IPFW tables and pipes

[hac3ru]

Hello,

I just updated FreeBSD OS to 9.2 and I have a little problem:

On the old system I had the ipfw.rules file like this:

table 1 flush
table 1 add 172.23.0.0/20

table 2 flush
table 2 add 172.23.1.7

pipe 10 config bw 400KByte/s mask src-ip 0x000007ff
pipe 11 config bw 400KByte/s mask dst-ip 0x000007ff
pipe 12 config bw 100MByte/s
pipe 13 config bw 100MByte/s

add pipe 10 all from table(1) to any in recv bge1
add pipe 11 all from any to table(1) out xmit bge1
add pipe 12 all from table(2) to any in recv bge1
add pipe 13 all from any to table(2) out xmit bge1

The ipfw.rules is a lot longer but it follows like before. On the old FreeBSD version the 172.23.0.0/20 was limited to 400KB/s and the IPs in table(2) were limited to 100MB/s. When I switched to FreeBSD 9.2 I had to add the rule

add allow all from any to any

because it would not let me connect to the network if this was missing. I also increased from 400KB to 800KB. The second problem is that it does not limit the 172.23.0.0/20 to 800KB/s. It remained at 400KB/s no matter what I do. Also, even if I remove the 172.23.1.7 from table(2), it doesn't limit it to 400 or 800KB/s. It stays at 100MB/s.
Anyone any ideas?
Also, someone else wrote the

pipe 10 config bw 400KByte/s mask src-ip 0x000007ff
pipe 11 config bw 400KByte/s mask dst-ip 0x000007ff

My question: What does the mask src-ip and mask dst-ip do in that rule?

Thanks in advance.

 

[qsecofr]

I might suggest reordering the commands so that the pipe is added before its bandwidth configured.

Example

$ipfw -q add pipe 3 tcp from any to me http,https in
$ipfw -q add pipe 4 tcp from me http,https to any out

$ipfw -q add queue 3 tcp from any to me http,https in
$ipfw -q add queue 4 tcp from me http,https to any out

$ipfw -q queue 3 config pipe 3 weight 30 queue 5Kbytes
$ipfw -q queue 4 config pipe 4 weight 30 queue 5Kbytes

$ipfw -q pipe 3 config bw 200Kbits/s queue 10Kbytes
$ipfw -q pipe 4 config bw 450Kbits/s queue 10Kbytes

 

[hac3ru]

Did that. Not working..... What about the mask line? Maybe that has to do something with it?