Dummynet does not match on flows

Question

I have two machines as shown below:

To internet<---->PC_A<----->PC_B

PC_A has two interfaces (one connected to internet and other to PC_B). PC_B has to go through PC_A to connect to the Internet. I run Dummynet on PC_A. PC_A has IP 192.168.1.1 on the interface facing the internet and IP 10.42.0.1 on the interface facing PC_B. PC_B bas 10.42.0.2 configured on its interface.

I have two pipes in Dummynet configured as follows:

ipfw add pipe 1 ip from 192.168.1.1 to any
ipfw add pipe 2 ip from any to 192.168.1.1
ipfw pipe 1 config bw 5000Kb/s
ipfw pipe 2 config bw 5000Kb/s

If I run bandwidth tests on the two machines (say speedtest.net), PC_A's bandwidth is exactly what I specify in Dummynet, while PC_B gets unlimited bandwidth. I do not understand how this is possible, since PC_B's packets have to go through it's gateway, where it will be subject to Dummynet's rules.

Could someone please point me to suggestions.

Thanks.

Answer 1

Is PC_A configured to NAT or is this machine simply forwarding the packets? If the former is not in place your IPFW rules will not catch packets passing through from PC_B's 10.42.0.2 interface. If not done already, I would suggest taking a tcpdump on the 192.168.1.1 interface on PC_A to look at source addresses of packets leaving the local network.

To elaborate, the IPFW rules that you have in place for pipe1 and pipe2 will only match packets with source and destination addresses (respectively) of 192.168.1.1...

Depending on your network topology and routing configurations, you may be able to achieve what you want without NAT by using in / out filters in your IPFW rules...

ipfw add pipe 1 ip from any to any in via em0
ipfw add pipe 2 ip from any to any out via em0

...however without a properly configured NAT, I am not sure how return traffic will manage to traverse back to the source machine.