FireBrick Shape Guide

Shaping rules

The FireBrick can be used to change the rate of traffic using speed lanes. The shaping rules define in to which speed lane each type of traffic is assigned. They operate much like filters. The first in-profile rule which matches the traffic in question is applied. If no rules match then the default master lane is used.

Name Allows you to give a name to this rule
Security Sets the security level of this rule and so defines who can view or edit the users details
Profile Defines the profile when this rule applies.
Source This allows you to specify one or more source interfaces from which the traffic may come
Target This allows you to specify one of more target interfaces to which the trafficmay be going
Lane This specifies the lane to be applied to the traffic
Both ways This makes the rule work both ways saving making two rules.
Source ports This allows a range of source ports to be specified. Applicable to TCP and UDP. Normally blank meaning any.
Target ports This allows a range of target ports to be specifiied. Applicable to TCP and UDP. Typically just one port for the specific protocol, e.g. 80 for WWW
Protocol This allows the specific protocol to be specified, or Any.
Port group Instead of using a source port range, target port range and protocol, then a named port group can be selected.
Source IP range Allows the range of source IPs to be specified, or blank for any.
Source IP group Instead of an IP range, a named IP group can be selected.
Target IP range Allows the range of target IPs to be specified, or blank for any.
Target IP group Instead of an IP range, a named IP group can be selected.

Technical Reference

  • Shaping rules are constantly rechecked in case profiles have moved traffic to a different speed lane. This can mean a few seconds delay in re-assigning traffic.
  • The target IP and ports are those before any NAT or mapping, altough the rule is actually applied at the end of the process of setting up a new session
  • Both ways operates on traffic from source IP, source Port and source interface to target IP, target port and target interface as well as from target IP, source Port and target interface to source IP, target Port, and source interface. I.e. the ports are not swapped as traffic is normally classified by target port regardless of direction of data.
  • Selecting Any protocol and no ports set means any protocol. Selecting Any with ports set means TCP or UDP only.