1# $OpenBSD: faq-example3,v 1.4 2006/10/07 04:48:01 mcbride Exp $ 2 3# 4# Company Network 5# http://www.openbsd.org/faq/pf/queueing.html#example2 6# 7 8 9# enable queueing on the external interface to queue packets going out 10# to the Internet. use the cbq scheduler so that the bandwidth use of 11# each queue can be controlled. the max outgoing bandwidth is 1.5Mbps. 12 13altq on fxp0 cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext } 14 15# define the parameters for the child queues. 16# std_ext - the standard queue. also the default queue for 17# outgoing traffic on fxp0. 18# www_ext - container queue for WWW server queues. limit to 19# 500Kbps. 20# www_ext_http - http traffic from the WWW server; higher priority. 21# www_ext_misc - all non-http traffic from the WWW server. 22# boss_ext - traffic coming from the boss's computer. 23 24queue std_ext bandwidth 500Kb cbq(default borrow) 25queue www_ext bandwidth 500Kb { www_ext_http, www_ext_misc } 26 queue www_ext_http bandwidth 50% priority 3 cbq(red borrow) 27 queue www_ext_misc bandwidth 50% priority 1 cbq(borrow) 28queue boss_ext bandwidth 500Kb priority 3 cbq(borrow) 29 30# enable queueing on the internal interface to control traffic coming 31# from the Internet or the DMZ. use the cbq scheduler to control the 32# bandwidth of each queue. bandwidth on this interface is set to the 33# maximum. traffic coming from the DMZ will be able to use all of this 34# bandwidth while traffic coming from the Internet will be limited to 35# 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to fxp1). 36 37altq on dc0 cbq bandwidth 100% queue { net_int, www_int } 38 39# define the parameters for the child queues. 40# net_int - container queue for traffic from the Internet. bandwidth 41# is 1.0Mbps. 42# std_int - the standard queue. also the default queue for outgoing 43# traffic on dc0. 44# it_int - traffic to the IT Dept network; reserve them 500Kbps. 45# boss_int - traffic to the boss's PC; assign a higher priority. 46# www_int - traffic from the WWW server in the DMZ; full speed. 47 48queue net_int bandwidth 1.0Mb { std_int, it_int, boss_int } 49 queue std_int bandwidth 250Kb cbq(default borrow) 50 queue it_int bandwidth 500Kb cbq(borrow) 51 queue boss_int bandwidth 250Kb priority 3 cbq(borrow) 52queue www_int bandwidth 99Mb cbq(red borrow) 53 54# enable queueing on the DMZ interface to control traffic destined for 55# the WWW server. cbq will be used on this interface since detailed 56# control of bandwidth is necessary. bandwidth on this interface is set 57# to the maximum. traffic from the internal network will be able to use 58# all of this bandwidth while traffic from the Internet will be limited 59# to 500Kbps. 60 61altq on fxp1 cbq bandwidth 100% queue { internal_dmz, net_dmz } 62 63# define the parameters for the child queues. 64# internal_dmz - traffic from the internal network. 65# net_dmz - container queue for traffic from the Internet. 66# net_dmz_http - http traffic; higher priority. 67# net_dmz_misc - all non-http traffic. this is also the default queue. 68 69queue internal_dmz bandwidth 99Mb cbq(borrow) 70queue net_dmz bandwidth 500Kb { net_dmz_http, net_dmz_misc } 71 queue net_dmz_http bandwidth 50% priority 3 cbq(red borrow) 72 queue net_dmz_misc bandwidth 50% priority 1 cbq(default borrow) 73 74 75# ... in the filtering section of pf.conf ... 76 77main_net = "192.168.0.0/24" 78it_net = "192.168.1.0/24" 79int_nets = "{ 192.168.0.0/24, 192.168.1.0/24 }" 80dmz_net = "10.0.0.0/24" 81 82boss = "192.168.0.200" 83wwwserv = "10.0.0.100" 84 85# default deny 86block on { fxp0, fxp1, dc0 } all 87 88# filter rules for fxp0 inbound 89pass in on fxp0 proto tcp from any to $wwwserv port { 21, \ 90 > 49151 } queue www_ext_misc 91pass in on fxp0 proto tcp from any to $wwwserv port 80 \ 92 queue www_ext_http 93 94# filter rules for fxp0 outbound 95pass out on fxp0 from $int_nets to any 96pass out on fxp0 from $boss to any queue boss_ext 97 98# filter rules for dc0 inbound 99pass in on dc0 from $int_nets to any 100pass in on dc0 from $it_net to any queue it_int 101pass in on dc0 from $boss to any queue boss_int 102pass in on dc0 proto tcp from $int_nets to $wwwserv port { 21, 80, \ 103 > 49151 } queue www_int 104 105# filter rules for dc0 outbound 106pass out on dc0 from dc0 to $int_nets 107 108# filter rules for fxp1 inbound 109pass in on fxp1 proto { tcp, udp } from $wwwserv to any port 53 110 111# filter rules for fxp1 outbound 112pass out on fxp1 proto tcp from any to $wwwserv port { 21, \ 113 > 49151 } queue net_dmz_misc 114pass out on fxp1 proto tcp from any to $wwwserv port 80 queue net_dmz_http 115pass out on fxp1 proto tcp from $int_nets to $wwwserv port { 80, \ 116 21, > 49151 } queue internal_dmz 117