Cisco elearning: Unix Network

Showing posts with label Unix Network. Show all posts

9:31 AM

Linux QoS

Linux provides a powerful and feature-rich subsystem for traffic control (traffic shaping, queuing disciplines, classification, prioritizing, sharing, filter chains), of both ingress and egress traffic. You configure such by having multiple sets of routing tables (iproute2) and by using the tc tool.

The main application of realms is in conjunction with the tc route classifier, where they help assign packets to traffic classes for accounting, policing, and scheduling. The tc tool handles these tasks:

Setup of queuing disciplines (QDISC) such as CBQ, RED, and SFQ
Setup of parent and child classes for classful queuing
Flexible filtering of classful queuing disciplines
Combinations of all these features

You also can shape inbound via the ingress option of the tc utility. It is up to you to decide whether inbound policing makes sense. Examples 13-6 through 13-10 demonstrate classless QDISCs.

Note that Example 13-6 facilitates a simple token-bucket filter (TBF) applied to interface eth0 (highlighted text), with certain parameters that influence shaping and allow short bursts while reacting with delays and drops to lasting overload conditions. In the current implementation, tokens correspond to bytes, not packets. A similar effect is achieved via a shaper device attached to eth0 in Example 13-7.

NOTE

For more details on TBF and an in-depth discussion of classful and classless queuing disciplines, see the "Linux Advanced Routing & Traffic Control HOWTO," especially for generic RED, weighted RED, and weighted round-robin (WRR).

Example 13-6. Interface Shaping with a TBF

[root@callisto:~#] tc qdisc add dev eth0 root tbf rate 220kbit latency 50ms burst 1540



[root@callisto:~#] tc -d qdisc

qdisc tbf 8001: dev eth0 rate 220Kbit burst 1539b/8 mpu 0b lat 61.0ms



[root@callisto:~#] tc -s qdisc

qdisc tbf 8001: dev eth0 rate 220Kbit burst 1539b lat 61.0ms

Sent 425 bytes 5 pkts (dropped 0, overlimits 0)

Example 13-7. Alternative Interface Shaping with the Shaper Device

[root@callisto:~#] insmod shaper

Using /lib/modules/2.4.21/kernel/drivers/net/shaper.o



[root@callisto:~#] shapecfg -?

shapecfg attach  

shapecfg speed  



[root@callisto:~#] shapecfg attach shaper0 eth0



[root@callisto:~#] shapecfg speed shaper0 2000000



[root@callisto:~#] ifconfig shaper0 192.168.80.1 netmask 255.255.255.0 up



[root@callisto:~#] ifconfig -a

eth0      Link encap:Ethernet  HWaddr 00:10:5A:D7:93:60

         inet addr:192.168.14.1  Bcast:192.168.14.255  Mask:255.255.255.0

         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

         RX packets:0 errors:0 dropped:0 overruns:0 frame:0

         TX packets:476 errors:0 dropped:0 overruns:0 carrier:0

         collisions:0 txqueuelen:100

         RX bytes:0 (0.0 b)  TX bytes:53487 (52.2 Kb)

         Interrupt:5 Base address:0xd800



eth1      Link encap:Ethernet  HWaddr 52:54:05:E3:51:87

         inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0

         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

         RX packets:19895 errors:0 dropped:0 overruns:0 frame:0

         TX packets:14777 errors:0 dropped:0 overruns:0 carrier:0

         collisions:43 txqueuelen:100

         RX bytes:5879639 (5.6 Mb)  TX bytes:1302730 (1.2 Mb)

         Interrupt:9 Base address:0xd400



eth1:1    Link encap:Ethernet  HWaddr 52:54:05:E3:51:87

         inet addr:192.168.45.253  Bcast:192.168.45.255  Mask:255.255.255.0

         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

         Interrupt:9 Base address:0xd400



lo        Link encap:Local Loopback

         inet addr:127.0.0.1  Mask:255.0.0.0

         UP LOOPBACK RUNNING  MTU:16436  Metric:1

         RX packets:72 errors:0 dropped:0 overruns:0 frame:0

         TX packets:72 errors:0 dropped:0 overruns:0 carrier:0

         collisions:0 txqueuelen:0

         RX bytes:5416 (5.2 Kb)  TX bytes:5416 (5.2 Kb)



shaper0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00

         inet addr:192.168.80.1  Mask:255.255.255.0

         UP RUNNING  MTU:1500  Metric:1

         RX packets:0 errors:0 dropped:0 overruns:0 frame:0

         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

         collisions:0 txqueuelen:10

         RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Stochastic fair queuing (SFQ), as shown in Example 13-8, represents an "almost" fair queuing mechanism with reduced calculation burden. It helps on saturated links to distribute utilization in a fair way among sessions.

Example 13-8. Stochastic Fair Queuing

[root@callisto:~#] tc qdisc add dev eth0 root sfq perturb 10 quantum 2



[root@callisto:~#] tc -s -d qdisc list

qdisc sfq 8003: dev eth0 quantum 2b limit 128p flows 128/1024 perturb 10sec

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

Example 13-9. pFIFO-Fast

[root@callisto:~#] tc qdisc add dev eth0 root pfifo limit 200k



[root@callisto:~#] tc -s -d qdisc list

qdisc pfifo 8004: dev eth0 limit 204800p

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

Example 13-10. Random Early Detect/Discard with Explicit Congestion Notification

[root@callisto:~#] tc qdisc add dev eth0 root red limit 100 min 80 max 90 avpkt 10 burst

 10 probability 1 bandwidth 200 ecn



[root@callisto:~#] tc -s -d qdisc list

qdisc red 8006: dev eth0 limit 100b min 80b max 90b ecn ewma 2 Plog 4 Scell_log 17

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

 marked 0 early 0 pdrop 0 other 0

In contrast to the previous examples, Example 13-11 offers a variant of classful queuing (priority queuing) in combination with filter chains. Class-based queuing (CBQ) is a huge field that is covered exhaustively in the HOWTO.

Example 13-11. Priority Queuing (PRIQ)

[root@callisto:~#] tc qdisc add dev eth0 root handle 1: prio



[root@callisto:~#] tc -s -d qdisc

qdisc prio 1: dev eth0 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1

Sent 1097 bytes 5 pkts (dropped 0, overlimits 0)



[root@callisto:~#] tc qdisc add dev eth0 parent 1:1 handle 10: sfq



[root@callisto:~#] tc qdisc add dev eth0 parent 1:2 handle 20: tbf rate 20kbit buffer 1600

 limit 3000



[root@callisto:~#] tc qdisc add dev eth0 parent 1:3 handle 30: sfq



[root@callisto:~#] tc -s -d qdisc

qdisc sfq 30: dev eth0 quantum 1514b limit 128p flows 128/1024

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

qdisc tbf 20: dev eth0 rate 20Kbit burst 1599b/8 mpu 0b lat 667.6ms

Sent 85 bytes 1 pkts (dropped 0, overlimits 0)



qdisc sfq 10: dev eth0 quantum 1514b limit 128p flows 128/1024

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)



qdisc prio 1: dev eth0 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1

Sent 1182 bytes 6 pkts (dropped 0, overlimits 0)



[root@callisto:~#] tc -s -d qdisc list dev eth0

qdisc sfq 30: quantum 1514b limit 128p flows 128/1024

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)



qdisc tbf 20: rate 20Kbit burst 1599b/8 mpu 0b lat 667.6ms

Sent 85 bytes 1 pkts (dropped 0, overlimits 0)



qdisc sfq 10: quantum 1514b limit 128p flows 128/1024

Sent 0 bytes 0 pkts (dropped 0, overlimits 0)



qdisc prio 1: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1

Sent 1182 bytes 6 pkts (dropped 0, overlimits 0)



[root@callisto:~#] tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip dport

 22 0xffff flowid 1:1



[root@callisto:~#] tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip sport

 80 0xffff flowid 1:1

[root@callisto:~#] tc -s -d filter list dev eth0

filter parent 1: protocol ip pref 1 u32

filter parent 1: protocol ip pref 1 u32 fh 800: ht divisor 1

filter parent 1: protocol ip pref 1 u32 fh 800::800 order 2048 key ht 800 bkt 0   flowid 1

:1 match 00000016/0000ffff at 20

filter parent 1: protocol ip pref 1 u32 fh 800::801 order 2049 key ht 800 bkt 0   flowid 1

:1 match 00500000/ffff0000 at 20

9:24 AM

UNIX Firewalling Engines and Queuing

In the UNIX world, traffic conditioning, policy routing, and shaping are tied closely to the packet filters available for the different platforms, forming conceptual pairs such as packet filter/ALTQ (Alternate Queuing), ipfirewall/dummynet, or iptables/tc. The reason for this design is simple: Packet filters already provide the necessary hooks within the forwarding engine of the IP network stack.

On Linux, the relationship between netfilter/iptables and the iproute2 package (ip/tc/rtmon) constitutes a firewall-marking and packet-mangling symbiosis to build sophisticated QoS routers. Packet mangling (manipulation) is the altering of certain bits of the IP header—for example, the ToS field or DSCP.

Table 13-1 shows an overview of the platform availability of these components. Figure 13-1 shows the lab layout for the following subsections.

OpenBSD ALTQ+pf

Packet filter (pf) is OpenBSD's stateful-inspection firewall system, packet filter, and NAT engine. It has been ported to NetBSD and FreeBSD recently. pf also is capable of normalizing and conditioning TCP/IP traffic and providing bandwidth control and packet prioritization via ALTQ. The ALTQ system is a framework to manage queuing disciplines on network interfaces.

Starting with OpenBSD 3.3, ALTQ has been integrated into pf (http://www.benzedrine.cx/pf.html). OpenBSD's ALTQ implementation supports CBQ and PRIQ schedulers (see Examples 13-17 and 13-18). It also supports RED and explicit congestion notification (ECN). The /etc/pf.conf file is the only relevant configuration file (pf.conf(5), pf(4), pfctl(8), pflogd(8), ftp-proxy(8)).

Example 13-17. OpenBSD pf/ALTQ PRIQ Example

[root@europa:~#] cat /etc/pf.conf

#

# Queuing: rule-based bandwidth control

#

# PRIQ Example

altq on xl0 bandwidth 2Mb priq queue {dflt engineering testlab}

queue dflt priority 7 qlimit 50 priq(default red ecn)

queue engineering priority 6 qlimit 50 priq(red ecn)

queue testlab priority 5 qlimit 50 priq(rio ecn)



# Filtering:

pass in log all

pass out on xl0 proto tcp from any to any port 22 queue dflt

pass out on xl0 proto icmp from any to any queue testlab

pass out on xl0 from 172.16.0.0/16 to any queue engineering

pass out log all



[root@europa:~#] pfctl -s queue -v

queue dflt priority 7 priq( red ecn default )

[ pkts:        468  bytes:      47560  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

queue engineering priority 6 priq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

queue testlab priority 5 priq( red ecn rio )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]



[root@europa:~#] pfctl -s queue -v -v

queue dflt priority 7 priq( red ecn default )

[ pkts:        495  bytes:      50376  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

queue engineering priority 6 priq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

queue testlab priority 5 priq( red ecn rio )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]



queue dflt priority 7 priq( red ecn default )

[ pkts:        511  bytes:      52212  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

[ measured:     3.2 packets/s, 2.93Kb/s ]

queue engineering priority 6 priq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

[ measured:     0.0 packets/s, 0 b/s ]

queue testlab priority 5 priq( red ecn rio )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

[ measured:     0.0 packets/s, 0 b/s ]



queue dflt priority 7 priq( red ecn default )

[ pkts:        532  bytes:      54538  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

[ measured:     4.2 packets/s, 3.71Kb/s ]

queue engineering priority 6 priq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

[ measured:     0.0 packets/s, 0 b/s ]

queue testlab priority 5 priq( red ecn rio )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50 ]

[ measured:     0.0 packets/s, 0 b/s ]



[root@europa:~#] pfctl -s rules -v

scrub in all random-id fragment reassemble

[ Evaluations: 2979      Packets: 1482      Bytes: 0           States: 0     ]



pass in log all

[ Evaluations: 1536      Packets: 759       Bytes: 64806       States: 0     ]



pass out on xl0 proto tcp from any to any port = ssh queue dflt

[ Evaluations: 1539      Packets: 0         Bytes: 0           States: 0     ]



pass out on xl0 proto icmp all queue testlab

[ Evaluations: 783       Packets: 0         Bytes: 0           States: 0     ]



pass out on xl0 inet from 172.16.0.0/16 to any queue engineering

[ Evaluations: 786       Packets: 0         Bytes: 0           States: 0     ]



pass out log all

[ Evaluations: 789       Packets: 789       Bytes: 73176       States: 0     ]

Example 13-18. OpenBSD pf/ALTQ CBQ Example

[root@europa:~#] cat /etc/pf.conf

#

# Queuing: rule-based bandwidth control

#

# CBQ Example

altq on xl0 bandwidth 2Mb cbq queue {dflt engineering testlab}

queue dflt bandwidth 50% priority 7 qlimit 50 cbq(default red ecn)

queue engineering priority 6 bandwidth 30% qlimit 50 cbq(red ecn borrow)

queue testlab priority 5 bandwidth 20% qlimit 50 cbq(red ecn)



# Filtering

pass in log all

pass out on xl0 proto tcp from any to any port 22 queue dflt

pass out on xl0 proto icmp from any to any queue testlab

pass out on xl0 from 172.16.0.0/16 to any queue engineering

pass out log all



[root@europa:~#] pfctl -s queue -v

queue root_xl0 bandwidth 2Mb priority 0 cbq( wrr root ) {dflt, engineering, testlab}

[ pkts:         25  bytes:       2256  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

queue  dflt bandwidth 1Mb priority 7 cbq( red ecn default )

[ pkts:         25  bytes:       2256  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

queue  engineering bandwidth 600Kb priority 6 cbq( red ecn borrow )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

queue  testlab bandwidth 400Kb priority 5 cbq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]



[root@europa:~#] pfctl -s queue -v -v

queue root_xl0 bandwidth 2Mb priority 0 cbq( wrr root ) {dflt, engineering, testlab}

[ pkts:         60  bytes:       6010  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

queue  dflt bandwidth 1Mb priority 7 cbq( red ecn default )

[ pkts:         60  bytes:       6010  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

queue  engineering bandwidth 600Kb priority 6 cbq( red ecn borrow )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

queue  testlab bandwidth 400Kb priority 5 cbq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]



queue root_xl0 bandwidth 2Mb priority 0 cbq( wrr root ) {dflt, engineering, testlab}

[ pkts:         80  bytes:       8454  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

[ measured:     4.0 packets/s, 3.90Kb/s ]

queue  dflt bandwidth 1Mb priority 7 cbq( red ecn default )

[ pkts:         80  bytes:       8454  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

[ measured:     4.0 packets/s, 3.90Kb/s ]



queue  engineering bandwidth 600Kb priority 6 cbq( red ecn borrow )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

[ measured:     0.0 packets/s, 0 b/s ]

queue  testlab bandwidth 400Kb priority 5 cbq( red ecn )

[ pkts:          0  bytes:          0  dropped pkts:      0 bytes:      0 ]

[ qlength:   0/ 50  borrows:      0  suspends:      0 ]

[ measured:     0.0 packets/s, 0 b/s ]



[root@europa:~#] pfctl -s rules -v

scrub in all random-id fragment reassemble

[ Evaluations: 584       Packets: 287       Bytes: 0           States: 0     ]



pass in log all

[ Evaluations: 10        Packets: 5         Bytes: 380         States: 0     ]



pass out on xl0 proto tcp from any to any port = ssh queue dflt

[ Evaluations: 10        Packets: 0         Bytes: 0           States: 0     ]



pass out on xl0 proto icmp all queue testlab

[ Evaluations: 5         Packets: 0         Bytes: 0           States: 0     ]



pass out on xl0 inet from 172.16.0.0/16 to any queue engineering

[ Evaluations: 5         Packets: 0         Bytes: 0           States: 0     ]



pass out log all

[ Evaluations: 5         Packets: 5         Bytes: 380         States: 0     ]

FreeBSD ipfilter+ALTQ

In contrast to OpenBSD pf, ipfilter and ALTQ do not form an integrated architecture. ALTQ does not natively ship with FreeBSD; it is now part of the KAME Project (http://www.kame.net/). The original web page is located at http://www.csl.sony.co.jp/~kjc/software.html#ALTQ.

ALTQ is concerned with queuing disciplines and resource-sharing QoS approaches. Remember, a queuing discipline controls outgoing traffic only. It provides stubs for RSVP and DiffServ support and enforces the following queuing regimes:

CBQ— Class-based queuing
HFSC— The hierarchical fair service curve algorithm for Link sharing, real-time, and priority service
JoBS— Joint buffer management and scheduling algorithm
RED— Random early detection
RIO— RED with in/out
Blue— A queue-management algorithm focusing on eliminating packet loss in congestion situations (an alternative to RED)
WFQ— Weighted fair queuing
PRIQ— Priority queuing

CBQ, HFSC, and RED are the most mature and recommended approaches. Relevant management tools and man pages are as follows:

tbrconfig(8)— Configure a token-bucket regulator for an output queue
altq(9)— Kernel interfaces for manipulating output queues on network interfaces
altq.conf(5)— ALTQ configuration file for altqd(8)
altqd(8)— The ALTQ daemon
altqstat(1)— Show ALTQ status
pf.conf(5)— Packet filter configuration file
pfctl(8)— Control the packet filter (PF) and NAT device

You can use the ALTQ token-bucket regulator to rate-limit an interface (see Example 13-19).

Example 13-19. Interface Rate-Limiting Without Queuing Discipline

[root@castor:~#] tbrconfig ed0 30M auto

       ed00: tokenrate 30.00M(bps)  bucketsize 36.62K(bytes)



[root@castor:~#] tbrconfig -d ed0

       deleted token bucket regulator on ed0

FreeBSD IP Firewall(ipfw) + dummynet

FreeBSD's ipfw(4) is the utility that is responsible for controlling the ipfirewall(4) and dummynet(4) system facilities. ipfirewall is used for filtering, redirection, accounting, and NAT, whereas dummynet is a flexible bandwidth manager and delay emulator for traffic shaping and networking protocol testing on the FreeBSD operating system. dummynet supports a variant of WFQ and can be used on any type of workstation or gateway acting as either a router or bridge (see Example 13-20). For a detailed introduction, check out the following excellent man pages: divert(4), ipfirewall(4), ipfw(4), ipfw-graph(8), ipfw-al(1).

Example 13-20. Traffic Shaping on a Crossover-Link FreeBSD with RED and WF2Q+ <--> Cisco IOS Architecture with CAR/GTS and RED on the Cisco Side

[root@castor:~#] ipfw add pipe 1 icmp from any to any out xmit ed0

[root@castor:~#] ipfw pipe 1 config bw 8Kbit/s queue 10 delay 10ms red

[root@castor:~#] ipfw queue 1 config pipe 1 weight 1 red



[root@castor:~#] ping 192.168.7.254

PING 192.168.7.254 (192.168.7.254): 56 data bytes

64 bytes from 192.168.7.254: icmp_seq=0 ttl=255 time=94.281 ms

64 bytes from 192.168.7.254: icmp_seq=1 ttl=255 time=95.006 ms

64 bytes from 192.168.7.254: icmp_seq=2 ttl=255 time=95.030 ms

64 bytes from 192.168.7.254: icmp_seq=3 ttl=255 time=95.002 ms



scar# show running-config

...

!

interface Ethernet0

bandwidth 10000

ip address 192.168.14.254 255.255.255.0

media-type 10BaseT

random-detect

traffic-shape rate 8000 8000 8000 1000

!

interface Ethernet1

ip address 192.168.7.254 255.255.255.0

rate-limit output 8000 1500 2000 conform-action transmit exceed-action drop

media-type 10BaseT

random-detect

!...



scar# show traffic-shape ethernet 0



Interface   Et0

      Access Target    Byte   Sustain   Excess    Interval  Increment Adapt

VC     List   Rate      Limit  bits/int  bits/int  (ms)      (bytes)   Active

-             8000      2000   8000      8000      1000      1000      -



scar# show traffic-shape statistics ethernet 0

                 Access Queue   Packets   Bytes     Packets   Bytes     Shaping

I/F               List   Depth                       Delayed   Delayed   Active

Et0                      0       351       32902     0         0         no



scar# show int ethernet 1 rate-limit

Ethernet1

 Output

   matches: all traffic

     params:  8000 bps, 1500 limit, 2000 extended limit

     conformed 340 packets, 33320 bytes; action: transmit

     exceeded 0 packets, 0 bytes; action: drop

     last packet: 940ms ago, current burst: 0 bytes

     last cleared 00:12:30 ago, conformed 0 bps, exceeded 0 bps

scar# ping 192.168.7.7


Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.7.7, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 108/112/116 ms
dummynet works in symbiosis with ipfw by "intercepting packets  and passing them through one or more objects called queues and pipes, which  simulate the effects of bandwidth limitations, propagation delays, bounded-size  queues, packet losses, and multipath."^[1]

Pipes represent fixed-bandwidth channels that can contain one or multiple queues. Think of a pipe as analogous to ATM virtual paths (VPs) and virtual channels (VCs). You can control the utilization and, as a consequence, the proportional bandwidth share of a pipe by associating queues with a weight.

Linux Firewall Marking and iproute2 (ip/tc)

netfilter and iptables are elements of the firewalling, NAT/NAPT, policy router, and packet-mangling architecture for the 2.4.x and 2.6.x Linux kernels. netfilter and iptables(8) allow marking and tagging of a packet with a number via the --set-mark facility. This is a mark of local significance only (packet metadata) and does not alter the IP header after forwarding. This mark can assign a different routing table (routing policy), as demonstrated in Example 13-21.

Example 13-21. Policy Routing Based on iptables Markings

[root@callisto:~#] iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 25 -j MARK

 --set-mark 1

[root@callisto:~#] echo 1 lab >> /etc/iproute2/rt_tables

[root@callisto:~#] ip rule add fwmark 1 table lab

[root@callisto:~#] ip rule list

0:     from all lookup local

32764: from all fwmark        1 lookup lab

32766: from all lookup main

32767: from all lookup default



[root@callisto:~#] ip route add default via 192.168.14.254 table lab

Bell Labs' Eclipse—An Operating System with QoS Support

The Eclipse operating system (http://www.bell-labs.com/project/eclipse/release/) is a QoS test platform from Lucent Technologies. It is an independent OS approach that is compatible with FreeBSD and provides a simple application-programming interface (API) for fine-grained QoS support.

8:55 AM

UNIX NAT Approaches

The topology in Figure 15-1 serves as a basis for the labs in this chapter. This is a generic example featuring a five-interface firewall/NAT gateway, as follows:

The first interface is a special segment inhabited by protocols that cannot coexist with NAT.
The second interface features an Ethernet crossover link to a screening access router.
The third interface represents a demilitarized zone (DMZ) with RFC 1918 addresses.
Finally, two internal interfaces with RFC 1918 address pools complete the picture.

The assumption is that this setup serves a fairly large corporate network. Suppose, for example, we have acquired a /24 address block from our upstream ISP, either a provider aggregate or a PI address block (does not really matter). This prefix is routed toward the firewall. Likewise, the firewall defaults toward the access router, which by itself defaults to the upstream provider.

Note that Figure 15-1 demonstrates two different ways to dynamically map client requests to either an outside address pool (n:m) or a single interface address (n:1 = masquerading). The DMZ design offers great flexibility: 1:1 static mappings, port forwarding, and load balancing can be utilized in a combined fashion.

NAT gateways are an additional hop in an IP packet's path. Therefore, they alter the Time To Live (TTL). Depending on the implementation, NAT gateways always use the same pool of port numbers for multiplexing connections. These are either predetermined at compile time or can be altered via sysctl or user-space configuration such as with ipfilter (ipf). Therefore, if you want to better camouflage your NAT gateway, taking care of a good random distribution of multiplexing ports and an unaltered TTL does not leave an investigator much evidence to detect a NAT gateway.

On the other hand, if you are in the role of an auditor, look for patterns in the high-port range for evidence of NAT conversion. Usually NAT is an integrated function of modern commercial or open-source firewalls, so do not reveal the existence of a firewall by politely rejecting packets by returning ICMP information; instead, just silently discard probes and attacks. The less information you reveal, the more difficult it is for attackers to gather useful information to penetrate defenses. Also keep in mind that the checksum of several headers has to be recomputed by the NAT gateway.

Lab 15-1: OpenBSD ipfilter

This lab (as detailed in Example 15-1) features a masquerading n:1 mapping scenario commonly found in small office/home office (SOHO) broadband and dial-up scenarios, for which a subscriber gets only one address from the service provider. The external addresses of SOHO devices such as broadband routers usually are deployed via Dynamic Host Configuration Protocol (DHCP). DHCP serves internal segments or VLANs, too.

Therefore, it is recommended that you use interface descriptors or shell variables rather than IP addresses in firewall/NAT configuration files wherever possible. You will also find examples for many-to-many configurations (NAT pools), port relaying, application proxies, and load balancing in this configuration (comments inline).

Example 15-1. OpenBSD ipfilter (ipf) NAT Configuration

[root@ganymed:~#] cat /etc/ipnat.rules

#########################################################################

# NAT/PAT Generic Configuration                                         #

# Gernot Schmied, March 2003                                            #

# This configuration example assumes that the network is 20.20.20.0/24. #

#########################################################################

#                                                                       #

# To get information, try "ipnat -lsv"                                  #

# Manually start via "ipnat -CF -f /etc/ipnat.rules"                    #

# To clear and flush, try  "ipnat -CF"                                  #

#                                                                       #

#########################################################################



#OUTSIDE="ne5"

#INSIDE ="ne3"

#DMZ    ="ne4"

#NONAT  ="ne2"



################################################################

### application proxies (always place before portmap rules!) ###

################################################################

# active ftp #

map ne5 192.168.1.0/24 -> ne5/32 proxy port ftp ftp/tcp

map ne5 192.168.2.0/24 -> ne5/32 proxy port ftp ftp/tcp

# H.323 proxy support #

map ne5 192.168.1.0/24 -> ne5/32 proxy port 1720 h323/tcp

# RealAudio #

map ne5 192.168.1.0/24 -> ne5/32 proxy port 7070 raudio/tcp

# IPsec Proxy #

map ne5 192.168.1.0/24 -> ne5/32 proxy port 500 ipsec/udp



#######################################

### dynamic NAT (many-to-one = n:1) ###

#######################################



map ne5 192.168.1.0/24 -> ne5/32 portmap tcp/udp 60000:65535

map ne5 192.168.1.0/24 -> ne5/32        # for ICMP

map ne5 192.168.2.0/24 -> ne5/32 portmap tcp/udp 60000:65535

map ne5 192.168.2.0/24 -> ne5/32        # for ICMP

map ne5 192.168.14.0/24 -> ne5/32 portmap tcp/udp 60000:65535

map ne5 192.168.14.0/24 -> ne5/32        # for ICMP

# alternative #

#map ne5 192.168.1.0/24 -> ne5/32 portmap tcp/udp auto

#map ne5 192.168.1.0/24 -> ne5/32       # for ICMP



###################################################

### working with NAT pools (many-to-many = n:m) ###

###################################################



#map ne5 192.168.7.0/24 -> 20.20.20.0/24 portmap tcp/udp 60000:65535

#map ne5 192.168.7.0/24 -> 20.20.20.0/24

# exclude from NAT pool #

#map-block ne5 192.168.2.18/32 -> 20.20.20.0/24 ports 64



###############################################

### static NAT entries (one-to-one = bimap) ###

###############################################



# Do not forget to set static routes when necessary

# e.g. "route add 211.11.117.65 192.168.2.65"

# There is no need to manually establish corresponding static ARP entries;

# however, in combination with some ill-behaving access devices,

# this is always a nice workaround.

# e.g. "arp -s 211.11.117.65 00:d0:ba:4c:a5:c0"



#bimap ne5 211.11.117.65/32 -> 192.168.2.65/32

# or alternatively #

# bimap ne5 211.11.117.64/27 -> 192.168.2.64/27



#######################################

### NAT Load Balancer (round-robin) ###

#######################################



#rdr ne5 211.111.111.2/32 port 80 -> 192.168.2.3 port 8000 tcp round-robin

#rdr ne5 211.111.111.2/32 port 80 -> 192.168.2.4 port 8000 tcp round-robin

#rdr ne5 211.111.111.2/32 port 80 -> 192.168.2.5 port 8000 tcp round-robin

Example 15-2 presents status information of the NAT configuration of Example 15-1 in action.

Example 15-2. OpenBSD NAT Operation Output

[root@ganymed:~#] ipnat -l

List of active MAP/Redirect filters:

map ne5 192.168.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 60000:65535

map ne5 192.168.1.0/24 -> 0.0.0.0/32

map ne5 192.168.2.0/24 -> 0.0.0.0/32 portmap tcp/udp 60000:65535

map ne5 192.168.2.0/24 -> 0.0.0.0/32

map ne5 192.168.14.0/24 -> 0.0.0.0/32 portmap tcp/udp 60000:65535

map ne5 192.168.14.0/24 -> 0.0.0.0/32



List of active sessions:

MAP 192.168.1.1     34240 <- -> 211.111.111.2 61761 [195.34.133.149 80]

MAP 192.168.1.1     34239 <- -> 211.111.111.2 61760 [213.229.60.9 80]

MAP 192.168.1.1     34238 <- -> 211.111.111.2 61759 [138.22.167.21 80]

MAP 192.168.1.1     34237 <- -> 211.111.111.2 61758 [205.156.51.200 80]

MAP 192.168.1.1     34236 <- -> 211.111.111.2 61757 [213.229.60.100 110]

MAP 192.168.1.1     34235 <- -> 211.111.111.2 61756 [213.229.60.100 110]

MAP 192.168.1.1     34234 <- -> 211.111.111.2 61755 [213.229.60.100 110]

MAP 192.168.1.1     34233 <- -> 211.111.111.2 61754 [213.229.60.100 110]

MAP 192.168.1.1     34232 <- -> 211.111.111.2 61753 [213.46.255.2 110]

MAP 192.168.1.1     32895 <- -> 211.111.111.2 61752 [195.34.133.10 53]

MAP 192.168.1.1     32894 <- -> 211.111.111.2 61751 [195.34.133.10 53]

MAP 192.168.1.1     32893 <- -> 211.111.111.2 61745 [195.34.133.10 53]

MAP 192.168.1.1     32892 <- -> 211.111.111.2 61744 [195.34.133.10 53]

MAP 192.168.1.1     32890 <- -> 211.111.111.2 61738 [195.34.133.10 53]

MAP 192.168.1.1     32889 <- -> 211.111.111.2 61737 [195.34.133.10 53]

MAP 192.168.1.1     32888 <- -> 211.111.111.2 61731 [195.34.133.10 53]



[root@ganymed:~#] ipnat -lv

List of active MAP/Redirect filters:

map ne5 192.168.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 60000:65535

map ne5 192.168.1.0/24 -> 0.0.0.0/32

map ne5 192.168.2.0/24 -> 0.0.0.0/32 portmap tcp/udp 60000:65535

map ne5 192.168.2.0/24 -> 0.0.0.0/32

map ne5 192.168.14.0/24 -> 0.0.0.0/32 portmap tcp/udp 60000:65535

map ne5 192.168.14.0/24 -> 0.0.0.0/32



List of active sessions:

MAP 192.168.1.1     34240 <- -> 211.111.111.2 61761 [195.34.133.149 80]

       age 299 use 0 sumd 0xc586/0xc586 pr 6 bkt 0/60 flags 1

       ifp ne5 bytes 5157 pkts 19

MAP 192.168.1.1     34239 <- -> 211.111.111.2 61760 [213.229.60.9 80]

       age 299 use 0 sumd 0xc586/0xc586 pr 6 bkt 89/38 flags 1

       ifp ne5 bytes 12208 pkts 27

MAP 192.168.1.1     34238 <- -> 211.111.111.2 61759 [138.22.167.21 80]

       age 254 use 0 sumd 0xc586/0xc586 pr 6 bkt 46/122 flags 1

       ifp ne5 bytes 2129 pkts 11

MAP 192.168.1.1     34237 <- -> 211.111.111.2 61758 [205.156.51.200 80]

       age 255 use 0 sumd 0xc586/0xc586 pr 6 bkt 20/80 flags 1

       ifp ne5 bytes 8635 pkts 33

MAP 192.168.1.1     34236 <- -> 211.111.111.2 61757 [213.229.60.100 110]

       age 227 use 0 sumd 0xc586/0xc586 pr 6 bkt 100/49 flags 1

       ifp ne5 bytes 1515 pkts 24

MAP 192.168.1.1     34235 <- -> 211.111.111.2 61756 [213.229.60.100 110]

       age 226 use 0 sumd 0xc586/0xc586 pr 6 bkt 98/47 flags 1

       ifp ne5 bytes 1264 pkts 20

MAP 192.168.1.1     34234 <- -> 211.111.111.2 61755 [213.229.60.100 110]

       age 226 use 0 sumd 0xc586/0xc586 pr 6 bkt 96/45 flags 1

       ifp ne5 bytes 2481 pkts 30

MAP 192.168.1.1     34233 <- -> 211.111.111.2 61754 [213.229.60.100 110]

       age 226 use 0 sumd 0xc586/0xc586 pr 6 bkt 94/43 flags 1

       ifp ne5 bytes 1280 pkts 20

MAP 192.168.1.1     34232 <- -> 211.111.111.2 61753 [213.46.255.2 110]

       age 220 use 0 sumd 0xc586/0xc586 pr 6 bkt 75/24 flags 1

       ifp ne5 bytes 1539 pkts 22

MAP 192.168.1.1     32895 <- -> 211.111.111.2 61752 [195.34.133.10 53]

       age 992 use 0 sumd 0xcabe/0xcabe pr 17 bkt 93/32 flags 2

       ifp ne5 bytes 1150 pkts 10

MAP 192.168.1.1     32894 <- -> 211.111.111.2 61751 [195.34.133.10 53]

       age 940 use 0 sumd 0xcabe/0xcabe pr 17 bkt 91/30 flags 2

       ifp ne5 bytes 198 pkts 2

MAP 192.168.1.1     32893 <- -> 211.111.111.2 61745 [195.34.133.10 53]

       age 940 use 0 sumd 0xcab9/0xcab9 pr 17 bkt 89/18 flags 2

       ifp ne5 bytes 480 pkts 4

MAP 192.168.1.1     32892 <- -> 211.111.111.2 61744 [195.34.133.10 53]

       age 580 use 0 sumd 0xcab9/0xcab9 pr 17 bkt 87/16 flags 2

       ifp ne5 bytes 198 pkts 2

MAP 192.168.1.1     32890 <- -> 211.111.111.2 61738 [195.34.133.10 53]

       age 580 use 0 sumd 0xcab5/0xcab5 pr 17 bkt 83/4 flags 2

       ifp ne5 bytes 464 pkts 4

MAP 192.168.1.1     32889 <- -> 211.111.111.2 61737 [195.34.133.10 53]

       age 220 use 0 sumd 0xcab5/0xcab5 pr 17 bkt 81/2 flags 2

       ifp ne5 bytes 182 pkts 2

MAP 192.168.1.1     32888 <- -> 211.111.111.2 61731 [195.34.133.10 53]

       age 220 use 0 sumd 0xcab0/0xcab0 pr 17 bkt 79/117 flags 2

       ifp ne5 bytes 464 pkts 4



List of active host mappings:

192.168.1.1 -> 0.0.0.0 (use = 16 hv = 32)


[root@ganymed:~#] ipnat -s

mapped  in      34077   out     34425

added   1763    expired 1746

no memory       0       bad nat 0

inuse   17

rules   6

wilds   0
 Lab 15-2: FreeBSD ipfw+natd

The user-space FreeBSD application natd(8) requires both the ipfw and the ipdivert sockets in the kernel configuration (options IPFIREWALL, options IPDIVERT). In addition, the following settings must be in /etc/rc.conf, as shown in Example 15-3).

Example 15-3. FreeBSD natd Requirements

gateway_enable="YES"

firewall_enable="YES"

firewall_type="OPEN"

natd_enable="YES"

natd_interface="en5" # Indicates which interface to forward packets through

                   # (the interface connected to the Internet).

natd_flags=" –l –m  –u –f /etc/natd.conf"
The FreeBSD natd supports traditional NAT and  port/protocol/address redirection. Consult the man page natd(8) for further  operational details. Example 15-4  presents a short example of port relaying.

Example 15-4. FreeBSD natd Example for Redirects

-redirect_port tcp 192.168.1.2:6667 6667

-redirect_port tcp 192.168.1.3:80 80

-redirect_port tcp 192.168.1.4:2000-3000 2000-3000

-redirect_address 192.168.1.2 128.1.1.2

-redirect_address 192.168.1.3 128.1.1.3

-redirect_proto encap 192.168.1.4

Lab 15-3: BSD Packet Filter (pf)

The pf packet filter is OpenBSD's native packet-inspection, stateful firewall, and NAT engine. It recently was ported to other BSD operating systems. Because it was inspired by ipfilter and works similarly, it is not discussed in detail here. For further information, consult the sources (especially the pf FAQ) in the "Recommended Reading" section at the end of this chapter.

Lab 15-4: Linux NAT (iptables)

The firewall/NAT engine for the 2.4 and 2.6 Linux kernels is iptables/netfilter. Because of the large number of features available, only a short example of IP masquerading on PPP links is presented in Example 15-5 (which is quoted from the iptables NAT tutorial).

Example 15-5. Linux iptables Masquerading Example

# Load the NAT module. (This pulls in all the others.)

modprobe iptable_nat

# In the NAT table (-t nat), append a rule (-A) after routing

# (POSTROUTING) for all packets going out ppp0 (-o ppp0), which says to

# masquerade the connection (-j MASQUERADE).

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Turn on IP forwarding.

echo 1 > /proc/sys/net/ipv4/ip_forward

NAT-Hostile Protocols

Because of their intrinsic operation, NAT gateways in the communication path of certain protocols might disturb their inner working. Good examples are H.323/SIP, FTP, end-to-end IPSec, and peer-to-peer applications. Unfortunately, these problems often are caused by inconsiderate application development and easily could have been avoided (RFC 3235, "Network Address Translator (NAT)—Friendly Application Design Guidelines"). In the case of H.323, this can be compensated easily by application level gateway (ALG) mappings of modern firewall engines (for example, Cisco PIX Firewall) or the use of H.323 gatekeepers/proxies.

Keep in mind that stateful NAT and stateful inspection firewall issues are related and often intertwined. Special pains are applications that use random ports.

8:35 AM

Appendix A. UNIX Kernel Configuration Files

This appendix presents the network-relevant configuration file portions for Linux, OpenBSD, and FreeBSD. It is assumed that you are familiar with how to configure and compile modular kernels on the respective platform. Relevant remarks are offered as comments within the configuration. Be warned that these are not full configurations, just fragments to be incorporated in the labs for this book, and they might differ slightly within minor revisions of your kernel series. Example A-1 presents a Linux configuration for the 2.4.x kernel series, Example A-2 shows an OpenBSD configuration for 3.x, and Example A-3 lists a configuration for the 4.x FreeBSD kernel series.

Example A-1. Linux 2.4.22 Network Kernel Options

# Code maturity-level options

CONFIG_EXPERIMENTAL=y


# Loadable module support

CONFIG_MODULES=y

CONFIG_MODVERSIONS=y

CONFIG_KMOD=y
# Networking options

CONFIG_PACKET=y

CONFIG_PACKET_MMAP=y

CONFIG_NETLINK_DEV=y

CONFIG_NETFILTER=y

CONFIG_NETFILTER_DEBUG=y

CONFIG_FILTER=y

CONFIG_UNIX=y

CONFIG_INET=y

CONFIG_IP_MULTICAST=y

CONFIG_IP_ADVANCED_ROUTER=y

CONFIG_IP_MULTIPLE_TABLES=y

CONFIG_IP_ROUTE_FWMARK=y

CONFIG_IP_ROUTE_NAT=y

CONFIG_IP_ROUTE_MULTIPATH=y

CONFIG_IP_ROUTE_TOS=y

CONFIG_IP_ROUTE_VERBOSE=y

# CONFIG_IP_PNP is not set

CONFIG_NET_IPIP=m

CONFIG_NET_IPGRE=m

CONFIG_NET_IPGRE_BROADCAST=y

CONFIG_IP_MROUTE=y

CONFIG_IP_PIMSM_V1=y

CONFIG_IP_PIMSM_V2=y

# CONFIG_ARPD is not set

# CONFIG_INET_ECN is not set

CONFIG_SYN_COOKIES=y
#   IP: Netfilter Configuration

CONFIG_IP_NF_CONNTRACK=m

CONFIG_IP_NF_FTP=m

# CONFIG_IP_NF_AMANDA is not set

# CONFIG_IP_NF_TFTP is not set

CONFIG_IP_NF_IRC=m

CONFIG_IP_NF_QUEUE=m

CONFIG_IP_NF_IPTABLES=m

CONFIG_IP_NF_MATCH_LIMIT=m

CONFIG_IP_NF_MATCH_MAC=m

CONFIG_IP_NF_MATCH_PKTTYPE=m

CONFIG_IP_NF_MATCH_MARK=m

CONFIG_IP_NF_MATCH_MULTIPORT=m

CONFIG_IP_NF_MATCH_TOS=m

# CONFIG_IP_NF_MATCH_RECENT is not set

CONFIG_IP_NF_MATCH_ECN=m

CONFIG_IP_NF_MATCH_DSCP=m

CONFIG_IP_NF_MATCH_AH_ESP=m

CONFIG_IP_NF_MATCH_LENGTH=m

CONFIG_IP_NF_MATCH_TTL=m

CONFIG_IP_NF_MATCH_TCPMSS=m

CONFIG_IP_NF_MATCH_HELPER=m

CONFIG_IP_NF_MATCH_STATE=m

CONFIG_IP_NF_MATCH_CONNTRACK=m

CONFIG_IP_NF_MATCH_UNCLEAN=m

CONFIG_IP_NF_MATCH_OWNER=m

CONFIG_IP_NF_FILTER=m

CONFIG_IP_NF_TARGET_REJECT=m

CONFIG_IP_NF_TARGET_MIRROR=m

CONFIG_IP_NF_NAT=m

CONFIG_IP_NF_NAT_NEEDED=y

CONFIG_IP_NF_TARGET_MASQUERADE=m

CONFIG_IP_NF_TARGET_REDIRECT=m

# CONFIG_IP_NF_NAT_LOCAL is not set

# CONFIG_IP_NF_NAT_SNMP_BASIC is not set

CONFIG_IP_NF_NAT_IRC=m

CONFIG_IP_NF_NAT_FTP=m

CONFIG_IP_NF_MANGLE=m

CONFIG_IP_NF_TARGET_TOS=m

# CONFIG_IP_NF_TARGET_ECN is not set

# CONFIG_IP_NF_TARGET_DSCP is not set

CONFIG_IP_NF_TARGET_MARK=m

CONFIG_IP_NF_TARGET_LOG=m

CONFIG_IP_NF_TARGET_ULOG=m

CONFIG_IP_NF_TARGET_TCPMSS=m

# CONFIG_IP_NF_ARPTABLES is not set

# CONFIG_IP_NF_COMPAT_IPCHAINS is not set

# CONFIG_IP_NF_COMPAT_IPFWADM is not set
CONFIG_IPV6=m

#   IPv6: Netfilter Configuration

CONFIG_IP6_NF_QUEUE=m

CONFIG_IP6_NF_IPTABLES=m

CONFIG_IP6_NF_MATCH_LIMIT=m

CONFIG_IP6_NF_MATCH_MAC=m

# CONFIG_IP6_NF_MATCH_RT is not set

# CONFIG_IP6_NF_MATCH_OPTS is not set

# CONFIG_IP6_NF_MATCH_FRAG is not set

# CONFIG_IP6_NF_MATCH_HL is not set

CONFIG_IP6_NF_MATCH_MULTIPORT=m

CONFIG_IP6_NF_MATCH_OWNER=m

CONFIG_IP6_NF_MATCH_MARK=m

# CONFIG_IP6_NF_MATCH_IPV6HEADER is not set

# CONFIG_IP6_NF_MATCH_AHESP is not set

CONFIG_IP6_NF_MATCH_LENGTH=m

CONFIG_IP6_NF_MATCH_EUI64=m

CONFIG_IP6_NF_FILTER=m

CONFIG_IP6_NF_TARGET_LOG=m

CONFIG_IP6_NF_MANGLE=m

CONFIG_IP6_NF_TARGET_MARK=m

# CONFIG_KHTTPD is not set

# CONFIG_ATM is not set

CONFIG_VLAN_8021Q=y

# CONFIG_IPX is not set

# CONFIG_ATALK is not set
# AppleTalk devices
# CONFIG_DECNET is not set

CONFIG_BRIDGE=y

# CONFIG_X25 is not set

# CONFIG_LAPB is not set

# CONFIG_LLC is not set

# CONFIG_NET_DIVERT is not set

# CONFIG_ECONET is not set

# CONFIG_WAN_ROUTER is not set

# CONFIG_NET_FASTROUTE is not set

# CONFIG_NET_HW_FLOWCONTROL is not set
# QoS and/or fair queuing

CONFIG_NET_SCHED=y

CONFIG_NET_SCH_CBQ=m

CONFIG_NET_SCH_HTB=m

CONFIG_NET_SCH_CSZ=m

CONFIG_NET_SCH_PRIO=m

CONFIG_NET_SCH_RED=m

CONFIG_NET_SCH_SFQ=m

CONFIG_NET_SCH_TEQL=m

CONFIG_NET_SCH_TBF=m

CONFIG_NET_SCH_GRED=m

CONFIG_NET_SCH_DSMARK=m

CONFIG_NET_SCH_INGRESS=m

CONFIG_NET_QOS=y

CONFIG_NET_ESTIMATOR=y

CONFIG_NET_CLS=y

CONFIG_NET_CLS_TCINDEX=m

CONFIG_NET_CLS_ROUTE4=m

CONFIG_NET_CLS_ROUTE=y

CONFIG_NET_CLS_FW=m

CONFIG_NET_CLS_U32=m

CONFIG_NET_CLS_RSVP=m

CONFIG_NET_CLS_RSVP6=m

CONFIG_NET_CLS_POLICE=y

# Network testing

CONFIG_NET_PKTGEN=m

CONFIG_IPSEC=y

# IPSec options (FreeS/WAN)

#

CONFIG_IPSEC_IPIP=y

CONFIG_IPSEC_AH=y

CONFIG_IPSEC_AUTH_HMAC_MD5=y

CONFIG_IPSEC_AUTH_HMAC_SHA1=y

CONFIG_IPSEC_ESP=y

CONFIG_IPSEC_ENC_3DES=y

CONFIG_IPSEC_IPCOMP=y

CONFIG_IPSEC_DEBUG=y

# Network device support


CONFIG_NETDEVICES=y
# ARCnet devices

# CONFIG_ARCNET is not set

CONFIG_DUMMY=m

CONFIG_BONDING=m

CONFIG_EQUALIZER=m

CONFIG_TUN=m

# CONFIG_ETHERTAP is not set

# CONFIG_NET_SB1000 is not set

# Ethernet (10 or 100 Mb)

#

CONFIG_NET_ETHERNET=y

# CONFIG_HAPPYMEAL is not set

# CONFIG_SUNGEM is not set

CONFIG_NET_VENDOR_3COM=y

# CONFIG_EL1 is not set

# CONFIG_EL2 is not set

# CONFIG_ELPLUS is not set

# CONFIG_EL16 is not set

# CONFIG_EL3 is not set

# CONFIG_3C515 is not set

CONFIG_VORTEX=y

# CONFIG_TYPHOON is not set

# CONFIG_LANCE is not set

# CONFIG_NET_VENDOR_SMC is not set

# CONFIG_NET_VENDOR_RACAL is not set

# CONFIG_AT1700 is not set

# CONFIG_DEPCA is not set

# CONFIG_HP100 is not set

# CONFIG_NET_ISA is not set

CONFIG_NET_PCI=y

# CONFIG_PCNET32 is not set

# CONFIG_AMD8111_ETH is not set

# CONFIG_ADAPTEC_STARFIRE is not set

# CONFIG_AC3200 is not set

# CONFIG_APRICOT is not set

# CONFIG_B44 is not set

# CONFIG_CS89x0 is not set

# CONFIG_TULIP is not set

# CONFIG_DE4X5 is not set

# CONFIG_DGRS is not set

# CONFIG_DM9102 is not set

# CONFIG_EEPRO100 is not set

# CONFIG_E100 is not set

# CONFIG_FEALNX is not set

# CONFIG_NATSEMI is not set

CONFIG_NE2K_PCI=y

# CONFIG_8139CP is not set

# CONFIG_8139TOO is not set

# CONFIG_SIS900 is not set

# CONFIG_EPIC100 is not set

# CONFIG_SUNDANCE is not set

# CONFIG_TLAN is not set

# CONFIG_VIA_RHINE is not set

# CONFIG_WINBOND_840 is not set

# CONFIG_NET_POCKET is not set



#

# Ethernet (1000 Mb)

#

# CONFIG_ACENIC is not set

# CONFIG_DL2K is not set

# CONFIG_E1000 is not set

# CONFIG_NS83820 is not set

# CONFIG_HAMACHI is not set

# CONFIG_YELLOWFIN is not set

# CONFIG_R8169 is not set

# CONFIG_SK98LIN is not set

# CONFIG_TIGON3 is not set

# CONFIG_FDDI is not set

# CONFIG_HIPPI is not set

CONFIG_PLIP=m

CONFIG_PPP=m

CONFIG_PPP_MULTILINK=y

CONFIG_PPP_FILTER=y

CONFIG_PPP_ASYNC=m

CONFIG_PPP_SYNC_TTY=m

CONFIG_PPP_DEFLATE=m

CONFIG_PPP_BSDCOMP=m

CONFIG_PPPOE=m

# CONFIG_SLIP is not set

# Wireless LAN (non ham radio)

# CONFIG_NET_RADIO is not set

# Token Ring devices

#

CONFIG_TR=y

CONFIG_IBMTR=m

CONFIG_IBMOL=m

CONFIG_IBMLS=m

CONFIG_3C359=m

CONFIG_TMS380TR=m

CONFIG_TMSPCI=m

CONFIG_TMSISA=m

CONFIG_ABYSS=m

CONFIG_SMCTR=m

# CONFIG_NET_FC is not set

# CONFIG_RCPCI is not set

CONFIG_SHAPER=m

#

# Network File Systems

#

CONFIG_CODA_FS=m

# CONFIG_INTERMEZZO_FS is not set

CONFIG_NFS_FS=m

CONFIG_NFS_V3=y

# CONFIG_NFS_DIRECTIO is not set

CONFIG_NFSD=m

CONFIG_NFSD_V3=y

# CONFIG_NFSD_TCP is not set

CONFIG_SUNRPC=m

CONFIG_LOCKD=m

CONFIG_LOCKD_V4=y

CONFIG_SMB_FS=m

# CONFIG_SMB_NLS_DEFAULT is not set

# CONFIG_NCP_FS is not set

# CONFIG_ZISOFS_FS is not set

# Cryptographic options

#

CONFIG_CRYPTO=y

CONFIG_CRYPTO_HMAC=y

CONFIG_CRYPTO_NULL=m

CONFIG_CRYPTO_MD4=m

CONFIG_CRYPTO_MD5=m

CONFIG_CRYPTO_SHA1=m

CONFIG_CRYPTO_SHA256=m

CONFIG_CRYPTO_SHA512=m

CONFIG_CRYPTO_DES=m

CONFIG_CRYPTO_BLOWFISH=m

CONFIG_CRYPTO_TWOFISH=m

CONFIG_CRYPTO_SERPENT=m

CONFIG_CRYPTO_AES=m

CONFIG_CRYPTO_DEFLATE=m

CONFIG_CRYPTO_TEST=m
Example A-2. OpenBSD 3.1 Network Kernel Options

#option         INSECURE        # default to secure

option          NTP             # hooks supporting the Network Time Protocol

option          DIAGNOSTIC      # internal consistency checks

option          KTRACE          # system call tracing, via ktrace(1)

option          KMEMSTATS       # collect malloc(9) statistics

option          PTRACE          # ptrace(2) system call

option          CRYPTO          # cryptographic framework

option          SYSVMSG         # System V-like message queues

option          SYSVSEM         # System V-like semaphores

option          SYSVSHM         # System V-like memory sharing

option          UVM_SWAP_ENCRYPT# support encryption of pages going to swap

option          LKM             # loadable kernel modules

option          FFS             # UFS

option          FFS_SOFTUPDATES # Soft updates

option          QUOTA           # UFS quotas

option          EXT2FS          # Second Extended File System

option          MFS             # memory file system

option          XFS             # xfs file system

option          TCP_SACK        # Selective acknowledgements for TCP

option          TCP_FACK        # Forward acknowledgements for TCP

option          TCP_SIGNATURE   # TCP MD5 signatures, for BGP routing sessions

option          NFSCLIENT       # Network File System client

option          NFSSERVER       # Network File System server

option          CD9660          # ISO 9660 + Rock Ridge file system

option          MSDOSFS         # MS-DOS file system

option          FDESC           # /dev/fd

option          FIFO            # FIFOs; Recommended

option          KERNFS          # /kern

option          NULLFS          # loopback file system

option          PORTAL          # dynamically created file system objects

option          PROCFS          # /proc

option          UMAPFS          # NULLFS + uid and gid remapping

option          GATEWAY         # packet forwarding

option          INET            # IP + ICMP + TCP + UDP

option          IPFILTER_DEFAULT_BLOCK

option          ALTQ            # ALTQ base

option          INET6           # IPv6 (needs INET)

option          PULLDOWN_TEST   # use m_pulldown for IPv6 packet parsing

option          IPSEC           # IPSec

option          IPFILTER        # IP packet filter for security

option          IPFILTER_LOG    # use /dev/ipl to log IPF

option          PPP_BSDCOMP     # PPP BSD compression

option          PPP_DEFLATE

option          MROUTING        # Multicast router
pseudo-device   pf      1       # packet filter

pseudo-device   pflog   1       # pf log if

pseudo-device   loop    2       # network loopback

pseudo-device   bpfilter 8      # packet filter

pseudo-device   sl      2       # CSLIP

pseudo-device   ppp     2       # PPP

pseudo-device   sppp    1       # Sync PPP/HDLC

pseudo-device   tun     2       # network tunneling over tty

pseudo-device   enc     1       # option IPSec needs the encapsulation interface

pseudo-device   bridge  2       # network bridging support

pseudo-device   vlan    2       # IEEE 802.1Q VLAN

pseudo-device   gre     1       # GRE encapsulation interface
pseudo-device   pty     64      # pseudo-terminals

pseudo-device   tb      1       # tablet line discipline

pseudo-device   vnd     4       # paging to files

pseudo-device   ksyms   1       # kernel symbols device
# for IPv6

pseudo-device   gif     4       # IPv[46] over IPv[46] tunnel (RFC 1933)

pseudo-device   faith   1       # IPv[46] tcp relay translation i/f
option          BOOT_CONFIG     # add support for boot –c

options         ALTQ_CBQ        # class-based queuing

options         ALTQ_WFQ        # weighted fair queuing

options         ALTQ_FIFOQ      # FIFO queuing

options         ALTQ_RED        # random early detection

options         ALTQ_FLOWVALVE  # flowvalve for RED (needs RED)

options         ALTQ_RIO        # triple red for diffserv (needs RED)

options         ALTQ_LOCALQ     # local use

options         ALTQ_HFSC       # hierarchical fair service curve

options         ALTQ_JOBS       # joint buffer management and scheduling

options         ALTQ_IPSEC      # check IPSec in IPv4

options         ALTQ_CDNR       # diffserv traffic conditioner

options         ALTQ_BLUE       # blue by wu-chang feng

options         ALTQ_PRIQ       # priority queue

#options        ALTQ_NOPCC      # don't use processor-cycle counter

#options        ALTQ_DEBUG      # for debugging
machine         i386            # architecture, used by config; required
option         I586_CPU

option         I686_CPU

option         GPL_MATH_EMULATE     # floating point emulation.

option         NMBCLUSTERS=8192

option         USER_PCICONF         # user-space PCI configuration

option         XSERVER              # diddle with console driver

option         APERTURE             # in-kernel aperture driver for XFree86

option         DUMMY_NOPS           # speed hack; recommended

option         COMPAT_SVR4          # binary compatibility with SVR4

option         COMPAT_IBCS2         # binary compatibility with SCO and ISC

option         COMPAT_LINUX         # binary compatibility with Linux

option         COMPAT_FREEBSD       # binary compatibility with FreeBSD

option         COMPAT_BSDOS         # binary compatibility with BSD/OS

maxusers       32                   # estimated number of users
# Networking devices

ne0    at isa? port 0x240 irq 9     # NE[12]000 Ethernet

ne1    at isa? port 0x300 irq 10    # NE[12]000 Ethernet

ne2    at isa? port 0x280 irq 9     # NE[12]000 Ethernet

ne*    at isapnp?                   # NE[12]000 PnP Ethernet
# crypto support

#hifn*    at pci? dev ? function ?     # Hi/fn 7751 crypto card

#ubsec*   at pci? dev ? function ?     # Bluesteel Networks 5xxx crypto card

#ises*    at pci? dev ? function ?     # Pijnenburg PCC-ISES

# mouse & keyboard multiplexor pseudo-devices

pseudo-device    wsmux        2

pseudo-device    crypto       1

Example A-3. FreeBSD 4.9 Network Kernel Options

machine        i386

cpu            I686_CPU

ident          GENERIC

maxusers       0

options        MATH_EMULATE          # Support for x87 emulation

options        INET                  # Internetworking

options        INET6                 # IPv6 communications protocols

options        FFS                   # Berkeley Fast File System

options        FFS_ROOT              # FFS usable as root device (Keep this!)

options        SOFTUPDATES           # Enable FFS soft updates support

options        UFS_DIRHASH           # Improve performance on big directories

options        MFS                   # Memory File System

options        MD_ROOT               # MD is a potential root device

options        NFS                   # Network File System

options        NFS_ROOT              # NFS usable as root device, NFS required

options        MSDOSFS               # MS-DOS File System

options        CD9660                # ISO 9660 File System

options        CD9660_ROOT           # CD-ROM usable as root, CD9660 required

options        PROCFS                # Process file system

options        COMPAT_43             # Compatible with BSD 4.3 [KEEP THIS!]

options        SCSI_DELAY=15000      # Delay (in ms) before probing SCSI

options        UCONSOLE              # Allow users to grab the console

options        USERCONFIG            # boot -c editor

options        VISUAL_USERCONFIG     # visual boot -c editor

options        KTRACE                # ktrace(1) support

options        SYSVSHM               # SYSV-style shared memory

options        SYSVMSG               # SYSV-style message queues

options        SYSVSEM               # SYSV-style semaphores

options        P1003_1B              # Posix P1003_1B real-time extensions

options        _KPOSIX_PRIORITY_SCHEDULING

options        ICMP_BANDLIM          # Rate limit bad replies

options        KBD_INSTALL_CDEV      # install a CDEV entry in /dev

options        SMBFS                 # SMB/CIFS file system

options        HZ=1000

options        SOFTUPDATES           # FFS soft Updates



# Directory hashing improves the speed of operations on very large

# directories at the expense of some memory.

options         UFS_DIRHASH



# Allow this to swap many devices.

#

# To manage swap, the system must reserve bitmap space that

# scales with the largest mounted swap device multiplied by NSWAPDEV,

# regardless of whether other swap devices exist.  So it

# is not a good idea to make this value too large.

options         NSWAPDEV=5



# Disk quotas are supported when this option is enabled.
options         QUOTA                   # enable disk quotas
options         IPSEC                   # IP security
options         IPSEC_ESP               # IP security (crypto; define w/IPSEC)
options         IPSEC_DEBUG             # debug for IP security
# Set IPSEC_FILTERGIF to force packets coming through a gif tunnel
# to be processed by any configured packet filtering (ipfw, ipf).
# The default is that packets coming from a tunnel are not processed;
# they are assumed trusted.
# Note that enabling this can be problematic as there are no mechanisms
# in place for distinguishing packets coming out of a tunnel (e.g., no
# encX devices as found on OpenBSD).
options        IPSEC_FILTERGIF         # filter IPSec packets from a tunnel
# Experimental IPSec implementation that uses the kernel crypto
# framework. This cannot be configured together with IPSec and
# (currently) supports only IPv4. To use this, you must also
# configure the crypto device (see below). Note that with this
# you get all the IPSec protocols (e.g., there is no FAST_IPSEC_ESP).
# IPSEC_DEBUG is used, as above, to configure debugging support
# within the IPSec protocols.
# options       FAST_IPSEC              # new IPsec
options         MROUTING                # Multicast routing
options         PIM                     # Protocol Independent Multicast
options         IPFIREWALL              # firewall
options         IPFIREWALL_VERBOSE      # enable logging to syslogd(8)
options         IPFIREWALL_FORWARD      # enable transparent proxy support
options         IPFIREWALL_VERBOSE_LIMIT=100    # limit verbosity
options         IPFIREWALL_DEFAULT_TO_ACCEPT    # allow everything by default
options         IPV6FIREWALL            # firewall for IPv6
options         IPV6FIREWALL_VERBOSE
options         IPV6FIREWALL_VERBOSE_LIMIT=100
options         IPV6FIREWALL_DEFAULT_TO_ACCEPT
options         IPDIVERT                # divert sockets
options         IPFILTER                # ipfilter support
options         IPFILTER_LOG            # ipfilter logging
options         IPFILTER_DEFAULT_BLOCK  # block all packets by default
options         IPSTEALTH               # support for stealth forwarding
options         TCPDEBUG                # TCP-related debugging info
options         DUMMYNET
options         BRIDGE
options         ATM_CORE                # core ATM protocol family
options         ATM_IP                  # IP over ATM support
options         ATM_SIGPVC              # SIGPVC signaling manager
options         ATM_SPANS               # SPANS signaling manager
options         ATM_UNI                 # UNI signaling manager
device          hea                     # Efficient ENI-155p ATM PCI
device          hfa                     # FORE PCA-200E ATM PCI
device          proatm                  # ProSum's ProATM-155
pseudo-device   atm                     # The ATM pseudo-device
device          en                      # Efficient Networks ATM Driver
options         NATM                    # native ATM
# SMB/CIFS requester

# NETSMB enables support for SMB protocol; it requires LIBMCHAIN and LIBICONV
# options.
# NETSMBCRYPTO enables support for encrypted passwords.
options         NETSMB                  # SMB/CIFS requester
options         NETSMBCRYPTO            # encrypted password support for SMB
# mchain library. It can be either loaded as KLD or compiled into kernel
options         LIBMCHAIN               # mbuf management library
options               LIBICONV                                                           

                                        
# netgraph(4). Enable the base Netgraph code with the NETGRAPH option.

# Individual node types can be enabled with the corresponding option

# listed below; however, this is not strictly necessary because Netgraph

# will automatically load the corresponding KLD module if the node type

# is not already compiled into the kernel. Each type below has a

# corresponding man page; e.g., ng_async(8).

options         NETGRAPH                # netgraph(4) system
options         NETGRAPH_ASYNC
options         NETGRAPH_BPF
options         NETGRAPH_CISCO
options         NETGRAPH_ECHO
options         NETGRAPH_ETHER
options         NETGRAPH_FRAME_RELAY
options         NETGRAPH_HOLE
options         NETGRAPH_IFACE
options         NETGRAPH_KSOCKET
options         NETGRAPH_L2TP
options         NETGRAPH_LMI
# MPPC compression requires proprietary files (not included)
#options        NETGRAPH_MPPC_COMPRESSION
options         NETGRAPH_MPPC_ENCRYPTION
options         NETGRAPH_ONE2MANY
options         NETGRAPH_PPP
options         NETGRAPH_PPPOE
options         NETGRAPH_PPTPGRE
options         NETGRAPH_RFC1490
options         NETGRAPH_SOCKET
options         NETGRAPH_TEE
options         NETGRAPH_TTY
options         NETGRAPH_UI
options         NETGRAPH_VJC
# Coda stuff:
options         CODA                    # CODA file system.
pseudo-device   vcoda   4               # coda minicache <-> venus comm.
# PCI Ethernet NICs that use the common MII bus controller code.
# Note: Be sure to keep the 'device miibus' line in order to use these NICs!
device        miibus       # MII bus support
device        xl           # 3Com 3c90x (``Boomerang'', ``Cyclone'')
# ISA Ethernet NICs.
# 'device ed' requires 'device miibus'
device        ed0    at isa? disable port 0x280 irq 10 iomem 0xd8000
# Pseudo devices - the number indicates how many units to allocate.
pseudo-device  loop    3       # Network loopback
pseudo-device  ether           # Ethernet support
pseudo-device  sl      1       # Kernel SLIP
pseudo-device  ppp     1       # Kernel PPP
pseudo-device  tun     3       # Packet tunnel
pseudo-device  pty             # Pseudo-ttys (Telnet etc.)
pseudo-device  md              # Memory "disks"
pseudo-device   vlan    3      # VLAN support
pseudo-device   token          # Generic Token Ring
pseudo-device   sppp           # Generic Synchronous PPP
pseudo-device   bpf            # Berkeley packet filter
pseudo-device   disc           # Discard device (ds0, ds1, etc.)
pseudo-device   sl      2      # Serial Line IP
pseudo-device   gre     3      # IP over IP tunneling
pseudo-device   ppp     2      # Point-to-Point Protocol
options         PPP_BSDCOMP    # PPP BSD-compress support
options         PPP_DEFLATE    # PPP zlib/deflate/gzip support
options         PPP_FILTER     # enable bpf filtering (needs bpf)
# for IPv6
pseudo-device   gif            # IPv6 and IPv4 tunneling
pseudo-device   faith   1      # for IPv6 and IPv4 translation
pseudo-device   stf            # 6to4 IPv6 over IPv4 encapsulation

Cisco elearning

Busines

Hiburan

Linux QoS

document.write(ultimaFecha);

Example 13-6. Interface Shaping with a TBF

Example 13-7. Alternative Interface Shaping with the Shaper Device

Example 13-8. Stochastic Fair Queuing

Example 13-9. pFIFO-Fast

Example 13-10. Random Early Detect/Discard with Explicit Congestion Notification

Example 13-11. Priority Queuing (PRIQ)

UNIX Firewalling Engines and Queuing

document.write(ultimaFecha);

OpenBSD ALTQ+pf

Example 13-17. OpenBSD pf/ALTQ PRIQ Example

Example 13-18. OpenBSD pf/ALTQ CBQ Example

FreeBSD ipfilter+ALTQ

Example 13-19. Interface Rate-Limiting Without Queuing Discipline

FreeBSD IP Firewall(ipfw) + dummynet

Example 13-20. Traffic Shaping on a Crossover-Link FreeBSD with RED and WF2Q+ <--> Cisco IOS Architecture with CAR/GTS and RED on the Cisco Side

Linux Firewall Marking and iproute2 (ip/tc)

Example 13-21. Policy Routing Based on iptables Markings

Bell Labs' Eclipse—An Operating System with QoS Support

UNIX NAT Approaches

document.write(ultimaFecha);

Lab 15-1: OpenBSD ipfilter

Example 15-1. OpenBSD ipfilter (ipf) NAT Configuration

Example 15-2. OpenBSD NAT Operation Output

Example 15-3. FreeBSD natd Requirements

Example 15-4. FreeBSD natd Example for Redirects

Lab 15-3: BSD Packet Filter (pf)

Lab 15-4: Linux NAT (iptables)

Example 15-5. Linux iptables Masquerading Example

NAT-Hostile Protocols

Appendix A. UNIX Kernel Configuration Files

document.write(ultimaFecha);

Example A-1. Linux 2.4.22 Network Kernel Options

Example A-3. FreeBSD 4.9 Network Kernel Options

Kesehatan

Labels

STAT

MY Backlink Site

Popular Posts

Visitors

Comunity