4

I just messed with my pf.conf and ran pf and I got:

Enabling pf.
No ALTQ support in kernel

Of course the fix is to re-compile the kernel, but that article is for freebsd 7. I'm on FreeBSD 9.1

I want to know:

  1. Should I really bother to enable ALTQ and recompile? Do I need to do it to re-route traffic into and outside my freebsd jail?
  2. Does the fix in this article apply to FreeBSD 9.1, I don't want to spend all night building the OS only to found out at the end something went wrong!!
gideon
  • 353
  • 3
  • 6
  • 17
  • 1
    If it makes you feel better, the current version of Mac OS X behaves the same way. Apparently Apple is with wollud1969: it isn't broke, so they're not going to fix it. Arguably `pf` should be detecting the missing feature and coping silently instead of complaining every time. – Warren Young Feb 26 '13 at 16:13

2 Answers2

6

I was running a FreeBSD based firewall without problems over many years with this particular issue. If you don't want to perform traffic shaping stuff, you don't need to fix, I would say. Or to say it in a different way: I wouldn't fix it.

wollud1969
  • 344
  • 1
  • 2
  • 4
2

No, you absolutely do NOT need ALTQ to re-route traffic to and from your freebsd jails. I use pf to map traffic on external IPs to the static IPs that my jails run on. The following entries direct traffic to and from the internet to the jails for my mail server:

ext_if="bce1"

lo_toaster = "127.0.0.6"
toaster    = "208.75.177.101"

nat on $ext_if from $lo_toaster   to any -> $toaster
rdr on $ext_if from any to $toaster      -> $lo_toaster

I have dozens of jails set up like this. While it is obviously more complicated than just assigning public IPs to the jails, it comes with some nice perks. I can change/add/delete public IP(s) for a jail and nothing within the jail needs to be touched. Edit /etc/pf.conf and I'm done. I can move jails between hosts without touching anything within the jails. Because they run on loopback addresses, I can bring the jail up on multiple servers simultaneously, test, and then move traffic by updating the network and firewall rules.

A long time ago, I used ALTQ to make connections to port 25 from Windows hosts really, really slow ( pass in quick proto tcp from any os "Windows" ... ) but the advantages of doing so aren't worth having to rebuild the kernel manually.

Matt Simerson
  • 185
  • 6
  • ah thanks for your answer. Being completely new to freebsd and linux generally I was lost and thought this was the reason I wasn't really able to re route traffic. Do you have any resources for understanding `pf.conf` and the firewall itself. I just copied a number of configurations without understanding what they were doing and eventually ended up giving up :( – gideon Jun 17 '13 at 08:48
  • I started using PF the week it was imported to FreeBSD from OpenBSD. The only resource for PF at the time was [the one on the OpenBSD site](http://www.openbsd.org/faq/pf/) and I have yet to find one I like better. FreeBSD has a section on [PF in the Handbook](http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-pf.html) but I think it's worth going straight to the source. I had to read through the PF pages on the OpenBSD site a few times until I finally "got it." It's worth the effort. – Matt Simerson Jun 17 '13 at 09:09
  • Thanks very much. I really love the jails concept in FreeBSD but the first round was really hard. I'm thinking of setting up a pc-bsd on my desktop to get a feel and play with jails, think it's a good idea for a bsd newbie? – gideon Jun 17 '13 at 14:47
  • As a newbie, the only thing you're likely to get out of running jails is experience. If you're in for that, then by all means, jail on. But using jails, or any other virtualization system to have multiple VMs is more complex that just having one systems. There are cases where jails are a **really** big win, such as security, service portability among jail hosts, being able to update software in one jail without it breaking other services, etc. Whether those features are worth the price of admission is a judgement call for you to make. – Matt Simerson Jun 17 '13 at 16:37