[altq:1722] Re: dmz traffic

[Kenjiro Cho <kjc@csl.sony.co.jp>]

Waldemar Brodkorb wrote:
> I have a problem to find a solution for following
> problem. 
> 
> OpenBSD 3.2 system configured as a bridge between 
> firewall (three interfaces) and LAN. 
> 
> I'm throttling all traffic into the LAN, every client
> gets 20 % of the line, including passive ftp.

[snip]

> But how I can configure altq to not shape traffic to
> our DMZ. I didn't find a possibility to negate source or
> destination addresses in the filter rules, nothing 
> mentioned in the manpage.
> DMZ is on the third firewall interface (10.0.0.0/8).

You can add a filter for the DMZ at the tail of the config.
For example,
	filter xl0 def_class 10.0.0.0 netmask 255.0.0.0 0 0 0 0
	filter xl0 def_class 0 0 10.0.0.0 netmask 255.0.0.0 0 0

-Kenjiro