1*fff57c55Syamt# $NetBSD: faq-example2,v 1.2 2008/06/18 09:06:26 yamt Exp $ 2*fff57c55Syamt# $OpenBSD: faq-example2,v 1.4 2006/10/07 04:48:01 mcbride Exp $ 3533d14a1Syamt 4533d14a1Syamt# 5533d14a1Syamt# Small, Home Network 6533d14a1Syamt# http://www.openbsd.org/faq/pf/queueing.html#example1 7533d14a1Syamt# 8533d14a1Syamt 9533d14a1Syamt 10533d14a1Syamt# enable queueing on the external interface to control traffic going to 11533d14a1Syamt# the Internet. use the priq scheduler to control only priorities. set 12533d14a1Syamt# the bandwidth to 610Kbps to get the best performance out of the TCP 13533d14a1Syamt# ACK queue. 14533d14a1Syamt 15533d14a1Syamtaltq on fxp0 priq bandwidth 610Kb queue { std_out, ssh_im_out, dns_out, \ 16533d14a1Syamt tcp_ack_out } 17533d14a1Syamt 18533d14a1Syamt# define the parameters for the child queues. 19533d14a1Syamt# std_out - the standard queue. any filter rule below that does not 20533d14a1Syamt# explicitly specify a queue will have its traffic added 21533d14a1Syamt# to this queue. 22533d14a1Syamt# ssh_im_out - interactive SSH and various instant message traffic. 23533d14a1Syamt# dns_out - DNS queries. 24533d14a1Syamt# tcp_ack_out - TCP ACK packets with no data payload. 25533d14a1Syamt 26533d14a1Syamtqueue std_out priq(default) 27533d14a1Syamtqueue ssh_im_out priority 4 priq(red) 28533d14a1Syamtqueue dns_out priority 5 29533d14a1Syamtqueue tcp_ack_out priority 6 30533d14a1Syamt 31533d14a1Syamt# enable queueing on the internal interface to control traffic coming in 32533d14a1Syamt# from the Internet. use the cbq scheduler to control bandwidth. max 33533d14a1Syamt# bandwidth is 2Mbps. 34533d14a1Syamt 35533d14a1Syamtaltq on dc0 cbq bandwidth 2Mb queue { std_in, ssh_im_in, dns_in, bob_in } 36533d14a1Syamt 37533d14a1Syamt# define the parameters for the child queues. 38533d14a1Syamt# std_in - the standard queue. any filter rule below that does not 39533d14a1Syamt# explicitly specify a queue will have its traffic added 40533d14a1Syamt# to this queue. 41533d14a1Syamt# ssh_im_in - interactive SSH and various instant message traffic. 42533d14a1Syamt# dns_in - DNS replies. 43533d14a1Syamt# bob_in - bandwidth reserved for Bob's workstation. allow him to 44533d14a1Syamt# borrow. 45533d14a1Syamt 46*fff57c55Syamtqueue std_in bandwidth 1.6Mb cbq(default) 47*fff57c55Syamtqueue ssh_im_in bandwidth 200Kb priority 4 48*fff57c55Syamtqueue dns_in bandwidth 120Kb priority 5 49533d14a1Syamtqueue bob_in bandwidth 80Kb cbq(borrow) 50533d14a1Syamt 51533d14a1Syamt 52533d14a1Syamt# ... in the filtering section of pf.conf ... 53533d14a1Syamt 54533d14a1Syamtalice = "192.168.0.2" 55533d14a1Syamtbob = "192.168.0.3" 56533d14a1Syamtcharlie = "192.168.0.4" 57533d14a1Syamtlocal_net = "192.168.0.0/24" 58533d14a1Syamtssh_ports = "{ 22 2022 }" 59533d14a1Syamtim_ports = "{ 1863 5190 5222 }" 60533d14a1Syamt 61533d14a1Syamt# filter rules for fxp0 inbound 62533d14a1Syamtblock in on fxp0 all 63533d14a1Syamt 64533d14a1Syamt# filter rules for fxp0 outbound 65533d14a1Syamtblock out on fxp0 all 66*fff57c55Syamtpass out on fxp0 inet proto tcp from (fxp0) to any \ 67*fff57c55Syamt queue(std_out, tcp_ack_out) 68*fff57c55Syamtpass out on fxp0 inet proto { udp icmp } from (fxp0) to any 69533d14a1Syamtpass out on fxp0 inet proto { tcp udp } from (fxp0) to any port domain \ 70*fff57c55Syamt queue dns_out 71533d14a1Syamtpass out on fxp0 inet proto tcp from (fxp0) to any port $ssh_ports \ 72*fff57c55Syamt queue(std_out, ssh_im_out) 73533d14a1Syamtpass out on fxp0 inet proto tcp from (fxp0) to any port $im_ports \ 74*fff57c55Syamt queue(ssh_im_out, tcp_ack_out) 75533d14a1Syamt 76533d14a1Syamt# filter rules for dc0 inbound 77533d14a1Syamtblock in on dc0 all 78533d14a1Syamtpass in on dc0 from $local_net 79533d14a1Syamt 80533d14a1Syamt# filter rules for dc0 outbound 81533d14a1Syamtblock out on dc0 all 82533d14a1Syamtpass out on dc0 from any to $local_net 83533d14a1Syamtpass out on dc0 proto { tcp udp } from any port domain to $local_net \ 84533d14a1Syamt queue dns_in 85533d14a1Syamtpass out on dc0 proto tcp from any port $ssh_ports to $local_net \ 86533d14a1Syamt queue(std_in, ssh_im_in) 87533d14a1Syamtpass out on dc0 proto tcp from any port $im_ports to $local_net \ 88533d14a1Syamt queue ssh_im_in 89533d14a1Syamtpass out on dc0 from any to $bob queue bob_in 90