# pf: packet queuing



## cbrace (Nov 10, 2012)

Hi all,

I'm trying to better understand how packet queuing works. On his site, Daniel Hartmeier offers this example:

```
ext_if="kue0"

altq on $ext_if priq bandwidth 100Kb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)

pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
        keep state queue (q_def, q_pri)

pass in on $ext_if proto tcp from any to $ext_if flags S/SA \
        keep state queue (q_def, q_pri)
```
Question: in the second pass statement, why is he queuing incoming packets? I thought that you don't have any control over the order in which incoming packets arrive at the network interface, that you can only influence the sequence of the outgoing.


----------



## DutchDaemon (Nov 10, 2012)

Queueing incoming packets means actually queueing their resulting outbound packets (return traffic, tcp acks, etc.). When using queues, always queue on pass in and pass out rules.


----------



## bbzz (Nov 10, 2012)

To elaborate a bit, he is in fact marking/classifying inbound packets, and since state is created, matching outbound packets are then queued based on policy.

So you can mark packets both ways but queuing is only done outbound (well, can be done inbound as well but that's another thing).


----------



## cbrace (Nov 10, 2012)

Thanks for the explanation. Is that what *keep state* is doing?


----------



## bbzz (Nov 11, 2012)

Yes. Hence, a stateful firewall.


----------

