|
||||||||||
On 29.11.2007, at 16:00, Sterling Windmill wrote: > If I disable and re-enable traffic shaping I see a few extra > entries in the firewall states that seem to be valid, but no new > entries show up afterwards. > > I have also verified that traffic shaping does not seem to be > working, as I have added a small pipe and corresponding rules to > shape traffic originating from my PC behind the m0n0wall and PIX > and see no change in throughput. > > Has anyone else experienced problems with 1.3b5 filtering bridge/ > traffic shaper perhaps specifically on the new ALIX hardware? You're right - on the 1.3b versions, enabling the traffic shaper (or the captive portal, for that matter) while the filtering bridge is enabled causes bridged packets not to be filtered. I've investigated the cause of this issue in the FreeBSD kernel, and after figuring out why this happens, I searched for FreeBSD PRs. I was quite surprised when I found one of my own, submitted more than two years ago, about the exact same issue (but in 5.3-RELEASE): http://www.FreeBSD.org/cgi/query-pr.cgi?pr=kern/78090 The problem was introduced with pfil hooks in FreeBSD - since ipfw also registers a pfil hook, but needs to be called separately from within BRIDGE code to handle dummynet properly, they just put in a quick fix to prevent IPFW from running twice. However, that fix simply jumps over any pfil hooks when bridging if ipfw is loaded (therefore also circumventing ipfilter). Apparently nobody cared, and the fix is not trivial... The fact that BRIDGE has been deprecated in favor of if_bridge probably won't help getting somebody to fix this issue either. I can try to do it myself, but to be honest, I'm not that much of a kernel hacker. The other alternative would be to convert m0n0wall to use if_bridge - speak up, volunteers! ;) In the meantime, I've put a notice on http://m0n0.ch/wall/ beta-1.3.php about this issue. Note that the traffic shaper works properly with (non-filtering) bridging in 1.3b, but behavior is slightly different from traffic shaping in normal (routing) mode: as packets are only passed through the shaper once (on input) when bridging (as opposed to both on input and output when routing), your traffic shaper rules need to reflect the fact that they can only match on input (i.e. "direction: out" will never match for bridged packets). However, this has always been the case in m0n0wall and is not specific to 1.3b. Regards, Manuel |