Help Limiting/Splitting Bandwidth

[EverydayDiesel]

Ive been reading http://www.openbsd.org/faq/pf/queueing.html but Im curious if someone could show me a simple setup splitting the bandwidth between 3 computers.

I have pf installed and it is routing and pf works great.

Can someone show me a easy example of how to split the bandwidth evenly between 3 people (33% each)?

thanks in advance


ext_if="vl0"
int_if="vl1"

set block-policy deny
scrub in


nat on $ext_if from !($ext_if) -> ($ext_if:0)

block in
pass out keep state

antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if

[EverydayDiesel]

anyone?

[jggimi]

What, specifically, in http://www.openbsd.org/faq/pf/queueing.html#example1 is confusing you?

[EverydayDiesel]

i cant seem to get it right.

that example is to control the upload and I want to control the download.

How can I modify my simple rules above to incorporate altq and have it split the connection 33% on each of 3 computers?

[jggimi]

Ah. Now I understand. Allow me to ease your confusion.

You cannot rate-limit inbound packets, directly. IP doesn't work that way. You can only rate limit on outbound packets. But, when you have a router with two interfaces, you can rate-limit them indirectly. In your case, just set up your queues for the packets leaving the router for the workstations that live on $int_if.

[robbak]

You can, to some limited extent, affect inbound speed of TCP connections (and only TCP packets) by delaying and/or dropping pakets. The other end might just get the idea that there is some restriction there and slow down. But that is all you can do. Once a packet has reached you, then it has already consumed your bandwidth. Dropping it won't do anything but wasting the bandwidth. You can do this by implementing outbound queues on your internal interface(s), as Jggimi said.
There are some systems envisioned that would allow a firewall to force upstream routers and/or servers to rate-limit for you, but none of them are well supported. You can look through what tools your ISP gives you for QOS - this would be the best way.
We get asked this one quite often, and this is the only answer that can be given.