ipfw+bridge

G

gercallog

Hi, I am using a freeBsd7.0 computer as a transparent bridge between a windows computer and a router. We want to model the access of the windows computer through the freeBsd computer to Internet.

We created a bridge and we have access to Internet, and if we type the following instructions we get access to Internet in the Windows computer:

Code: 
ipfw -f flush
ipfw -f pipe flush
ipfw -f ipfw add 1 pipe 100 tcp from ip1 to ip2 in
ipfw -f ipfw add 1 pipe 200 tcp from ip2 to ip1 in
ipfw pipe 100 config delay 2ms bw 10Mbit/s
ipfw pipe 200 config delay 2ms bw 10Mbit/s

Ip1 is the IP address of the windows computer given by the router by DHCP, and ip2 is the IP address of a webpage (e.g. CNN). When we try to shape the connection, we see that several ip addresses exchange information with the windows computer, not only ip2.

What we would like to do is to control the entire connection, not only one ip, but the whole flow from the router to the freebsd machine, so we should change the third and fourth instructions, putting something there instead of ip1 and ip2.

Can anyboby give us a hand?
 
1st, i recommend not to use the word 'bridge' cus it mislead to if_bridge interface, what is way other thing. Name this router or firewall =)
2nd, instead of 3 and 4 rule you can place something like this
Code: 
 ipfw -f ipfw add 1 pipe 100 tcp from any to any out xmit fxp0
ipfw -f ipfw add 1 pipe 200 tcp from any to any in recv fxp0
Where fxp0 is internet interface. You'll need to replace rules 5 and 6 too, adding them 'mask' parameter (so you pipe on per-host basis, not whole network). I dont remember how to use it huh xD
 
We tried this and we can now shape the traffic from the freeBsd machine to the windows machine, but we cannot shape the uplink traffic from the windows machine to the FreeBsd machine. We want to create an assymetric connection, but it only creates the downlink pipe.

When we created the bridge "bridge0", appart from the options in the rc.conf and sysctl files, should we add some instructions to the kernel and compile it again?

Thanks for your help
 
Here they go:

*rc.conf:

Code: 
gateway_enable="YES"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm emo addm em1 up"
ifconfig_em0="up"
ifconfig_em1="up"
hostname=".eit.lth.se"
ifconfig_sis0="DHCP"
ifconfig_em0="DHCP"
ifconfig_em1="inet 192.168.3.10 netmask 255.255.255.0"
inetd_enable="YES"
ipv6_enable="YES"
keymap="swedish.iso"
linux_enable="YES"
moused_enable="YES"
nfs_client_enable="YES"
nfs_server_enable="YES"
sshd_enable="YES"
hald_enable="YES"
dbus_enable="YES"
firewall_enable="YES"


* ifconfig:

Code: 
sis0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:e0:4c:a2:89:e4
inet6 fe80::2e0:4cff:fea2:89e4%sis0 prefixlen 64 scopeid 0x1
media: Ethernet autoselect (none)
status: no carrier

em0: flags=8943>UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=98<VLAN_MTU,VLANHWTAGGING,VLAN_HWCSUM>
ether 00:1b:21:1a:06:6a
inet6 fe80::21b21ff:fe1a:66a%em0 prefixlen 64 scopeid 0x2
inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status:active

em1: flags=8943>UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=98<VLAN_MTU,VLANHWTAGGING,VLAN_HWCSUM>
ether 00:1b:21:2b:37:b3
inet6 fe80::21b21ff:fe1a:66a%em0 prefixlen 64 scopeid 0x2
inet 192.168.3.10 netmask 0xffffff00 broadcast 192.168.3.255
media: Ethernet autoselect (1000baseTX <full-duplex>)
status:active

plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 copeid 0x5
inet 127.0.0.1 netmask 0xff000000

bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether a6:f0:2f:a1:36:f8
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: em1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>


*sysctl.conf:

Code: 
net.inet.ip.fw.enable=1
net.link.ether.bridge.enable=1
net.link.net.ether.bridge.ipfw=1


What we want is to shape the traffic between the FreeBsd machine and the windows machine with two pipes (one as uplink and the other one as downlink), so we could simulate the traffic as an asymmetric connection. They are connected through em1. And the FreeBsd machine is connected to internet through the em0 interface.

The ipfw rules we used are:

Code: 
ipfw -f flush
ipfw -f pipe flush
ipfw -f ipfw add 1 pipe 100 ip from any to any via em1 in
ipfw -f ipfw add 1 pipe 200 ip from any to any via em1 out
ipfw pipe 100 config delay 2ms bw 10Mbit/s
ipfw pipe 200 config delay 2ms bw 10Mbit/s


Thanks for your help
 
With this configuration and without any pipes created (only with ipfw -f flush) we can access to internet in the windows machine. But when we create the pipes, we see with wireshark that it seems that the bridge breaks, and we lose the connection to internet through the FreeBsd machine. Packets come inside the FreeBsd machine via em1 but don't come out via em1.
 
gercallog said:
With this configuration and without any pipes created (only with ipfw -f flush) we can access to internet in the windows machine. But when we create the pipes, we see with wireshark that it seems that the bridge breaks, and we lose the connection to internet through the FreeBsd machine. Packets come inside the FreeBsd machine via em1 but don't come out via em1.
Click to expand...
Try
Code: 
sysctl net.inet.ip.fw.one_pass=1
For bridge no answers, try code i put above.. And you can try this without bridge, i cant understand why you need it..
 
You must log in or register to reply here.
Back
Top