The packet filter has the function "pipe" that allows to divide and aggregate packet streams. This function can be used to define if packet will be processed by one or other plugin (i.e. NAT/Shaper).
At the diagram this usage looks like the next:
--[-Port.BeforeFilter.Stack-]--------------[-Port.AfterFilter.Stack-]---
[--Shaper/NAT--]
To perform this use the Action named "pipe" with decimal number as parameter. Every packet, that conforms to the "pipe" rule is processed exactly as in "allow", but is sent not to the corresponding Stream, but to the stream defined with decimal parameter.
Note: you must also add "defup=yes" parameter to every filter that is using piping to Stream that is attached to only one of the "PORT" and "STACK" (this is the case of almost every configuration described by this document). This will allow Filter to act as end point of packet stream.
Here is extract of the configuration file that uses the configuration descibed in the diagram above.
[beforefilter]
load = pl_flt:filter
bind=stack:afterfilter.stack;shaper.in
defup=yes
rule=pipe 1 all from 192.168.0.1 to any in
rule=pipe 0 all from any to any
[shaper]
load = pl_shape:multi_shaper
bind = out:afterfilter.stack[1]
[afterfilter]
load = pl_flt:filter
defup=yes
rule=pipe 1 all from any to 192.168.0.1 out
rule=pipe 0 all from any to any
Here is example of the working SafeFire Links configuration with Traffic Shaper. It defines shaping rules for 9 different IP addresses with different limits for IN and OUT directions and can be easily extended to support up to 65534 different addresses, address groups, ports or other attributes that can be selected with Filter plugin.
[plugman]
log.level=7
log.console=yes
buzz=1
[ether]
load=pl_lan:Protocol
protocol=800 F00
[ppp]
load=pl_lan:Adapter
bind=io:filter.stack
[filter]
load = pl_flt:filter
bind=port:shfilter.stack;sh1in.in;sh2in.in;sh3in.in;sh4in.in;sh5in.in;sh6in.in;sh7in.in;sh8in.in;sh9in.in
enabled=1
defup=1
rule=pipe 1 all from 10.1.3.11 to any out
rule=pipe 2 all from 10.1.3.13 to any out
rule=pipe 3 all from 10.1.3.16 to any out
rule=pipe 4 all from 10.1.3.17 to any out
rule=pipe 5 all from 10.1.3.19 to any out
rule=pipe 6 all from 10.1.2.19 to any out
rule=pipe 7 all from 10.1.2.23 to any out
rule=pipe 8 all from 10.1.2.24 to any out
rule=pipe 9 all from 10.1.2.25 to any out
rule=pipe 0 all from any to any
[sh1In]
load=pl_shape:single_shaper
bind=out:sh1out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh1Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[1]
rate=20000
limit=30000
bothsided=no
timeout=0
[sh2In]
load=pl_shape:single_shaper
bind=out:sh2out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh2Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[2]
rate=50000
limit=75000
bothsided=no
timeout=0
[sh3In]
load=pl_shape:single_shaper
bind=out:sh3out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh3Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[3]
rate=50000
limit=75000
bothsided=no
timeout=0
[sh4In]
load=pl_shape:single_shaper
bind=out:sh4out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh4Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[4]
rate=50000
limit=80000
bothsided=no
timeout=0
[sh5In]
load=pl_shape:single_shaper
bind=out:sh5out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh5Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[5]
rate=10000
limit=20000
bothsided=no
timeout=0
[sh6In]
load=pl_shape:single_shaper
bind=out:sh6out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh6Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[6]
rate=20000
limit=30000
bothsided=no
timeout=0
[sh7In]
load=pl_shape:single_shaper
bind=out:sh7out.out
rate=50000
limit=75000
bothsided=no
timeout=0
[sh7Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[7]
rate=50000
limit=70000
bothsided=no
timeout=0
[sh8In]
load=pl_shape:single_shaper
bind=out:sh8out.out
rate=50000
limit=75000
bothsided=no
timeout=0
[sh8Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[8]
rate=80000
limit=90000
bothsided=no
timeout=0
[sh9In]
load=pl_shape:single_shaper
bind=out:sh9out.out
rate=10000
limit=15000
bothsided=no
timeout=0
[sh9Out]
load=pl_shape:single_shaper
bind=in:shfilter.stack[9]
rate=100000
limit=200000
bothsided=no
timeout=0
[shfilter]
load = pl_flt:filter
bind=port:nat.stack
enabled=1
defup=1
rule=pipe 1 all from any to 10.1.3.11 in
rule=pipe 2 all from any to 10.1.3.13 in
rule=pipe 3 all from any to 10.1.3.16 in
rule=pipe 4 all from any to 10.1.3.17 in
rule=pipe 5 all from any to 10.1.3.19 in
rule=pipe 6 all from any to 10.1.2.19 in
rule=pipe 7 all from any to 10.1.2.23 in
rule=pipe 8 all from any to 10.1.2.24 in
rule=pipe 9 all from any to 10.1.2.25 in
rule=pipe 0 all from any to any
[nat]
load=pl_alias:nat
bind=port:natfilter.stack
enabled=1
[natfilter]
load = pl_flt:filter
bind=port:ether.io
| Return to documentation index | SafeFire Links (C) Link Guard Solutions 1999, 2000 |