.Brc

.Brc

.Bl -tag -width indent

.Bl -tag -width indent

.It Cm any

.It Cm any

.It Cm me

.It Cm me

.It Cm me6

.It Cm me6

The address list is evaluated at the time the packet is

The address list is evaluated at the time the packet is

analysed.

analysed.

.It Cm table Ns Pq Ar name Ns Op , Ns Ar value

.It Cm table Ns Pq Ar name Ns Op , Ns Ar value

.It Ar flow-spec : Ar flow-field Ns Op , Ns Ar flow-spec

.It Ar flow-spec : Ar flow-field Ns Op , Ns Ar flow-spec

.It Ar flow-field : src-ip | proto | src-port | dst-ip | dst-port

.It Ar flow-field : src-ip | proto | src-port | dst-ip | dst-port

.It Cm addr

.It Cm addr

Each entry is represented by an

Each entry is represented by an

.Ar addr Ns Op / Ns Ar masklen

.Ar addr Ns Op / Ns Ar masklen

and will match all addresses with base

and will match all addresses with base

When looking up an IP address in a table, the most specific

When looking up an IP address in a table, the most specific

entry will match.

entry will match.

.It Cm iface

.It Cm iface

Each entry is represented by string treated as interface name.

Each entry is represented by string treated as interface name.

Wildcards are not supported.

Wildcards are not supported.

.It Cm number

.It Cm number

Each entry is represented by 32-bit unsigned integer.

Each entry is represented by 32-bit unsigned integer.

Ranges are not supported.

Ranges are not supported.

.It Cm flow

.It Cm flow

.Ar m

.Ar m

is the number of bytes a queue can serve before being moved to the tail

is the number of bytes a queue can serve before being moved to the tail

of old queues list.

of old queues list.

is 9000 bytes.

is 9000 bytes.

.It Cm limit

.It Cm limit

.Ar m

.Ar m

instance of the scheduler.

instance of the scheduler.

The default value of

The default value of

.Ar m

.Ar m

.It Cm flows

.It Cm flows

.Ar m

.Ar m

specifies the total number of flow queues (sub-queues) that fq_*

specifies the total number of flow queues (sub-queues) that fq_*

creates and manages.

creates and manages.

By default, 1024 sub-queues are created when an instance

By default, 1024 sub-queues are created when an instance

of the fq_{codel/pie} scheduler is created.

of the fq_{codel/pie} scheduler is created.

65536.

65536.

.El

.El

.Pp

.Pp

Note that for slow speed links you should keep the queue

Note that for slow speed links you should keep the queue

size short or your traffic might be affected by a significant

size short or your traffic might be affected by a significant

queueing delay.

queueing delay.

or 20s of queue on a 30Kbit/s pipe.

or 20s of queue on a 30Kbit/s pipe.

Even worse effects can result if you get packets from an

Even worse effects can result if you get packets from an

interface with a much larger MTU, e.g.\& the loopback interface

interface with a much larger MTU, e.g.\& the loopback interface

.It Cm onoff

.It Cm onoff

enable turning PIE on and off depending on queue load.

enable turning PIE on and off depending on queue load.

If this option is enabled,

If this option is enabled,

This option is disabled by

This option is disabled by

default.

default.

.It Cm dre | ts

.It Cm dre | ts

If your network has network traffic analyzer

If your network has network traffic analyzer

connected to your host directly via dedicated interface

connected to your host directly via dedicated interface

or remotely via RSPAN vlan, you can selectively mirror

or remotely via RSPAN vlan, you can selectively mirror

.Pp

.Pp

First, make sure your firewall is already configured and runs.

First, make sure your firewall is already configured and runs.

Then, enable layer2 processing if not already enabled:

Then, enable layer2 processing if not already enabled:

.Dl "ipfw nat 5 config redirect_port tcp"

.Dl "ipfw nat 5 config redirect_port tcp"

.Dl "			192.168.0.1:80,192.168.0.10:22,192.168.0.20:25 500"

.Dl "			192.168.0.1:80,192.168.0.10:22,192.168.0.20:25 500"

.Pp

.Pp

.Cm record-state

.Cm record-state

and

and

.Cm defer-action

.Cm defer-action

.Cm allow

.Cm allow

rule packet need to be passed to NAT, not allowed as soon is possible.

rule packet need to be passed to NAT, not allowed as soon is possible.

.Pp

.Pp

.Pp

.Pp

On way out, after all checks place this rules:

On way out, after all checks place this rules:

.Pp

.Pp