1135184Smlaier# $FreeBSD: releng/11.0/share/examples/pf/faq-example2 173536 2007-11-11 01:16:51Z mlaier $ 2173536Smlaier# $OpenBSD: faq-example2,v 1.4 2006/10/07 04:48:01 mcbride Exp $ 3135184Smlaier 4135184Smlaier# 5135184Smlaier# Small, Home Network 6135184Smlaier# http://www.openbsd.org/faq/pf/queueing.html#example1 7135184Smlaier# 8135184Smlaier 9135184Smlaier 10135184Smlaier# enable queueing on the external interface to control traffic going to 11135184Smlaier# the Internet. use the priq scheduler to control only priorities. set 12135184Smlaier# the bandwidth to 610Kbps to get the best performance out of the TCP 13135184Smlaier# ACK queue. 14135184Smlaier 15135184Smlaieraltq on fxp0 priq bandwidth 610Kb queue { std_out, ssh_im_out, dns_out, \ 16135184Smlaier tcp_ack_out } 17135184Smlaier 18135184Smlaier# define the parameters for the child queues. 19135184Smlaier# std_out - the standard queue. any filter rule below that does not 20135184Smlaier# explicitly specify a queue will have its traffic added 21135184Smlaier# to this queue. 22135184Smlaier# ssh_im_out - interactive SSH and various instant message traffic. 23135184Smlaier# dns_out - DNS queries. 24135184Smlaier# tcp_ack_out - TCP ACK packets with no data payload. 25135184Smlaier 26135184Smlaierqueue std_out priq(default) 27135184Smlaierqueue ssh_im_out priority 4 priq(red) 28135184Smlaierqueue dns_out priority 5 29135184Smlaierqueue tcp_ack_out priority 6 30135184Smlaier 31135184Smlaier# enable queueing on the internal interface to control traffic coming in 32135184Smlaier# from the Internet. use the cbq scheduler to control bandwidth. max 33135184Smlaier# bandwidth is 2Mbps. 34135184Smlaier 35135184Smlaieraltq on dc0 cbq bandwidth 2Mb queue { std_in, ssh_im_in, dns_in, bob_in } 36135184Smlaier 37135184Smlaier# define the parameters for the child queues. 38135184Smlaier# std_in - the standard queue. any filter rule below that does not 39135184Smlaier# explicitly specify a queue will have its traffic added 40135184Smlaier# to this queue. 41135184Smlaier# ssh_im_in - interactive SSH and various instant message traffic. 42135184Smlaier# dns_in - DNS replies. 43135184Smlaier# bob_in - bandwidth reserved for Bob's workstation. allow him to 44135184Smlaier# borrow. 45135184Smlaier 46173536Smlaierqueue std_in bandwidth 1.6Mb cbq(default) 47173536Smlaierqueue ssh_im_in bandwidth 200Kb priority 4 48173536Smlaierqueue dns_in bandwidth 120Kb priority 5 49135184Smlaierqueue bob_in bandwidth 80Kb cbq(borrow) 50135184Smlaier 51135184Smlaier 52135184Smlaier# ... in the filtering section of pf.conf ... 53135184Smlaier 54135184Smlaieralice = "192.168.0.2" 55135184Smlaierbob = "192.168.0.3" 56135184Smlaiercharlie = "192.168.0.4" 57135184Smlaierlocal_net = "192.168.0.0/24" 58135184Smlaierssh_ports = "{ 22 2022 }" 59135184Smlaierim_ports = "{ 1863 5190 5222 }" 60135184Smlaier 61135184Smlaier# filter rules for fxp0 inbound 62135184Smlaierblock in on fxp0 all 63135184Smlaier 64135184Smlaier# filter rules for fxp0 outbound 65135184Smlaierblock out on fxp0 all 66173536Smlaierpass out on fxp0 inet proto tcp from (fxp0) to any \ 67173536Smlaier queue(std_out, tcp_ack_out) 68173536Smlaierpass out on fxp0 inet proto { udp icmp } from (fxp0) to any 69135184Smlaierpass out on fxp0 inet proto { tcp udp } from (fxp0) to any port domain \ 70173536Smlaier queue dns_out 71135184Smlaierpass out on fxp0 inet proto tcp from (fxp0) to any port $ssh_ports \ 72173536Smlaier queue(std_out, ssh_im_out) 73135184Smlaierpass out on fxp0 inet proto tcp from (fxp0) to any port $im_ports \ 74173536Smlaier queue(ssh_im_out, tcp_ack_out) 75135184Smlaier 76135184Smlaier# filter rules for dc0 inbound 77135184Smlaierblock in on dc0 all 78135184Smlaierpass in on dc0 from $local_net 79135184Smlaier 80135184Smlaier# filter rules for dc0 outbound 81135184Smlaierblock out on dc0 all 82135184Smlaierpass out on dc0 from any to $local_net 83135184Smlaierpass out on dc0 proto { tcp udp } from any port domain to $local_net \ 84135184Smlaier queue dns_in 85135184Smlaierpass out on dc0 proto tcp from any port $ssh_ports to $local_net \ 86135184Smlaier queue(std_in, ssh_im_in) 87135184Smlaierpass out on dc0 proto tcp from any port $im_ports to $local_net \ 88135184Smlaier queue ssh_im_in 89135184Smlaierpass out on dc0 from any to $bob queue bob_in 90