pf: packet queuing

[cbrace]

Hi all,

I'm trying to better understand how packet queuing works. On his site, Daniel Hartmeier offers this example:

ext_if="kue0"

altq on $ext_if priq bandwidth 100Kb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)

pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
        keep state queue (q_def, q_pri)

pass in on $ext_if proto tcp from any to $ext_if flags S/SA \
        keep state queue (q_def, q_pri)

Question: in the second pass statement, why is he queuing incoming packets? I thought that you don't have any control over the order in which incoming packets arrive at the network interface, that you can only influence the sequence of the outgoing.

 

[DutchDaemon]

Queueing incoming packets means actually queueing their resulting outbound packets (return traffic, tcp acks, etc.). When using queues, always queue on pass in and pass out rules.

 

[bbzz]

To elaborate a bit, he is in fact marking/classifying inbound packets, and since state is created, matching outbound packets are then queued based on policy.

So you can mark packets both ways but queuing is only done outbound (well, can be done inbound as well but that's another thing).

 

[cbrace]

Thanks for the explanation. Is that what keep state is doing?

 

[bbzz]

Yes. Hence, a stateful firewall.