fireqos-params-match(5)

NAME

fireqos-params-match - optional match parameters

SYNOPSIS

at { root | name }

class name

syn|syns

ack|acks

{ proto|protocol protocol [,protocol...] } |tcp|udp|icmp|gre|ipv6

{ tos | priority } tosid [,tosid...]

{ DSCP } classname [,classname...]

mark mark [,mark...]

connmark mark [,mark...]

rawmark mark [,mark...]

custommark name mark [,mark...]

{ port | ports } port[:range] [ ,port[:range]... ]

{ sport | sports } port[:range] [ ,port[:range]... ]

{ dport | dports } port[:range] [ ,port[:range]... ]

{ ip | net | host } net [,net...]

src net [,net...]

dst net [,net...]

{ srcmac | smac } mac

{ dstmac | dmac } mac

prio id

input

output

custom `custom tc parameters'

estimator interval decay

police police

insidegre

DESCRIPTION

These options apply to match statements.

  input, output

On bidirectional interfaces, input and output will check the current direction of the interface. If the match is input but the interface is output the match will be reversed. The same will happen if output is given at the match and the interface is input.

The parameters that are reversed are:

•   src and dst

•   sport and dport

•   srcmac and dstmac

This allows a definition like this:

      interface dsl0 world bidirectional ...
        class surfing ...
          match input sport 0:1023

The above will match sport 0:1023 at the input interface, and will automatically reverse it to match dport 0:1023 at the output interface.

  at

By default a match is attached to the parent of its parent class. For example, if its parent is a class directly under the interface, then the match is attached to the interface and is compared against all traffic of the interface. For nested classes, a match of a leaf, is attached to the parent class and is compared against all traffic of this parent class.

With the at parameter, a match can be attached any class. The name parameter should be a class name. The name root attaches the match to the interface.

  class

Defines the name of the class that will get the packets matched by this match.

By default it is the name of the class the match statement appears under.

    Note

    There is also a class definition for traffic, see fireqos-class(5).

  syn, syns

Match TCP SYN packets. Note that the tcp parameter must be specified.

If the same match statement includes more protocols than TCP, then this match will work for the TCP packets (it will be silently ignored for all other protocols).

For example, syn is ignored when generating the UDP filter in the below:

    match tcp syn
    match proto tcp,udp syn

  ack, acks

Same as syn, but matching small TCP packets with the ACK bit set.

  proto, protocol, tcp, udp, icmp, gre, ipv6

Match the protocol in the IP header.

  tos, priority

Match to TOS field of ipv4 or the priority field of ipv6. The tosid can be a value/mask in any format tc(8) accepts, or one of the following:

•   min-delay, minimize-delay, minimum-delay, low-delay, interactive

•   maximize-throughput, maximum-throughput, max-throughput, high-throughput, bulk

•   maximize-reliability, maximum-reliability, max-reliability, reliable

•   min-cost, minimize-cost, minimum-cost, low-cost, cheap, normal-service, normal

    Note

    There is also a class parameter called priority, see fireqos-params-class(5).

  dscp

Match to DSCP value in IP TOS header field. The classname has to be one of the following values:

•   CS1, CS2, CS3, CS4, CS5, CS6, CS7

•   AF11, AF12, AF13

•   AF21, AF22, AF23

•   AF31, AF32, AF33

•   AF41, AF42, AF43

•   EF

    Note

    tc-filter only supports ToS parameters. That is why a lookaside table is configured within fireqos code to translate the DSCP value to their matching TOS value. See RFC2474 for more information.

  mark, connmark, custommark, rawmark

Match an iptables(8) MARK. This works the same way it works for FireHOL. FireHOL and FireQOS share the same marks and their masks.

Matching iptables(8) MARKs do not work on input interfaces. You can use them only on output. The IFB devices that are used for shaping inbound traffic do not have any iptables hooks to allow matching MARKs. If you try it, FireQOS will attempt to do it, but currently you will get an error from the tc(8) command executed or they will be silently ignored by it.

On some Linux distributions (e.g. OpenWRT) there is a module called act_commark that will enable this feature. Set this within your fireqos.conf to enable it:

    FIREQOS_CONNMARK_RESTORE="act_connmark"

Also note that matching marks requires a suitably configured kernel (with CONFIG_CLS_U32_MARK=y). There is no error if the kernel is not configured correctly; it just silently drops the rules. For details see this error report (https://github.com/firehol/firehol/issues/231).

  ports, sports, dports

Match ports of the IP header. ports will create rules for matching source and destination ports (separate rules for each). dports matches destination ports, sports matches source ports.

  ip, net, host, src, dst

Match IPs of the IP header. ip, net and host will create rules for matching source and destination IPs (separate rules for each). src matches source IPs and dst destination IPs.

    Note

    If the class these matches appear in are IPv4, then only IPv4 IPs can be used. To override use match6 ... src/dst *IPV6_IP*

    Similarly, if the class is IPv6, then only IPv6 IPs can be used. To override use match4 ... src/dst *IPV4_IP*.

You can mix IPv4 and IPv6 in any way you like. FireQOS supports inheritance, to figure out for each statement which is the default. For example:

    interface46 eth0 lan output rate 1Gbit # ipv4 and ipv6 enabled
      class voip # ipv4 and ipv6 class, as interface is both
        match udp port 53 # ipv4 and ipv6 rule, as class is both
        match4 src 192.0.2.1 # ipv4 only rule
        match6 src 2001:db8::1 # ipv6 only rule
      class4 realtime # ipv4 only class
        match src 198.51.100.1 # ipv4 only rule, as class is ipv4-only
      class6 servers # ipv6 only class
            match src 2001:db8::2 # ipv6 only rule, as class is ipv6-only

To convert an IPv4 interface to IPv6, just replace interface with interface6. All the rules in that interface, will automatically inherit the new protocol. Of course, if you use IP addresses for matching packets, make sure they are IPv6 IPs too.

  prio (match)

    Note

    There is also a class parameter called prio, see fireqos-params-class(5).

All match statements are attached to the interface. They forward traffic to their class, but they are actually executed for all packets that are leaving the interface (note: input matches are actually output matches on an IFB device).

By default, the priority they are executed, is the priority they appear in the configuration file, i.e. the first match of the first class is executed first, then the rest matches of thasses to their subclasses. FireQOS will not allow you to set a burst at a subclass, higher than its parent. Setting a burst of a subclass higher than its parent will drain the parent class, which may be stuck for up to a minute when this happens. For this check to work, FireQOS uses just its configuration (it does not query the kernel to check how the value specified in the config file for a subclass relates to the actual value of its parent).

  cburst

cburst is like burst, but at hardware speed (not just ceiling speed).

By default, FireQOS lets the kernel decide this parameter.

cburst is inherited from interfaces to classes and from group classes to their subclasses. FireQOS will not allow you to set a cburst at a subclass, higher to its parent. Setting a cburst of a subclass higher than its parent, will drain the parent class, which may be stuck for up to a minute when this happens. For this check to work, FireQOS uses just its configuration (it does not query the kernel to check how the value specified in the config file for a subclass relates to the actual value of its parent).

  quantum

quantum specifies the number of bytes a class is allowed to send at once, when it is borrowing spare bandwidth from other classes.

By default, FireQOS sets quantum to the interface mtu.

quantum is inherited from interfaces to classes and from group classes to their subclasses.

  priority, balanced

These parameters set the priority mode of the child classes.

priority
    priority is the default mode, where FireQOS assigns an incremental priority to each class. In this mode, the first class takes prio 0, the second prio 1, etc. When a class has a higher prio than the others (higher = smaller number), this high priority class will get all the spare bandwidth available, when it needs it. Spare bandwidth will be allocate to lower priority classes only when the higher priority ones do not need it.

balanced
    balanced mode gives prio 4 to all child classes. When multiple classes have the same prio, the spare bandwidth available is spread among them, proportionally to their committed rate. The value 4 can be overwritten by setting FIREQOS_BALANCED_PRIO at the top of the config file to the prio you want the balanced mode to assign for all classes.

The priority mode can be set in interfaces and class groups. The effect is the same. The classes that are defined as child classes, will get by default the calculated class prio based on the priority mode given.

These options affect only the default prio that will be assigned by FireQOS. The default is used only if you don’t explicitly use a prio parameter on a class.

    Note

    There is also a match parameter called priority, see fireqos-params-match(5).

SEE ALSO

•   fireqos(1) - FireQOS program

•   fireqos.conf(5) - FireQOS configuration file

•   fireqos-interface(5) - QOS interface definition

•   fireqos-class(5) - QOS class definition

•   FireHOL Website (http://firehol.org/)

•   FireQOS Online PDF Manual (http://firehol.org/fireqos-manual.pdf)

•   FireQOS Online Documentation (http://firehol.org/documentation/)

AUTHORS
FireHOL Team.