"see" packet mark by linux

aragon

Daemon

Thanks: 278
Messages: 2,029

#26
Glad it worked!

vlad2005 said:
Now, i don't understand, why mincost bit need to be 0? Or when need to be 0 or 1?
I think your ISP won't set this bit so rather have ipfw match on it being 0. Otherwise, excluding those last two bits from the match might be more correct:

Code:
ipfw add 20 count ip from any to any ipprecedence 1 iptos \!lowdelay,throughput,\!reliability
I haven't delved much into DSCP, but it looks like those last two bits aren't used. My guess is your ISP will either set them to 0 or not modify them from what they receive from upstream.
 
OP
OP
V

vlad2005

Member

Thanks: 2
Messages: 28

#27
Ok, now it's ok.
I'm glad to see that this discussion is finished with good results.
Anyway, it's elegant solution with patch, because an rule like this
Code:
ip from any to any dscp AF11
is more readable for many people, and additionally can benefit from possibility to modify packets. In this case have with ipfw same possibilities like iptables in linux. That it's an good opportunity for freebsd users.
I work to finnish patch for freebsd 7.1 because i have an modification from version of Marcelo Araujo, and then i make an patch to freebsd 7.2 because in that version are some changes with ipfw file structure from version 7.1.
All patches will be post on this forum.
Thanks aragon for your support!
 
OP
OP
V

vlad2005

Member

Thanks: 2
Messages: 28

#29
Patch it's ready. Work with kernel for freebsd 7.1 release.
Need to have kernel source installed in /usr/src.
For who want to test'it as module, then need to compile module and binary for ipfw.
Copy patch to /usr/src and apply:
Code:
#cd /usr/src
#patch < ipfw-modip20090901.diff
In next step need to copy an file that it's used when compile ipfw. That is very important, so don't miss.
Code:
cp /usr/src/sys/netinet/ip_fw.h /usr/include/netinet/ip_fw.h
Compile module and binary for ipfw:
Code:
#cd /usr/src/sys/modules/ipfw/
#make && make install && make clean && make cleandir
#cd /usr/src/sbin/ipfw
#make && make install && make clean && make cleandir
Then load ipfw module
Code:
#kldload ipfw
For testing, have example in this post.
If need dummynet, then need to compile ipfw in kernel. Not work as module.
So put necessarily options in kernel, compile and then compile binary for ipfw like it's explained before. Reboot and must work.
Now can filter packets based on dscp value, or change packets. U can change ipprecedence, tos, dscp and df.
 

Attachments

OP
OP
V

vlad2005

Member

Thanks: 2
Messages: 28

#30
I finished and patch version for freebsd 7.2.
Tested and worked. same steps as described before.

Note.
When compile ipfw modules, edit Makefile from /usr/src/sys/modules/ipfw and uncomment line that configure firewall default to accept.
Code:
CFLAGS+= -DIPFIREWALL_DEFAULT_TO_ACCEPT
Otherwise will be blocked by firewall when load ipfw.
 

Attachments

WrEtCh

New Member


Messages: 2

#32
modip for FreeBSD 8.2

I am very interested about this patch, however, I work on FreeBSD 8.1 and 8.2. I am writing this post asking if anybody can make the patch to apply and then compile ipfw for FreeBSD version 8.1 and 8.2.

Thank you in advance and best regards.
 
Top