            SafeFire PPP 1.0
            Firewall Plugin
              Piping mode
          (c) Link Guard Solutions

    Starting from SafeFire PPP v1.1, packet filter has new function - "pipe" that allows to divide and aggregate packet streams.
    This function can be used to define if packet will be processed by one or other plugin (i.e. NAT/Shaper)

    At the diagram (please use monotype font) this usage will look like the next:

       --<-Port.BeforeFilter.Stack->--------------<-Port.AfterFilter.Stack->---
                                  \>--Shaper/NAT--</

    To perform this, new Action named "pipe" was introduced with decimal number as parameter.
    Every packet, that conforms to the "pipe" rule is processed exactly as in "allow", but is sent not to the corresponding Stream, but to the stream defined with decimal parameter.
    Note: you must also add "defup=yes" parameter to every filter that is using piping to Stream that is attached to only one of the "PORT" and "STACK" (this is the case of almost every configuration described by this document). This will allow Filter to act as end point of packet stream.

    Here is extract of the configuration file that uses the configuration descibed in the diagram above.
    -------------------
    [beforefilter]
    load = pl_flt:filter
    bind=stack:afterfilter.stack;shaper.in
    defup=yes

    rule=pipe 1 all from 192.168.0.1 to any in
    rule=pipe 0 all from any to any

    [shaper]
    load = pl_add:shaper
    bind = out:afterfilter.stack[1]

    [afterfilter]
    load = pl_flt:filter
    defup=yes

    rule=pipe 1 all from any to 192.168.0.1 out
    rule=pipe 0 all from any to any
    --------------------

    Here is example of the working SafeFire Links configuration with Traffic Shaper. It defines shaping rules for 9 different IP addresses with different limits for IN and OUT directions and can be easily extended to support up to 65534 different addresses, address groups, ports or other attributes that can be selected with Filter plugin.
    --------------------
    [plugman]
    log.level=7
    log.console=yes
    buzz=1

    [ether]
    load=pl_lan:Protocol
    protocol=800 F00

    [ppp]
    load=pl_lan:Adapter
    bind=io:filter.stack

    [filter]
    load = pl_flt:filter
    bind=port:shfilter.stack;sh1in.in;sh2in.in;sh3in.in;sh4in.in;sh5in.in;sh6in.in;sh7in.in;sh8in.in;sh9in.in
    enabled=1
    defup=1

    rule=pipe 1 all from 10.1.3.11 to any out
    rule=pipe 2 all from 10.1.3.13 to any out
    rule=pipe 3 all from 10.1.3.16 to any out
    rule=pipe 4 all from 10.1.3.17 to any out
    rule=pipe 5 all from 10.1.3.19 to any out

    rule=pipe 6 all from 10.1.2.19 to any out
    rule=pipe 7 all from 10.1.2.23 to any out
    rule=pipe 8 all from 10.1.2.24 to any out
    rule=pipe 9 all from 10.1.2.25 to any out

    rule=pipe 0 all from any to any


    [sh1In]
    load=pl_add:singleshaper
    bind=out:sh1out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh1Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[1]
    rate=20000
    limit=30000
    bothsided=no
    timeout=0

    [sh2In]
    load=pl_add:singleshaper
    bind=out:sh2out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh2Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[2]
    rate=50000
    limit=75000
    bothsided=no
    timeout=0

    [sh3In]
    load=pl_add:singleshaper
    bind=out:sh3out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh3Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[3]
    rate=50000
    limit=75000
    bothsided=no
    timeout=0

    [sh4In]
    load=pl_add:singleshaper
    bind=out:sh4out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh4Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[4]
    rate=50000
    limit=80000
    bothsided=no
    timeout=0

    [sh5In]
    load=pl_add:singleshaper
    bind=out:sh5out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh5Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[5]
    rate=10000
    limit=20000
    bothsided=no
    timeout=0

    [sh6In]
    load=pl_add:singleshaper
    bind=out:sh6out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh6Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[6]
    rate=20000
    limit=30000
    bothsided=no
    timeout=0

    [sh7In]
    load=pl_add:singleshaper
    bind=out:sh7out.out
    rate=50000
    limit=75000
    bothsided=no
    timeout=0

    [sh7Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[7]
    rate=50000
    limit=70000
    bothsided=no
    timeout=0

    [sh8In]
    load=pl_add:singleshaper
    bind=out:sh8out.out
    rate=50000
    limit=75000
    bothsided=no
    timeout=0

    [sh8Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[8]
    rate=80000
    limit=90000
    bothsided=no
    timeout=0

    [sh9In]
    load=pl_add:singleshaper
    bind=out:sh9out.out
    rate=10000
    limit=15000
    bothsided=no
    timeout=0

    [sh9Out]
    load=pl_add:singleshaper
    bind=in:shfilter.stack[9]
    rate=100000
    limit=200000
    bothsided=no
    timeout=0

    [shfilter]
    load = pl_flt:filter
    bind=port:nat.stack
    enabled=1
    defup=1

    rule=pipe 1 all from any to 10.1.3.11 in
    rule=pipe 2 all from any to 10.1.3.13 in
    rule=pipe 3 all from any to 10.1.3.16 in
    rule=pipe 4 all from any to 10.1.3.17 in
    rule=pipe 5 all from any to 10.1.3.19 in
    rule=pipe 6 all from any to 10.1.2.19 in
    rule=pipe 7 all from any to 10.1.2.23 in
    rule=pipe 8 all from any to 10.1.2.24 in
    rule=pipe 9 all from any to 10.1.2.25 in

    rule=pipe 0 all from any to any


    [nat]
    load=pl_alias:nat
    bind=port:natfilter.stack
    enabled=1

    [natfilter]
    load = pl_flt:filter
    bind=port:ether.io
    --------------------
