28.4 OpenBSD «Ê¥]¹LÂo¾¹ (Packet Filter, PF)¤Î ALTQ

¦b 2003 ¦~ 6 ¤ë¥÷¡AOpenBSD ªº¨¾¤õÀð³nÅé PF ³Q²¾´Ó¨ì FreeBSD ¤¤¡A¨Ã¥B¦¬¿ý©ó Ports Collection ¤º¡C ¦Ó 2004 ¦~ 11 ¤ë¥÷©Òµo¦æªº FreeBSD 5.3 ª©¤]¬O²Ä¤@¦¸±N PF ¾ã¦X¬°°ò¦¨t²Îªº¤@³¡¤À¡C PF¬O­Ó§¹³Æ¡B¥þ¥\¯àªº¨¾¤õÀð¡A ¨Ã¥B¨ã¦³¿ï¾Ü©Ê ALTQ(¥æ¿ù¦î¦C¡AAlternate Queuing) ªº¥\¯à¡C ALTQ´£¨Ñ¤F¡uQoS¡v (Quality of Service)ÀW¼eºÞ¨î¥\¯à¡A ¥¦¥i¥H¥Î¹LÂo³W«hªº¤è¦¡¨Ó«O»Ù¦UºØ¤£¦PªA°ÈªºÀW¼e¡C ¥t¥~¡AOpenBSD ­p¹º¤¤¤w¸g¹ï PF ªº¨Ï¥Î«ü«n´£¨Ñ¤F¸ÔºÉªº¸Ñ»¡¡A ¦]¦¹¦b³o¥»¤â¥U¤¤§Ú­Ì¤£·|§@­«½ÆªºÂØ­z¡A¦Ó¥u¤¶²Ð·§­n¡C

§ó¦hÃö©ó PF ªº¸ê°T¥i©ó¤U¦Cºô§}¬d¸ß¡Ghttp://pf4freebsd.love2party.net/.

28.4.1 ±Ò¥Î PF

PF ¦b FreeBSD 5.3 ¤§«áªº¨t²Î¤¤¡A´N¥i¥H»´ÃP¨Ï¥Î kernel °ÊºA¼Ò²Õ¨Ó¸ü¤J¡C ¦b rc.conf ¤¤¥[¤J pf_enable="YES" «á¡A ¨t²Î´N·|¸ü¤J PF ªº kernel °ÊºA¼Ò²Õ¡C³o¼Ò²Õ·|¦b«Ø¥ß®É¤]±Ò¥Î pflog(4) °O¿ý¥\¯à¡C

Note: ³o­Ó¼Ò²Õ·|°²³] kernel ¤º¤w¦³ options INET ©M device bpf¡C °£«D½sĶ kernel ®É¤w¦b¹³¬O make.conf(5) ³]©wÀɤ¤¥[¤J NOINET6( FreeBSD 6.0 ¥H«áªºª©¥»«h¬O NO_INET6) ³o¼Ë¤~·|Á×§K¤£¥´¶} IPv6 ¤ä´©¡A §_«h pf ¼Ò²Õ¦P®É¤]»Ý­n options INET6¡A¤]´N¬O IPv6 ¤ä´©¡C

¤@¥¹¸ü¤J PF ªº kernel ¼Ò²Õ©Î¬OÀRºA½sͤJ kernel ¤º¡A ´N¥i¥H¨Ï¥Î pfctl ¨Ó±Ò°Ê©ÎÃö³¬ pf¡C

¤U­±³o­Ó¨Ò¤l¥Ü½d¦p¦ó±Ò°Ê pf¡G

# pfctl -e

pfctl ¬O¨Ï¥Î pf ¨¾¤õÀ𪺫ü¥O¡C ­Y­n¤F¸Ñ§ó¸ÔºÉªº pfctl ¹B¥Î¡A½Ð¬d¾\ pfctl(8) ½u¤W¤â¥U¡C

28.4.2 kernel ¿ï¶µ

¦b½sĶ FreeBSD kernel ®É¡A¨Ã¤£¥²§¹¥þ¥[¤J¤U¦Cªº¿ï¶µ¨Ó±Ò¥Î PF¡C ¦b³o¸Ì¥u¬O­n¦C¥Xµ¹§A°Ñ¦Òªº¤@¨Ç¸ê°T¦Ó¤w¡C ±N PF ½sͤJ kernel ¤¤¡A·|¾É­PµLªk¨Ï¥Î kernel ªº°ÊºA¸ü¤J¼Ò²Õ¡C

³]©w PF ªº kernel ¿ï¶µ½d¨Ò¦b kernel ­ì©l½X¤¤ªº /usr/src/sys/conf/NOTES¡AÂà¶K¤º®e¦p¤U¡G

device pf
device pflog
device pfsync

device pf ¬O¥Î¨Ó±Ò°Ê¡upacket filter(«Ê¥]¹LÂo)¡v ªº¨¾¤õÀð¤ä´©¡C

¦Ó device pflog¡A¦¹¥\¯à­n¸Ë¤£¸Ë¬Ò¥i¡A¥¦·|±Ò°Ê pflog(4)¡A¥H bpf(4) ®æ¦¡¨Ó°O¿ýºô¸ô¬y¶q¡C pflogd(8) daemon «h¬O¥Î¨Ó¬ö¿ý³o¨Ç°T®§¡A¨Ã¦s¦bµwºÐ¤W¡C

device pfsync¡A¦¹¥\¯à­n¸Ë¤£¸Ë¬Ò¥i¡A¥¦·|±Ò°Ê pfsync(4)¡A¥i¥H¥Î¨ÓºÊ±±¡uª¬ºAªº§ïÅÜ¡v¡C ½Ðª`·N¡G device pfsync¨Ã¤£¬O kernel °ÊºA¼Ò²Õ¡A­n¨Ï¥Îªº¸Ü¡A ¥²¶·­n½s¤J¦Û­qªº kernel ¤¤¤~¦æ¡C

³o¨Ç³]©w±N·|¦b§A½sĶ¤Î¦w¸Ë¦n·s kernel «á¤~·|¥Í®Ä¡C

28.4.3 rc.conf ¨ä¥L¬ÛÃöªº¿ï¶µ

§A»Ý­n¦b /etc/rc.conf ¤¤¥[¤J¤U¦Cªº³]©w¡A¥H«K¦b¨t²Î±Ò°Ê®É±Ò¥Î PF¡G

pf_enable="YES"                 # ±Ò¥Î PF (¦pªG»Ý­nªº¸Ü¸ü¤J¼Ò²Õ)
pf_rules="/etc/pf.conf"         # PF ¨¾¤õÀð³W«h³]©wÀÉ
pf_flags=""                     # pfctl ±Ò°Ê®Éªºªþ¥[¿ï¶µ
pflog_enable="YES"              # ±Ò°Ê pflogd(8)
pflog_logfile="/var/log/pflog"  # pflogd Àx¦s°O¿ýÀɮתº¦a¤è
pflog_flags=""                  # pflogd ±Ò°Ê®Éªþ¥[ªº¿ï¶µ

¦pªG±zªº¨¾¤õÀð«á­±¦³­Ó LAN(°Ï°ìºô¸ô)¡A¨Ã­n³z¹L¥¦¨ÓÂà°e«Ê¥]¡A ´N¥²¶·­n³]©w¤U¦C¿ï¶µ¡G

gateway_enable="YES"            # ±Ò¥Î LAN Gateway

28.4.4 ±Ò¥Î ALTQ

ALTQ ¥u¦³¦b½s¤J FreeBSD kernel ¤¤¤~¯à¥Í®Ä¡C ¤£¬O©Ò¦³ªººô¸ô¥dÅX°Êµ{¦¡³£¤ä´© ALTQ¡C ½Ð¬Ý altq(4) ½u¤W¤â¥U¨Ó¤F¸Ñ§A¨Ï¥Îªº FreeBSD ª©¥»¤¤¤ä´©ÅX°Êµ{¦¡ªº²M³æ¡C ¤U­±©Ò¦Cªº±N·|±Ò¥Î ALTQ ¤Î¨ä¥Lªþ¥[¥\¯à¡G

options         ALTQ
options         ALTQ_CBQ        # Class Bases Queuing (CBQ)
options         ALTQ_RED        # Random Early Detection (RED)
options         ALTQ_RIO        # RED In/Out
options         ALTQ_HFSC       # Hierarchical Packet Scheduler (HFSC)
options         ALTQ_PRIQ       # Priority Queuing (PRIQ)
options         ALTQ_NOPCC      # Required for SMP build

options ALTQ ¬O±Ò¥Î ALTQ ¥D¬[ºc¡C

options ALTQ_CBQ ·|±Ò¥Î¡uCBQ¡v (Class Based Queuing)¤ä´©¡C CBQ ¤¹³\§A divide a connection's bandwidth into different classes or queues to prioritize traffic based on filter rules.

options ALTQ_RED enables Random Early Detection (RED). RED is used to avoid network congestion. RED does this by measuring the length of the queue and comparing it to the minimum and maximum thresholds for the queue. If the queue is over the maximum all new packets will be dropped. True to its name, RED drops packets from different connections randomly.

options ALTQ_RIO enables Random Early Detection In and Out.

options ALTQ_HFSC enables the Hierarchical Fair Service Curve Packet Scheduler. For more information about HFSC see: http://www-2.cs.cmu.edu/~hzhang/HFSC/main.html.

options ALTQ_PRIQ enables Priority Queuing (PRIQ). PRIQ will always pass traffic that is in a higher queue first.

options ALTQ_NOPCC enables SMP support for ALTQ. This option is required on SMP systems.

28.4.5 Creating Filtering Rules

The Packet Filter reads its configuration rules from the pf.conf(5) file and it modifies, drops or passes packets according to the rules or definitions specified there. The FreeBSD installation comes with a default /etc/pf.conf which contains useful examples and explanations.

Although FreeBSD has its own /etc/pf.conf the syntax is the same as one used in OpenBSD. A great resource for configuring the pf firewall has been written by OpenBSD team and is available at http://www.openbsd.org/faq/pf/.

Warning: When browsing the pf user's guide, please keep in mind that different versions of FreeBSD contain different versions of pf. The pf firewall in FreeBSD 5.X is at the level of OpenBSD version 3.5 and in FreeBSD 6.X is at the level of OpenBSD version 3.7.

The FreeBSD packet filter ¶l»¼½×¾Â is a good place to ask questions about configuring and running the pf firewall. Do not forget to check the mailing list archives before asking questions.

¥»¤å¤Î¨ä¥L¤å¥ó¡A¥i¥Ñ¦¹¤U¸ü¡Gftp://ftp.FreeBSD.org/pub/FreeBSD/doc/¡C

­Y¦³ FreeBSD ¤è­±ºÃ°Ý¡A½Ð¥ý¾\Ū FreeBSD ¬ÛÃö¤å¥ó¡A¦p¤£¯à¸Ñ¨Mªº¸Ü¡A¦A¬¢¸ß <questions@FreeBSD.org>¡C
Ãö©ó¥»¤å¥óªº°ÝÃD¡A½Ð¬¢¸ß <doc@FreeBSD.org>¡C