PF/ALTQ rules not working as intended

[Weaseal]

I am attempting to limit all clients on the network to 128Kbps down and 64Kbps up. This is *sort of* working, except that for some reason, ALL clients are falling under the "c1" queue (which is the default), instead of using the ones written specifically for them.

Here is my pf.conf:

$ cat /etc/pf.conf
int_if="rl0"
ext_if="nfe0"
int_net="192.168.2.0/24"

principal="192.168.2.2"
c1="192.168.2.3"
c2="192.168.2.4"
c3="192.168.2.5"
c4="192.168.2.6"
c5="192.168.2.7"
c6="192.168.2.8"
c7="192.168.2.9"
c8="192.168.2.10"
c9="192.168.2.11"


altq on $int_if cbq bandwidth 3Mb queue { principal_d,c1_d,c2_d,c3_d,c4_d,c5_d,c6_d,c7_d,c8_d,c9_d }
altq on $ext_if cbq bandwidth 1Mb queue { principal_u,c1_u,c2_u,c3_u,c4_u,c5_u,c6_u,c7_u,c8_u,c9_u }


queue principal_d bandwidth 192Kb cbq ( rio )
queue principal_u bandwidth 64Kb cbq ( rio )

queue c1_d bandwidth 128Kb cbq ( default rio )
queue c1_u bandwidth 64Kb cbq ( default rio )

queue c2_d bandwidth 128Kb cbq ( rio )
queue c2_u bandwidth 64Kb cbq ( rio )

queue c3_d bandwidth 128Kb cbq ( rio )
queue c3_u bandwidth 64Kb cbq ( rio )

queue c4_d bandwidth 128Kb cbq ( rio )
queue c4_u bandwidth 64Kb cbq ( rio )

queue c5_d bandwidth 128Kb cbq ( rio )
queue c5_u bandwidth 64Kb cbq ( rio )

queue c6_d bandwidth 128Kb cbq ( rio )
queue c6_u bandwidth 64Kb cbq ( rio )

queue c7_d bandwidth 128Kb cbq ( rio )
queue c7_u bandwidth 64Kb cbq ( rio )

queue c8_d bandwidth 1200Kb cbq ( rio )
queue c8_u bandwidth 64Kb cbq ( rio )

queue c9_d bandwidth 128Kb cbq ( rio )
queue c9_u bandwidth 64Kb cbq ( rio )


pass out on $int_if from any to $principal keep state queue principal_d
pass out on $int_if from any to $c1 keep state queue c1_d
pass out on $int_if from any to $c2 keep state queue c2_d
pass out on $int_if from any to $c3 keep state queue c3_d
pass out on $int_if from any to $c4 keep state queue c4_d
pass out on $int_if from any to $c5 keep state queue c5_d
pass out on $int_if from any to $c6 keep state queue c6_d
pass out on $int_if from any to $c7 keep state queue c7_d
pass out on $int_if from any to $c8 keep state queue c8_d
pass out on $int_if from any to $c9 keep state queue c9_d


pass out on $ext_if from $principal to any keep state queue principal_u
pass out on $ext_if from $c1 to any keep state queue c1_u
pass out on $ext_if from $c2 to any keep state queue c2_u
pass out on $ext_if from $c3 to any keep state queue c3_u
pass out on $ext_if from $c4 to any keep state queue c4_u
pass out on $ext_if from $c5 to any keep state queue c5_u
pass out on $ext_if from $c6 to any keep state queue c6_u
pass out on $ext_if from $c7 to any keep state queue c7_u
pass out on $ext_if from $c8 to any keep state queue c8_u
pass out on $ext_if from $c9 to any keep state queue c9_u

And here is "pftop" and pressing 8 on the keyboard:

pfTop: Up Queue 1-22/22, View: queue, Cache: 10000                                                                                     21:09:20

QUEUE                             BW SCH  PRIO     PKTS    BYTES   DROP_P   DROP_B QLEN BORROW SUSPEN     P/S     B/S
root_rl0                       3000K cbq     0      238    59029        0        0    0      0      0       9    2544
root_nfe0                      1000K cbq     0      275   212907        0        0    0      0      0      12    7886
 principal_d                    192K cbq              0        0        0        0    0      0      0       0       0
 principal_u                   64000 cbq              0        0        0        0    0      0      0       0       0
 c1_d                           128K cbq            238    59029        0        0    0      0      3       9    2544
 c1_u                          64000 cbq            275   212907       34    31105   33      0     65      12    7886
 c2_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c2_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c3_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c3_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c4_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c4_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c5_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c5_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c6_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c6_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c7_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c7_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c8_d                          1200K cbq              0        0        0        0    0      0      0       0       0
 c8_u                          64000 cbq              0        0        0        0    0      0      0       0       0
 c9_d                           128K cbq              0        0        0        0    0      0      0       0       0
 c9_u                          64000 cbq              0        0        0        0    0      0      0       0       0

Can anyone suggest what I am doing wrong?

[Weaseal]

Well, clearly and unfortunately this thread never got a reply and I was forced to switch to ipfw/dummynet for the bandwidth limiting. I'd rather be using pf for its advanced packet shaping features, but sometimes we have to settle for what gets the most important part done.

[s0xxx]

I don't have means to simulate and try your config right now as I am on a Windows machine, but you could've tried to generate traffic and then run pfctl -vv -ss (and possibly pfctl -vv -sr) to see which rule(s) put traffic into default queue so you can investigate why.
I see you got the problem solved but It's worth knowing why it didn't work.

[s2scott]

Can you do an ascii-art network diagram (topology). I think the reason your rules aren't hitting are --perhaps-- because you have the inside-outside ip addresses and the to-from mis-aligned.

pfctl -vvsrules

will show you the rule "hit" counts. I suspect they'll be zero.

/Scott

[Weaseal]

Originally Posted by s2scott

Can you do an ascii-art network diagram (topology). I think the reason your rules aren't hitting are --perhaps-- because you have the inside-outside ip addresses and the to-from mis-aligned.

Ok.

( INTERNET ) --- ( ADSL modem ) --- ( <nfe0> FreeBSD gateway <rl0> ) --- ( switch ) --- ( clients )