• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

Traffic shaping with SafeFire Firewall?

Started by mrwarper, 2008.02.07, 05:45:06

Previous topic - Next topic

mrwarper

Hello all,

I connect several machines to the Internet through my home server, which runs SafeFire Firewall, and I'd like to use the shaper ability to limit the upload bandwidth used by several workstations. Everything else works fine so I guess I'm doing something wrong... a hand on this, please?

My current configuration:
Server running SafeFire (v1.2.2ß, which in the changelog lists "added traffic shaper" - maybe it's not finished?) with two NICs: the first one has SFire bound to it, and gets a public IP via DHCP. On the second one I have the static IP 192.168.1.1, and BIND 8.2.4 acting as (forwarder) DNS.

The workstations have IPs in the range 192.168.1.x/255.255.255.0, 192.168.1.1 as Gateway and Name server.

My sfire.cfg file:

---8<------8<------8<------8<------8<------8<------8<------8<------8<------8<---
[nat]           ;Network Address Translation configuration parameters
enable=yes

[portmap]       ; Port mapping rules. NOTE: Portmapper requires enabled NAT!
; 1) My eMule
rule = 0:4662,192.168.1.106:4662
rule = 0:4672,192.168.1.106:4672
; 2) VNC
rule = 0:5900,192.168.1.106:5900
;My brother:
rule = 0:21943,192.168.1.15:21943
rule = 0:4692,192.168.1.15:4692
;My flatmate:
rule = 0:4693,192.168.1.110:4693
rule = 0:4694,192.168.1.110:4694

[shaper]        ; Traffic shaper
pipe=1 speed 300 Kbps
pipe=2 speed 22 Kbps

[filter]        ; Packet filter
enable=yes

;rule = 11 pipe 1 all from any to 192.168.1.101 bidi
;rule = 12 pipe 2 all from 192.168.1.101 to any bidi
rule = 20 allow all from any to any bidi

[remote]
enable = yes
port   = 1021
allow  = 192.168.1.101
userid   = :)
password = :P

[device]
fastmode=yes
---8<------8<------8<------8<------8<------8<------8<------8<------8<------8<---

So currently I only use the firewall to do NAT and some port mapping so we can all use P2P, etc.

Now, if I change the rules set to something like

rule = 11 pipe 1 all from any to 192.168.1.101 in
rule = 12 pipe 2 all from 192.168.1.101 to any out
rule = 20 allow all from any to any bidi

I understand my wokstation should have limited bandwidth to upload/download, and everything else should work as usual (free for all). What actually happens is that 101 gets isolated from the outside world (known servers stop replying to ping and every connection seems dead). The admin tool reports matched activity using 'stat filter' + 'stat traf' + 'stat shaper' but I cannot get through.

Help, anyone? Or does anyone know who's maintaining SafeFire now?

Regards and TIA.

PS: Please stick to the question and do not tell me to switch to Injoy or some hardware router/firewall :)

NNYITGuy

Hi,

I like that you are using SafeFire Firewall.  I do not have the package currently running, but from what I have studied, found that the traffic shaper was in the dial-up package and that plug-in was usable in the regular SafeFire Firewall.

Hope this helps... :-)

NNYITGuy
Todd J Simpson (IT Consultant)
Business Automation Technologies
(Professional Products and Services.  Business to Business...)

mrwarper

Actually, SafeFire products seem to have been merged in a new version.

According to the file_id.diz,
---8<-------8<-------8<-------8<-------8<-------8<-------8<----
SafeFire Links 1.3 Alpha 071125

Copyright (C) 1999 - 2002 Link Guard Solutions Ltd
Copyright (C) 2006 - 2007 Vyacheslav Gnatenko
---8<-------8<-------8<-------8<-------8<-------8<-------8<----

I'm currently studying the NEW docs :(

NNYITGuy

I have only 070802 for a release date.  Where did you find SafeFire Links 1.3 Alpha 071125?  The original website replies with a couple of lines in a language I do not understand.

Yes, you are correct about the merge.  I had forgotten about that.  Also, the merged product supports a plug-in for OpenVPN connections.

Todd J Simpson (IT Consultant)
Business Automation Technologies
(Professional Products and Services.  Business to Business...)

NNYITGuy

Hello mrwarper,

Just reading up on your request further...  In v1.3a I found reference to what you are wanting to accomplish in the fw_pipe.txt file in the readme folder.  The example that is given provides shaping for 9 specific internal ip addresses.

Hope this helps...
Todd J Simpson (IT Consultant)
Business Automation Technologies
(Professional Products and Services.  Business to Business...)