. 229d7ccc0fSMax Laier# dns_out - DNS queries. 239d7ccc0fSMax Laier# tcp_ack_out - TCP ACK packets with no data payload. 249d7ccc0fSMax Laier 259d7ccc0fSMax Laierqueue std_out priq(default) 269d7ccc0fSMax Laierqueue ssh_im_out priority 4 priq(red) 279d7ccc0fSMax Laierqueue dns_out priority 5 289d7ccc0fSMax Laierqueue tcp_ack_out priority 6 299d7ccc0fSMax Laier 309d7ccc0fSMax Laier# enable queueing on the internal interface to control traffic coming in 319d7ccc0fSMax Laier# from the Internet. use the cbq scheduler to control bandwidth. max 329d7ccc0fSMax Laier# bandwidth is 2Mbps. 339d7ccc0fSMax Laier 349d7ccc0fSMax Laieraltq on dc0 cbq bandwidth 2Mb queue { std_in, ssh_im_in, dns_in, bob_in } 359d7ccc0fSMax Laier 369d7ccc0fSMax Laier# define the parameters for the child queues. 379d7ccc0fSMax Laier# std_in - the standard queue. any filter rule below that does not 389d7ccc0fSMax Laier# explicitly specify a queue will have its traffic added 399d7ccc0fSMax Laier# to this queue. 409d7ccc0fSMax Laier# ssh_im_in - interactive SSH and various instant message traffic. 419d7ccc0fSMax Laier# dns_in - DNS replies. 429d7ccc0fSMax Laier# bob_in - bandwidth reserved for Bob's workstation. allow him to 439d7ccc0fSMax Laier# borrow. 449d7ccc0fSMax Laier 4542a227f8SMax Laierqueue std_in bandwidth 1.6Mb cbq(default) 4642a227f8SMax Laierqueue ssh_im_in bandwidth 200Kb priority 4 4742a227f8SMax Laierqueue dns_in bandwidth 120Kb priority 5 489d7ccc0fSMax Laierqueue bob_in bandwidth 80Kb cbq(borrow) 499d7ccc0fSMax Laier 509d7ccc0fSMax Laier 519d7ccc0fSMax Laier# ... in the filtering section of pf.conf ... 529d7ccc0fSMax Laier 539d7ccc0fSMax Laieralice = "192.168.0.2" 549d7ccc0fSMax Laierbob = "192.168.0.3" 559d7ccc0fSMax Laiercharlie = "192.168.0.4" 569d7ccc0fSMax Laierlocal_net = "192.168.0.0/24" 579d7ccc0fSMax Laierssh_ports = "{ 22 2022 }" 589d7ccc0fSMax Laierim_ports = "{ 1863 5190 5222 }" 599d7ccc0fSMax Laier 609d7ccc0fSMax Laier# filter rules for fxp0 inbound 619d7ccc0fSMax Laierblock in on fxp0 all 629d7ccc0fSMax Laier 639d7ccc0fSMax Laier# filter rules for fxp0 outbound 649d7ccc0fSMax Laierblock out on fxp0 all 6542a227f8SMax Laierpass out on fxp0 inet proto tcp from (fxp0) to any \ 6642a227f8SMax Laier queue(std_out, tcp_ack_out) 6742a227f8SMax Laierpass out on fxp0 inet proto { udp icmp } from (fxp0) to any 689d7ccc0fSMax Laierpass out on fxp0 inet proto { tcp udp } from (fxp0) to any port domain \ 6942a227f8SMax Laier queue dns_out 709d7ccc0fSMax Laierpass out on fxp0 inet proto tcp from (fxp0) to any port $ssh_ports \ 7142a227f8SMax Laier queue(std_out, ssh_im_out) 729d7ccc0fSMax Laierpass out on fxp0 inet proto tcp from (fxp0) to any port $im_ports \ 7342a227f8SMax Laier queue(ssh_im_out, tcp_ack_out) 749d7ccc0fSMax Laier 759d7ccc0fSMax Laier# filter rules for dc0 inbound 769d7ccc0fSMax Laierblock in on dc0 all 779d7ccc0fSMax Laierpass in on dc0 from $local_net 789d7ccc0fSMax Laier 799d7ccc0fSMax Laier# filter rules for dc0 outbound 809d7ccc0fSMax Laierblock out on dc0 all 819d7ccc0fSMax Laierpass out on dc0 from any to $local_net 829d7ccc0fSMax Laierpass out on dc0 proto { tcp udp } from any port domain to $local_net \ 839d7ccc0fSMax Laier queue dns_in 849d7ccc0fSMax Laierpass out on dc0 proto tcp from any port $ssh_ports to $local_net \ 859d7ccc0fSMax Laier queue(std_in, ssh_im_in) 869d7ccc0fSMax Laierpass out on dc0 proto tcp from any port $im_ports to $local_net \ 879d7ccc0fSMax Laier queue ssh_im_in 889d7ccc0fSMax Laierpass out on dc0 from any to $bob queue bob_in 89