Project

General

Profile

Actions

Bug #4326

closed

Limiters on firewall rules where NAT applies drop all traffic

Added by Adam Hirsch over 6 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
Traffic Shaper (Limiters)
Target version:
Start date:
01/27/2015
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2.x
Affected Architecture:

Description

A PASS filter rule with In / Out limiters set will pass traffic until bandwidth in a limited direction hits the limit rate, at which point all further traffic in that direction is silently discarded. Traffic in a direction which has not reached its limit rate or does not have a limit applied continues passing, unaffected. Rate-limited rules which had been working under 2.1.5 broke badly with the 2.2 upgrade.

Steps to reproduce:
  1. Firewall -> Traffic Shaper -> Limiter
  2. Create two limiters, labeled "in" and "out", each at 1Mb/s , all other values left at defaults
  3. Create a NAT filter rule (in my case, passing port 7500 on the WAN interface through to port 7500 on a host inside the firewall)
  4. Under "Advanced features", apply the limiters as In / Out limits for this filter rule
  5. On the host inside the firewall, set up a listener on port 7500 using "netcat -l 7500"
  6. From outside the firewall, connect through, using "netcat <WAN ADDRESS> 7500"
  7. Type at each netcat session, verifying that slow traffic passes in both directions
  8. From whichever host is closer to you, paste in a large block of text all at once (I used Lewis Carroll's "Jabberwocky")
  9. Note the block of text get cut off partway through.
  10. Attempt to send further traffic from that host, and note it no longer reaches the other side ... but that the tcp connection remains up
  11. Type in slow traffic from the other side to observe that traffic which has not reached the limited rate can still pass, but only in that direction.

Files

no-reply-to.png (40.9 KB) no-reply-to.png Filter rule -> Advanced Adam Hirsch, 01/29/2015 07:50 AM
Actions

Also available in: Atom PDF