From owner-freebsd-ipfw@FreeBSD.ORG Mon Jul 6 13:33:59 2009 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8A9CD1065673 for ; Mon, 6 Jul 2009 13:33:59 +0000 (UTC) (envelope-from dev+lists@humph.com) Received: from drum.humph.com (drum.humph.com [88.149.202.106]) by mx1.freebsd.org (Postfix) with ESMTP id 4B6178FC16 for ; Mon, 6 Jul 2009 13:33:59 +0000 (UTC) (envelope-from dev+lists@humph.com) Received: from 88-149-183-86.static.ngi.it ([88.149.183.86] helo=b.boox.net) by drum.humph.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.69) (envelope-from ) id 1MNo0G-000Ld1-J5; Mon, 06 Jul 2009 15:13:04 +0200 Message-Id: From: Giuliano Gavazzi To: Kim Attree In-Reply-To: <00265389C30B444288C246DF37651D0C37637A1893@server-02.playsafesa.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 6 Jul 2009 15:13:03 +0200 References: <00265389C30B444288C246DF37651D0C37637A1893@server-02.playsafesa.com> X-Mailer: Apple Mail (2.935.3) Cc: "freebsd-ipfw@freebsd.org" Subject: Re: Problem with source based policy routing X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 13:33:59 -0000 On M 6 Jul, 2009, at 10:36 , Kim Attree wrote: > > Hey Guys, > > > > I'm having a problem with source-based policy routing in IPFW, I'm > trying to run a load-balanced SMTP System over two links. > > Primary link is re0, lets give it an ip of 192.168.1.1 > Secondary link is re1, with an ip of 192.168.2.1 > > Default gateway for the box is 192.168.1.254 (so ALL outgoing > traffic goes out of re0, unless hardcoded into the routing table for > destinations instead) > Default gateway for re1 is 192.168.2.254 > > I want re1 to be able to accept SMTP, but respond to the originating > IP over the same link re1 (instead of the default gateway). > With this in mind, I setup my NAT accordingly: > > > port 8669 > alias_address 192.168.2.1 > same_ports yes > use_sockets yes > log_ipfw_denied yes > redirect_port tcp 10.0.0.1:25 192.168.2.1:25 > > > And the IPFW rules such: > > > # NATD Statements > add 00097 divert 8668 all from any to any via re0 > add 00097 divert 8669 all from any to any via re1 > why NAT? Unless you also want to spread outgoing traffic from internal hosts, presumably based on dest port or network, then NAT is of no use (except the one via re0 that is presumably used for internal hosts). Incoming packets don't need any rules as the gw 192.168.2.254 knows how to reach your host, you only need to fwd (that is to route) your outgoing packets according to the source. I have a similar setup (with also 2 NATs because I do use both gateways also for natted hosts). The fwd rule would be very early, just after the loopback rules, UNLESS you want to block outgoing traffic on some ports: add 50 fwd 192.168.2.254 src-ip 192.168.2.1 not dst-ip 192.168.2.1/24 That should do it. NOTE: if you also do NAT on that port (re1), then you need this also after the corresponding nat rule. But I urge you to distinguish between necessarily natted traffic (that is traffic coming from internal hosts) and traffic coming from the host itself, by using an alias on the same subnet (say 192.168.2.2) for the natted traffic. This way you avoid natting traffic that does not need it, and can easily distinguish between incoming traffic for your host (192.168.2.1) and for natted hosts (192.168.2.2). Giuliano