The packet filter has the function "pipe" that allows to divide and aggregate packet streams. This function can be used to define if packet will be processed by one or other plugin (i.e. NAT/Shaper).
At the diagram this usage looks like the next:
--[-Port.BeforeFilter.Stack-]--------------[-Port.AfterFilter.Stack-]--- [--Shaper/NAT--]
To perform this use the Action named "pipe" with decimal number as parameter. Every packet, that conforms to the "pipe" rule is processed exactly as in "allow", but is sent not to the corresponding Stream, but to the stream defined with decimal parameter.
Note: you must also add "defup=yes" parameter to every filter that is using piping to Stream that is attached to only one of the "PORT" and "STACK" (this is the case of almost every configuration described by this document). This will allow Filter to act as end point of packet stream.
Here is extract of the configuration file that uses the configuration descibed in the diagram above.
[beforefilter] load = pl_flt:filter bind=stack:afterfilter.stack;shaper.in defup=yes rule=pipe 1 all from 192.168.0.1 to any in rule=pipe 0 all from any to any [shaper] load = pl_shape:multi_shaper bind = out:afterfilter.stack[1] [afterfilter] load = pl_flt:filter defup=yes rule=pipe 1 all from any to 192.168.0.1 out rule=pipe 0 all from any to any
Here is example of the working SafeFire Links configuration with Traffic Shaper. It defines shaping rules for 9 different IP addresses with different limits for IN and OUT directions and can be easily extended to support up to 65534 different addresses, address groups, ports or other attributes that can be selected with Filter plugin.
[plugman] log.level=7 log.console=yes buzz=1 [ether] load=pl_lan:Protocol protocol=800 F00 [ppp] load=pl_lan:Adapter bind=io:filter.stack [filter] load = pl_flt:filter bind=port:shfilter.stack;sh1in.in;sh2in.in;sh3in.in;sh4in.in;sh5in.in;sh6in.in;sh7in.in;sh8in.in;sh9in.in enabled=1 defup=1 rule=pipe 1 all from 10.1.3.11 to any out rule=pipe 2 all from 10.1.3.13 to any out rule=pipe 3 all from 10.1.3.16 to any out rule=pipe 4 all from 10.1.3.17 to any out rule=pipe 5 all from 10.1.3.19 to any out rule=pipe 6 all from 10.1.2.19 to any out rule=pipe 7 all from 10.1.2.23 to any out rule=pipe 8 all from 10.1.2.24 to any out rule=pipe 9 all from 10.1.2.25 to any out rule=pipe 0 all from any to any [sh1In] load=pl_shape:single_shaper bind=out:sh1out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh1Out] load=pl_shape:single_shaper bind=in:shfilter.stack[1] rate=20000 limit=30000 bothsided=no timeout=0 [sh2In] load=pl_shape:single_shaper bind=out:sh2out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh2Out] load=pl_shape:single_shaper bind=in:shfilter.stack[2] rate=50000 limit=75000 bothsided=no timeout=0 [sh3In] load=pl_shape:single_shaper bind=out:sh3out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh3Out] load=pl_shape:single_shaper bind=in:shfilter.stack[3] rate=50000 limit=75000 bothsided=no timeout=0 [sh4In] load=pl_shape:single_shaper bind=out:sh4out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh4Out] load=pl_shape:single_shaper bind=in:shfilter.stack[4] rate=50000 limit=80000 bothsided=no timeout=0 [sh5In] load=pl_shape:single_shaper bind=out:sh5out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh5Out] load=pl_shape:single_shaper bind=in:shfilter.stack[5] rate=10000 limit=20000 bothsided=no timeout=0 [sh6In] load=pl_shape:single_shaper bind=out:sh6out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh6Out] load=pl_shape:single_shaper bind=in:shfilter.stack[6] rate=20000 limit=30000 bothsided=no timeout=0 [sh7In] load=pl_shape:single_shaper bind=out:sh7out.out rate=50000 limit=75000 bothsided=no timeout=0 [sh7Out] load=pl_shape:single_shaper bind=in:shfilter.stack[7] rate=50000 limit=70000 bothsided=no timeout=0 [sh8In] load=pl_shape:single_shaper bind=out:sh8out.out rate=50000 limit=75000 bothsided=no timeout=0 [sh8Out] load=pl_shape:single_shaper bind=in:shfilter.stack[8] rate=80000 limit=90000 bothsided=no timeout=0 [sh9In] load=pl_shape:single_shaper bind=out:sh9out.out rate=10000 limit=15000 bothsided=no timeout=0 [sh9Out] load=pl_shape:single_shaper bind=in:shfilter.stack[9] rate=100000 limit=200000 bothsided=no timeout=0 [shfilter] load = pl_flt:filter bind=port:nat.stack enabled=1 defup=1 rule=pipe 1 all from any to 10.1.3.11 in rule=pipe 2 all from any to 10.1.3.13 in rule=pipe 3 all from any to 10.1.3.16 in rule=pipe 4 all from any to 10.1.3.17 in rule=pipe 5 all from any to 10.1.3.19 in rule=pipe 6 all from any to 10.1.2.19 in rule=pipe 7 all from any to 10.1.2.23 in rule=pipe 8 all from any to 10.1.2.24 in rule=pipe 9 all from any to 10.1.2.25 in rule=pipe 0 all from any to any [nat] load=pl_alias:nat bind=port:natfilter.stack enabled=1 [natfilter] load = pl_flt:filter bind=port:ether.io
Return to documentation index | SafeFire Links (C) Link Guard Solutions 1999, 2000 |