## SafeFire Links

### v1.3a

# Firewall Plugin. Piping mode

The packet filter has the function "pipe" that allows to divide and aggregate packet streams. This function can be used to define if packet will be processed by one or other plugin (i.e. NAT/Shaper).

At the diagram this usage looks like the next:

           --[-Port.BeforeFilter.Stack-]--------------[-Port.AfterFilter.Stack-]---
                                       [--Shaper/NAT--]

To perform this use the Action named "pipe" with decimal number as parameter. Every packet, that conforms to the "pipe" rule is processed exactly as in "allow", but is sent not to the corresponding Stream, but to the stream defined with decimal parameter.

Note: you must also add "defup=yes" parameter to every filter that is using piping to Stream that is attached to only one of the "PORT" and "STACK" (this is the case of almost every configuration described by this document). This will allow Filter to act as end point of packet stream.

Here is extract of the configuration file that uses the configuration descibed in the diagram above.

        [beforefilter]
        load = pl_flt:filter
        bind=stack:afterfilter.stack;shaper.in
        defup=yes

        rule=pipe 1 all from 192.168.0.1 to any in
        rule=pipe 0 all from any to any

        [shaper]
        load = pl_shape:multi_shaper
        bind = out:afterfilter.stack[1]

        [afterfilter]
        load = pl_flt:filter
        defup=yes

        rule=pipe 1 all from any to 192.168.0.1 out
        rule=pipe 0 all from any to any

Here is example of the working SafeFire Links configuration with Traffic Shaper. It defines shaping rules for 9 different IP addresses with different limits for IN and OUT directions and can be easily extended to support up to 65534 different addresses, address groups, ports or other attributes that can be selected with Filter plugin.

        [plugman]
        log.level=7
        log.console=yes
        buzz=1

        [ether]
        load=pl_lan:Protocol
        protocol=800 F00

        [ppp]
        load=pl_lan:Adapter
        bind=io:filter.stack

        [filter]
        load = pl_flt:filter
        bind=port:shfilter.stack;sh1in.in;sh2in.in;sh3in.in;sh4in.in;sh5in.in;sh6in.in;sh7in.in;sh8in.in;sh9in.in
        enabled=1
        defup=1

        rule=pipe 1 all from 10.1.3.11 to any out
        rule=pipe 2 all from 10.1.3.13 to any out
        rule=pipe 3 all from 10.1.3.16 to any out
        rule=pipe 4 all from 10.1.3.17 to any out
        rule=pipe 5 all from 10.1.3.19 to any out

        rule=pipe 6 all from 10.1.2.19 to any out
        rule=pipe 7 all from 10.1.2.23 to any out
        rule=pipe 8 all from 10.1.2.24 to any out
        rule=pipe 9 all from 10.1.2.25 to any out

        rule=pipe 0 all from any to any

        [sh1In]
        load=pl_shape:single_shaper
        bind=out:sh1out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh1Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[1]
        rate=20000
        limit=30000
        bothsided=no
        timeout=0

        [sh2In]
        load=pl_shape:single_shaper
        bind=out:sh2out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh2Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[2]
        rate=50000
        limit=75000
        bothsided=no
        timeout=0

        [sh3In]
        load=pl_shape:single_shaper
        bind=out:sh3out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh3Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[3]
        rate=50000
        limit=75000
        bothsided=no
        timeout=0

        [sh4In]
        load=pl_shape:single_shaper
        bind=out:sh4out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh4Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[4]
        rate=50000
        limit=80000
        bothsided=no
        timeout=0

        [sh5In]
        load=pl_shape:single_shaper
        bind=out:sh5out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh5Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[5]
        rate=10000
        limit=20000
        bothsided=no
        timeout=0

        [sh6In]
        load=pl_shape:single_shaper
        bind=out:sh6out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh6Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[6]
        rate=20000
        limit=30000
        bothsided=no
        timeout=0

        [sh7In]
        load=pl_shape:single_shaper
        bind=out:sh7out.out
        rate=50000
        limit=75000
        bothsided=no
        timeout=0

        [sh7Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[7]
        rate=50000
        limit=70000
        bothsided=no
        timeout=0

        [sh8In]
        load=pl_shape:single_shaper
        bind=out:sh8out.out
        rate=50000
        limit=75000
        bothsided=no
        timeout=0

        [sh8Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[8]
        rate=80000
        limit=90000
        bothsided=no
        timeout=0

        [sh9In]
        load=pl_shape:single_shaper
        bind=out:sh9out.out
        rate=10000
        limit=15000
        bothsided=no
        timeout=0

        [sh9Out]
        load=pl_shape:single_shaper
        bind=in:shfilter.stack[9]
        rate=100000
        limit=200000
        bothsided=no
        timeout=0

        [shfilter]
        load = pl_flt:filter
        bind=port:nat.stack
        enabled=1
        defup=1

        rule=pipe 1 all from any to 10.1.3.11 in
        rule=pipe 2 all from any to 10.1.3.13 in
        rule=pipe 3 all from any to 10.1.3.16 in
        rule=pipe 4 all from any to 10.1.3.17 in
        rule=pipe 5 all from any to 10.1.3.19 in
        rule=pipe 6 all from any to 10.1.2.19 in
        rule=pipe 7 all from any to 10.1.2.23 in
        rule=pipe 8 all from any to 10.1.2.24 in
        rule=pipe 9 all from any to 10.1.2.25 in

        rule=pipe 0 all from any to any

        [nat]
        load=pl_alias:nat
        bind=port:natfilter.stack
        enabled=1

        [natfilter]
        load = pl_flt:filter
        bind=port:ether.io

Return to documentation index | SafeFire Links (C) Link Guard Solutions 1999, 2000