Questions[ipfw](server)

I'm using tc with kernel 2.6.38.8 for traffic shaping. Limit bandwidth works, adding delay works, but when shaping both bandwidth with delay, the achieved bandwidth is always much lower than the limit if the limit is >1.5 Mbps or so.

Example:

tc qdisc del dev usb0 root
tc qdisc add dev usb0 root handle 1: tbf rate 2Mbit burst 100kb latency 300ms
tc qdisc add dev usb0 parent 1:1 handle 10: netem limit 2000 delay 200ms

Yields a delay (from ping) of 201 ms, but a capacity of just 1.66 Mbps (from iperf). If I eliminate the delay, the bandwidth is precisely 2 Mbps. If I specify a bandwidth of 1 Mbps and 200 ms RTT, everything works. I've also tried ipfw / dummynet, which yields similar results.

I've tried using rebuilding the kernel with HZ=1000 in Kconfig -- that didn't fix the problem. Other ideas?

I've played around with the ipfw command on a Mac and tried to limit the bandwidth to 1MBit/s.

sudo ipfw add pipe 1 ip from any to me
sudo ipfw pipe 1 config bw 1MBit/s

These are the statements I'm using. ipfw indeed limits the bandwidth drastically but according to speedtest.net only to ~7.7 Mbps on a 100 Mbps line. With a restriction to 3MBit/s the effective download is ~23.13 Mbps. Apparently the ipfw always uses a factor ~7.7 of the given limit. With a limit of 4 Mbps the effective speed is ~30,84 Mbps, with 8 Mbps it's ~61.6 Mbps and so on...

Anyone knows why this is the reason? Is it a bug or do I use the statement wrong?

Thank you

I have the following ipfw settings on my Mac OS X 10.4 Tiger:

00100 allow ip from any to 123.123.123.123
00110 allow tcp from any to 123.123.123.123
00120 allow udp from any to 123.123.123.123
00130 allow ip from 123.123.123.123 to any
00140 allow tcp from 123.123.123.123 to any
00150 allow udp from 123.123.123.123 to any
65534 deny ip from any to any
65535 allow ip from any to any

I am trying to ssh to the Mac from a Linux computer which has IP address 123.123.123.123, and sshd is running on the Mac. However, the ssh client outputs the following:

ssh [email protected] -v

OpenSSH_5.5p1, OpenSSL 1.0.0d-fips 8 Feb 2011
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to mac.example.com [10.10.10.10] port 22.
debug1: Connection established.
debug1: identity file /home/me/.ssh/id_rsa type -1
debug1: identity file /home/me/.ssh/id_rsa-cert type -1
debug1: identity file /home/me/.ssh/id_dsa type -1
debug1: identity file /home/me/.ssh/id_dsa-cert type -1
ssh_exchange_identification: Connection closed by remote host

What could cause the Mac to suddenly close the connection before even asking for a password?

I believe it has to do with the IPFW settings, because the ssh worked when I simply had 65535 allow ip from any to any as the IPFW settings. E.g., do I need a rule for a reverse DNS lookup?

I am trying to convert code I made on ubuntu work with osx. I do not know how to convert the iptables commands to ipfw commands. Any help would be appreciated.

Ubuntu Code:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ssh server -l root -w0:0
ifconfig tun0 10.0.0.1 netmask 255.0.0.0
route add -net 1.2.3.4 dev tun0
iptables -t nat -A OUTPUT -p all -d 15.0.0.5 -o tun0 -j DNAT --to-destination 10.0.0.5
route add -host 15.0.0.5 dev tun0

Mac OS X Code:

sysctl -w net.inet.ip.forwarding=1 
HELP HERE PLEASE!
ssh server -l root -w0:0
ifconfig tun0 10.0.0.1 netmask 255.0.0.0
route add -net 1.2.3.4 dev tun0
HERE TOO HERE!
route add -host 15.0.0.5 dev tun0

I want to forward requests from 192.168.99.100:80 to 127.0.0.1:8000. This is how I'd do it in linux using iptables:

iptables -t nat -A OUTPUT -p tcp --dport 80 -d 192.168.99.100 -j DNAT --to-destination 127.0.0.1:8000

How do I do the same thing in MacOS X? I tried out a combination of ipfw commands without much success:

ipfw add fwd 127.0.0.1,8000 tcp from any to 192.168.99.100 80

(Success for me is pointing a browser at http://192.168.99.100 and getting a response back from a development server that I have running on localhost:8000)