From owner-freebsd-net@freebsd.org Wed Oct 9 20:05:27 2019 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 5349F12DEE7 for ; Wed, 9 Oct 2019 20:05:27 +0000 (UTC) (envelope-from mgrooms@shrew.net) Received: from mx2.shrew.net (mx2.shrew.net [38.97.5.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 46pQF25MKrz3xYX for ; Wed, 9 Oct 2019 20:05:26 +0000 (UTC) (envelope-from mgrooms@shrew.net) Received: from mail.shrew.net (mail.shrew.prv [10.24.10.20]) by mx2.shrew.net (8.15.2/8.15.2) with ESMTP id x99JvZiV061660 for ; Wed, 9 Oct 2019 14:57:35 -0500 (CDT) (envelope-from mgrooms@shrew.net) Received: from [10.16.32.30] (65-36-5-114.static.grandenetworks.net [65.36.5.114]) by mail.shrew.net (Postfix) with ESMTPSA id 11A0E1965F9 for ; Wed, 9 Oct 2019 14:57:30 -0500 (CDT) Subject: Re: CARP and NAT question To: freebsd-net@freebsd.org References: <20191008134851.GP2691@home.lan> <20191008155813.GS2691@home.lan> <20191009093454.GU2691@home.lan> <2591c7ce-887e-0e38-bb69-01c1e0ba5bd4@freebsd.org> From: Matthew Grooms Message-ID: Date: Wed, 9 Oct 2019 14:57:28 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <2591c7ce-887e-0e38-bb69-01c1e0ba5bd4@freebsd.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (mx2.shrew.net [10.24.10.11]); Wed, 09 Oct 2019 14:57:35 -0500 (CDT) X-Rspamd-Queue-Id: 46pQF25MKrz3xYX X-Spamd-Bar: ++ Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of mgrooms@shrew.net designates 38.97.5.132 as permitted sender) smtp.mailfrom=mgrooms@shrew.net X-Spamd-Result: default: False [2.22 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; RECEIVED_SPAMHAUS_XBL(5.00)[114.5.36.65.khpj7ygk5idzvmvt5x4ziurxhy.zen.dq.spamhaus.net : 127.0.0.4]; NEURAL_HAM_MEDIUM(-0.99)[-0.994,0]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(0.00)[+mx:c]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[freebsd-net@freebsd.org]; RCPT_COUNT_ONE(0.00)[1]; BAD_REP_POLICIES(0.10)[]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; NEURAL_HAM_LONG(-0.82)[-0.821,0]; RCVD_IN_DNSWL_NONE(0.00)[132.5.97.38.list.dnswl.org : 127.0.10.0]; IP_SCORE(-0.97)[ip: (-9.21), ipnet: 38.0.0.0/8(2.83), asn: 174(1.58), country: US(-0.05)]; DMARC_NA(0.00)[shrew.net]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:174, ipnet:38.0.0.0/8, country:US]; MID_RHS_MATCH_FROM(0.00)[]; GREYLIST(0.00)[pass,body] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Oct 2019 20:05:27 -0000 On 10/9/2019 2:50 PM, Julian Elischer wrote: > On 10/9/19 2:34 AM, Julien Cigar wrote: >> On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote: >>> On 10/8/19 8:58 AM, Julien Cigar wrote: >>>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: >>>>> Hi Julien, >>>> Hi Matthew, >>>> >>>>> It's not clear why you are trying to assign multiple carp IP >>>>> address to >>>>> two different interfaces from within the same IP subnet. Are you >>>>> trying >>>>> to fail over a 2nd carp address or are you trying to improve >>>>> throughput/redundancy? If you just want to fail over a 2nd carp >>>>> address, >>>>> assign a 2nd alias to your first interface. If your trying to improve >>>>> throughput/redundancy, assign both interfaces to a lagg and build >>>>> your >>>>> carp interfaces on top of that instead. >>>>> >>>> Currently outbound traffic from $net1 and $net2 (two private networks) >>>> pass through the same network interface (igb0) (as you can see in (1) >>>> in my previous post) on the router. I'd like to prevent that >>>> $net2 saturates the interface and slow down traffic from $net1 >>>> (which is >>>> more important). I could lagg and build CARP on top of that but it >>>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin >>>> ALTQ >>>> of course, which I'd like to avoid). >>>> >>>>> -Matthew >>>>> >>>>> On 10/8/2019 8:48 AM, Julien Cigar wrote: >>>>>> Hello, >>>>>> >>>>>> I'd like to NAT outbound traffic from two different private networks >>>>>> through two different interfaces, with CARP on top. I have 4 >>>>>> public IPS >>>>>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). >>>>>> >>>>>> I have two redundant router/firewall running FreeBSD 12 with CARP >>>>>> and >>>>>> PF with the following: (1) which works well, but all traffic >>>>>> goes through the same interface. >>>>>> >>>>>> So I'd like to switch to something like (2), which will not work >>>>>> (lines >>>>>> 5 and 13 are not valid) and I'm wondering if I could use >>>>>> something like >>>>>> (3) ..? >>>>>> >>>>>> Thank you! >>>>>> Julien >>>>>> >>>>>> (1) >>>>>> https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 >>>>>> (2) >>>>>> https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 >>>>>> (3) >>>>>> https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db >>>>>> >>>>> _______________________________________________ >>>>> freebsd-net@freebsd.org mailing list >>>>> https://lists.freebsd.org/mailman/listinfo/freebsd-net >>>>> To unsubscribe, send any mail to >>>>> "freebsd-net-unsubscribe@freebsd.org" >>> can you draw it? >> yes, see https://ibb.co/mv5RPM9 > > so, you have several ways of doing this: > > one is to assign a different routing table to each class of traffic. > > Each table has  a different default route, sending data out to a > different external interface. > > Each interface out is NAT'd so that the return packets will come back > the same way. > How do you classify the traffic based on the source address when using multiple route tables? > But you only have a single pipe to the internet, So one wonders how > that helps with redundancy? > I asked a similar question. He believe he mentioned that he was trying to get around the 1Gbit limit of each interface. WRT redundancy, he probably means the use of a backup firewall, carp and probably pfsync. -Matthew