ref: https://calomel.org/pf_config.html (
Ingress Policing with Linux and tc
I am simply amazed at the things GNU/Linux can now do, especially with regard to IP networking. I use pf under OpenBSD, a Unix-like operating system that is not Linux, to keep untrusted wireless access traffic from my trusted wired network at home. Lately, I have been working with Linux operating systems in a corporate environment and needed packet policing. It feels good to be able to get similar features to a Cisco device without the need to make a 4500USD purchase.An ingress policy can decrease the amount of incoming traffic, but it depends on well-behaved TCP/IP stacks and a transport protocol that supports throttling on the sending hosts. The following commands install an ingress queue to eth0 and applies a filter that applies a policy rate of 512kbit.
tc qdisc add dev eth0 handle ffff: ingress tc filter add dev eth0 parent ffff: protocol ip prio 50 \ u32 match ip src 0.0.0.0/0 police rate 256kbit \ burst 10k drop flowid :1
tc qdisc add dev eth0 root tbf \ rate 256kbit latency 25ms burst 10k
i'm not sure about this
# ### Calomel.org pf.conf # ################ FreeBSD pf.conf ########################## # Required order: options, normalization, queueing, translation, filtering. # Note: translation rules are first match while filter rules are last match. ################ Macros ################################### ### Interfaces ### ExtIf ="mxge0" IntIf ="mxge1" ### Hosts ### Windows ="10.10.10.3" Xbox360 ="10.10.10.4" phone ="10.10.10.5" WorkSsh ="123.123.123.123" ### Queues, States and Types ### IcmpPing ="icmp-type 8 code 0" SshQueue ="(ssh_bulk, ssh_login)" SynState ="flags S/SA synproxy state" TcpState ="flags S/SA modulate state" UdpState ="keep state" ### Stateful Tracking Options (STO) ### OpenSTO ="(max 90000, source-track rule, max-src-conn 1000, max-src-nodes 256)" SmtpSTO ="(max 200, source-track rule, max-src-conn 10, max-src-nodes 256, max-src-conn-rate 200/30)" SshSTO ="(max 100, source-track rule, max-src-conn 10, max-src-nodes 100, max-src-conn-rate 100/30, overloadflush global)" WebSTO ="(max 4096, source-track rule, max-src-conn 64, max-src-nodes 512, max-src-conn-rate 500/100, overload flush global)" ### Tables ### table counters table counters file "/somedir/block_permanent" table ################ Options ###################################################### ### Misc Options set skip on lo set debug urgent set block-policy drop set loginterface $ExtIf set state-policy if-bound set fingerprints "/etc/pf.os" set ruleset-optimization none ### Timeout Options set optimization normal set timeout { tcp.closing 60, tcp.established 7200} ################ Queueing #################################################### # no quality of service (QOS) since it is not supported by the myricom 10gig # mxge0 interface drivers and we would lose as much as 10% bandwidth anyways. # for more information: https://calomel.org/pf_hfsc.html ################ Normalization ############################################### # set-tos 0x1c is Maximize-Reliability + Minimize-Delay + Maximize=Throughput scrub out log on $ExtIf all random-id set-tos 0x1c fragment reassemble scrub log on $ExtIf inet all reassemble tcp fragment reassemble ################ Translation ################################################# ### NAT and Redirection rules are first match # NAT with static NAT for the XBOX360 nat on $ExtIf from $Xbox360 to any -> ($ExtIf) static-port nat on $ExtIf from $IntIf:network to any -> ($ExtIf) # Apache or Nginx (external users to an internal server?) rdr on $ExtIf inet proto tcp from !($ExtIf) to ($ExtIf) port https -> 10.10.10.100 rdr on $ExtIf inet proto tcp from !($ExtIf) to ($ExtIf) port http -> 10.10.10.100 # OpenSMTPD or Postfix with Spamd rdr on $ExtIf inet proto tcp from ! to ($ExtIf) port smtp -> 10.10.10.200 port spamd rdr on $ExtIf inet proto tcp from to ($ExtIf) port smtp -> 10.10.10.250 # Openssh rdr on $ExtIf inet proto tcp from $WorkSsh to ($ExtIf) port ssh -> lo0 rdr on $IntIf inet proto tcp from $Windows to $IntIf port ssh -> lo0 # Apache or Nginx (internal webserver for the LAN to localhost?) rdr on $IntIf inet proto tcp from !($IntIf) to ($IntIf) port http -> lo0 rdr on $IntIf inet proto tcp from !($IntIf) to ($IntIf) port https -> lo0 # Bind or Unbound DNS for LAN machines rdr on $IntIf inet proto udp from $IntIf:network to $IntIf port domain -> lo0 # Ntpd time server for the LAN rdr on $IntIf inet proto udp from $IntIf:network to $IntIf port ntp -> lo0 # Anchors rdr-anchor "games" # Ftp ( secure ftp-proxy for the internal LAN ) nat-anchor "ftp-proxy/*" rdr-anchor "ftp-proxy/*" rdr pass on $IntIf proto tcp from $IntIf:network to any port 21 -> 127.0.0.1 port 8021 # DENY rouge redirection no rdr ################ Filtering ################################################### # Rules are best (closest) match. Notice we optimized the rules so external # interface parsing is first followed by the internal interface. ### $ExtIf block abusive hosts in temp and perm tables block drop in log quick on $ExtIf from to any block drop in log quick on $ExtIf proto udp from to any block drop in log quick on $ExtIf proto tcp from to any port != ssh ### $ExtIf default block with drop block drop in log on $ExtIf ### $ExtIf inbound pass in log on $ExtIf inet proto tcp from !($ExtIf) to 10.10.10.100 port https $TcpState $WebSTO pass in log on $ExtIf inet proto tcp from !($ExtIf) to 10.10.10.100 port www $TcpState $WebSTO pass in log on $ExtIf inet proto tcp from to 10.10.10.250 port smtp $TcpState $SmtpSTO pass in log on $ExtIf inet proto tcp from ! to 10.10.10.200 port spamd $TcpState $SmtpSTO pass in log on $ExtIf inet proto tcp from $WorkSsh to lo0 port ssh $TcpState $SshSTO ### $ExtIf outbound pass out log on $ExtIf inet proto tcp from ($ExtIf) to !($ExtIf) $TcpState $OpenSTO pass out log on $ExtIf inet proto udp from ($ExtIf) to !($ExtIf) $UdpState $OpenSTO pass out log on $ExtIf inet proto icmp from ($ExtIf) to !($ExtIf) $UdpState $OpenSTO ### $IntIf default block with return (TCP reset) block return in log on $IntIf inet ### $IntIf inbound (restrict LAN clients to external machines here) pass in log on $IntIf inet proto tcp from $IntIf:network to any port https $TcpState $OpenSTO pass in log on $IntIf inet proto tcp from $IntIf:network to any port www $TcpState $OpenSTO pass in log on $IntIf inet proto tcp from $Windows to lo0 port ssh $TcpState $OpenSTO pass in log on $IntIf inet proto udp from $IntIf:network to lo0 port domain $UdpState $OpenSTO pass in log on $IntIf inet proto udp from $IntIf:network to lo0 port ntp $UdpState $OpenSTO pass in log on $IntIf inet proto icmp from $IntIf:network to $IntIf $IcmpPing $UdpState $OpenSTO ### $IntIf ftp secure secure proxy for LAN anchor "ftp-proxy/*" in on $IntIf inet proto tcp ### $IntIf outbound pass out log on $IntIf inet proto tcp from $IntIf to $IntIf:network $TcpState pass out log on $IntIf inet proto udp from $IntIf to $IntIf:network $UdpState pass out log on $IntIf inet proto icmp from $IntIf to $IntIf:network $UdpState ### Games ( Xbox 360, Xbox ONE, PS3, PS4 and PC ) anchor "games" ############# END of FreeBSD pf.conf https://calomel.org #######################
