FireBrick 105
Manuals
Home

Shaping rules

The FireBrick can be used to change the rate of traffic using speed lanes. The shaping rules define in to which speed lane each type of traffic is assigned. They operate much like filters. The first in-profile rule which matches the traffic in question is applied. If no rules match then the default master lane is used.

Name	Allows you to give a name to this rule
Security	Sets the security level of this rule and so defines who can view or edit the users details
Profile	Defines the profile when this rule applies.
Source	This allows you to specify one or more source interfaces from which the traffic may come
Target	This allows you to specify one of more target interfaces to which the trafficmay be going
Lane	This specifies the lane to be applied to the traffic
Both ways	This makes the rule work both ways saving making two rules.
Source ports	This allows a range of source ports to be specified. Applicable to TCP and UDP. Normally blank meaning any.
Target ports	This allows a range of target ports to be specifiied. Applicable to TCP and UDP. Typically just one port for the specific protocol, e.g. 80 for WWW
Protocol	This allows the specific protocol to be specified, or Any.
Port group	Instead of using a source port range, target port range and protocol, then a named port group can be selected.
Source IP range	Allows the range of source IPs to be specified, or blank for any.
Source IP group	Instead of an IP range, a named IP group can be selected.
Target IP range	Allows the range of target IPs to be specified, or blank for any.
Target IP group	Instead of an IP range, a named IP group can be selected.

Technical Reference

Shaping rules are constantly rechecked in case profiles have moved traffic to a different speed lane. This can mean a few seconds delay in re-assigning traffic.
The target IP and ports are those before any NAT or mapping, altough the rule is actually applied at the end of the process of setting up a new session
Both ways operates on traffic from source IP, source Port and source interface to target IP, target port and target interface as well as from target IP, source Port and target interface to source IP, target Port, and source interface. I.e. the ports are not swapped as traffic is normally classified by target port regardless of direction of data.
Selecting Any protocol and no ports set means any protocol. Selecting Any with ports set means TCP or UDP only.