A brief introduction to altq

#SLOW hosts will be throttled.
table <SLOW> persist { $INT }
#FAST does not get throttled. put friendly or important nets here.
table <FAST> persist { $INT:network }

# 300Kb is probably good if you have 500Kb up
UP="300Kb"

# re0 is a gigabit adapter, so even 1% blows the chips off the cable modem
# Since both the fast and zoom queues can borrow, they are effectively not
# rate-limited, but having one queue with slightly higher priority makes
# ACK prioritization possible.
altq on $INT cbq tbrsize 1500 queue {slow, fast, zoom}
queue slow bandwidth $UP priority 1 cbq(red default)
queue fast bandwidth 40% priority 5 cbq(borrow)
queue zoom bandwidth 59% priority 6 cbq(borrow)

# inbound connections (and their replies) will default to the slow queue
pass on $INT all flags any queue slow

# on-net traffic is uncapped.
pass quick on $INT inet from <FAST> to <FAST> \
flags any queue (fast, zoom)

# Useful protocols go first. SSH, mail, dns, time and web
# take priority over random unspecified drivel
FAST="{22,25,53,123,80,443}"
pass log quick on $INT inet proto {tcp udp} from port $FAST \
flags any queue (fast, zoom)
pass log quick on $INT inet proto {tcp udp} to port $FAST \
flags any queue (fast, zoom)
pass log quick on $INT inet proto icmp queue fast

# This rule will tag everything as fast, with TCP ACKs and IPTOS_LOWDELAY
# getting high priority. See /usr/share/pf/ackpri.
pass log on $INT inet flags any queue (fast, zoom)

# set up priority queuing. The two lowest classes are using the Random Early
# Detect (or Drop) to start dropping packets as the queue length increases.
# For general web-wanking and unclassified connections, some packet loss is
# acceptable. For the more interactive and time-sensitive protocols loss is
# unacceptable.
altq on $EXT priq bandwidth $UP queue {ultra, fast, norm, slow}
queue slow priority 1 priq(default, red)
queue norm priority 4 priq(red)
queue fast priority 5
queue ultra priority 6

# There is much wailing and gnashing of teeth if ssh, dns or ntp are laggy.
ULTRA="{22, 53, 123}"
# FTP, telnet, and various chat/instant messenger protocols
FAST="{21, 23, 706, 1863, 5050, 5190, 5222, 6667}"
# Bulk transfers that won't mind waiting for more interactive protocols
NORM="{25, 80, 443, 8080, 2401}"
# Everything not listed above gets the lowest priority
INBOUND="{3072, 4096, 5120}"

# Block everything unless otherwise allowed, and queue any state that
# packet might flow into the slow class unless otherwise requeued.
block in on $EXT queue slow

#allow in some basic services
pass in on $EXT inet proto icmp icmp-type echoreq queue ultra
pass in on $EXT inet proto tcp to port {22, 443} synproxy state queue ultra
pass in on $EXT inet proto tcp to port {25, 80} synproxy state queue norm

pass in on $EXT proto {tcp udp} to port $INBOUND queue slow

# queue packets so they go faster
# "ULTRA" always goes first
pass out quick on $EXT inet proto icmp queue ultra
pass out quick on $EXT proto {tcp udp} to port $ULTRA queue ultra