Scribd Logo
Upload

Welcome to Scribd!

  • 263 views

    Layer 7 Rules Groups in PfSense 1

    Uploaded by

    Aung Kyaw Thu
    This document describes how to create a layer 7 rules group in pfSense 2.1 to direct BitTorrent traffic into the P2P queue. It explains that layer 7 inspection allows controlling traffic based on application patterns rather than just IP addresses and ports. It provides step-by-step instructions for adding a new layer 7 rules group, selecting BitTorrent as the protocol, and assigning it to the P2P queue. It also mentions an alternative method of uploading a pattern file to create the rules group.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Layer 7 Rules Groups in PfSense 1

    Uploaded by

    Aung Kyaw Thu
    263 views2 pages
    This document describes how to create a layer 7 rules group in pfSense 2.1 to direct BitTorrent traffic into the P2P queue. It explains that layer 7 inspection allows controlling traffic based on application patterns rather than just IP addresses and ports. It provides step-by-step instructions for adding a new layer 7 rules group, selecting BitTorrent as the protocol, and assigning it to the P2P queue. It also mentions an alternative method of uploading a pattern file to create the rules group.

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document describes how to create a layer 7 rules group in pfSense 2.1 to direct BitTorrent traffic into the P2P queue. It explains that layer 7 inspection allows controlling traffic based on application patterns rather than just IP addresses and ports. It provides step-by-step instructions for adding a new layer 7 rules group, selecting BitTorrent as the protocol, and assigning it to the P2P queue. It also mentions an alternative method of uploading a pattern file to create the rules group.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    263 views2 pages

    Layer 7 Rules Groups in PfSense 1

    Uploaded by

    Aung Kyaw Thu
    This document describes how to create a layer 7 rules group in pfSense 2.1 to direct BitTorrent traffic into the P2P queue. It explains that layer 7 inspection allows controlling traffic based on application patterns rather than just IP addresses and ports. It provides step-by-step instructions for adding a new layer 7 rules group, selecting BitTorrent as the protocol, and assigning it to the P2P queue. It also mentions an alternative method of uploading a pattern file to create the rules group.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 2

    Layer 7 Rules Groups in pfSense 2.

    1
    October 15, 2013 by maximumdx 2 Comments

    Adding a layer 7 rules group in pfSense 2.1.
    In the previous article, I described how to create a traffic shaping rule to place BitTorrent traffic
    into the P2P queue. Another way of directing traffic into queues is to create a layer 7 rules group.
    In this article, I will describe how to do this.
    Traditionally, network traffic is identified by looking at IP packet fields or by referring to which
    port is being used. In the OSI network model, this method is limited to looking at layers 3 and 4.
    This is highly constricting, but fortunately there is a better way. We can inspect packets at the
    application layer (also known as deep packet inspection), which provides us with a powerful
    solution for controlling traffic based on application patterns. Since this functionality is built into
    pfSense 2.0 and later, we can easily create rules for layer 7 inspection.
    Creating an Layer 7 Rules Group
    As an illustration, I will again turn to the example of limiting bandwidth used by BitTorrent
    traffic by placing it in the P2P queue. First, navigate to Firewall -> Traffic Shaper, and click on
    the Layer 7 tab. Once there, click on the plus button to add a new Layer 7 rule. At
    Enable/Disable, check the checkbox to enable this layer 7 container. At Name, you can
    enter a name, and at Description, you can enter a description that will not be parsed. At
    Rule(s), press the plus button to add one or more rules. There are three dropdown boxes:
    Protocol, Structure, and Behaviour. For Protocol, you can select any one of dozens of
    protocols; I wont list all of them here, but some of the more significant ones are:
    DHCP: Dynamic Host Configuration Protocol, an application level netwprk protocol
    used to configure devices that are connected to a network so they can communicate on
    that network using the Internet Protocol (IP).
    Finger: The Finger user information protocol, which provides basic user information on
    some systems.
    HTTP: Hypertext Transfer Protocol, the main application protocol for the World Wide
    Web.
    UUCP: Unix-to-Unix Copy, a suite of computer programs and protocols allowing remote
    execution of commands and transfer of files, email, and netnews between computers.
    In our case, well choose bittorrent as the protocol. Under Structure, we can choose either
    action or queue. action seems to have one option under Behaviour: block. Since we
    dont want to block bittorrent traffic, but instead want to put it in the P2P queue, we select
    queue. For Behavior, we select qP2P (the P2P queue). We could add another rule, but
    instead we will press the Save button to save the rules group, and Apply changes on the
    next page.
    This covers how to add an layer 7 rules group. But there is an alternative way of adding a layer 7
    rules group: when you first click on the Layer 7 tab, there should be a hyperlink to add new
    layer 7 protocol patterns. Click on this link, then on the Add layer7 pattern page, press the
    Choose button and select a file with the file dialog box. When you are done, press the
    Upload Pattern file button to upload the file.
    This article should be enough to get you started with using layer 7 rules groups, but if you want a
    more in-depth explanation of Layer 7 traffic control and how it was implemented in pfSense, you
    may want to read this scholarly paper on L7 in the pfSense platform (also linked to in the
    external links section).

    You might also like