From owner-freebsd-questions@FreeBSD.ORG Wed May 20 07:36:41 2015 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 34593CE9; Wed, 20 May 2015 07:36:41 +0000 (UTC) Received: from mail-wi0-x233.google.com (mail-wi0-x233.google.com [IPv6:2a00:1450:400c:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BCED61CC2; Wed, 20 May 2015 07:36:40 +0000 (UTC) Received: by wicmc15 with SMTP id mc15so140571503wic.1; Wed, 20 May 2015 00:36:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=WIIy/NNv3lJPFtmYmekglovUEsALd5F5qEZMz8mW39w=; b=kVJoeU1zss0/LNsMWpAI15/zluj0C/uj2A4uD17bP0Huq3hPbS2Taf4Ij/Kn55+z7Z CFxCedJTsCcgHKHJy3fQIrTNipx5FlvoxGd9RTmSEGC4CZOIeU9/cRtww1wtbTryzJ2b /4bED1fYb02M4TfYJRoDSXU9snfQsa7yAy45xsD6myIc7t0VTqF5rN1ek6h6crNlpqRD i9qQ0xy3iNgrlu62xNvg7GJwjRgbvMwjw5UwfZgf2vVNl49YZ8YuiyKbcpSOtWmXJte4 LsLxCqa/zYugyOcoZ2L7sNtVFN6Br4OBhFv+ALq0GFVQrt8wQ6Zo8oRiFSh6mCeNXDtK zFUw== MIME-Version: 1.0 X-Received: by 10.180.38.70 with SMTP id e6mr38244625wik.91.1432107399155; Wed, 20 May 2015 00:36:39 -0700 (PDT) Received: by 10.28.210.149 with HTTP; Wed, 20 May 2015 00:36:39 -0700 (PDT) In-Reply-To: References: Date: Wed, 20 May 2015 08:36:39 +0100 Message-ID: Subject: Re: Asymmetric routing with FreeBSD on Amazon EC2 within VPC From: krad To: Adrian Chadd Cc: Patrick Gibson , FreeBSD Questions Mailing List Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 May 2015 07:36:41 -0000 oh and dont run pf if you are going to try vnet jails as the two dont play at present On 20 May 2015 at 08:35, krad wrote: > you best bet is to probably run 2 vnet jails one for each ip. Annoying to > have to have the extra maintenance and resource overhead I know, but its > not a bad thing security wise > > On 20 May 2015 at 04:56, Adrian Chadd wrote: > >> Hi, >> >> So the "freebsd clean" solution would be to create two listen sockets, >> one per IP address, and and have each IP address / routing table in a >> separate FIB, or separate vnet. >> >> I don't know if anyone has set that up though. It would be nice to >> teach some web servers and proxy serversabout FreeBSD FIBs. >> >> >> >> -adrian >> >> >> On 19 May 2015 at 12:22, Patrick Gibson wrote: >> > I'm wondering if anyone has managed to figure out a way to have an >> > Amazon EC2 instance behind a VPC work with multiple public IP >> > addresses? The issue is with asymmetric routing. It's been resolved in >> > the Linux world >> > (http://blog.bluemalkin.net/multiple-ips-and-enis-on-ec2-in-a-vpc/), >> > but I can't seem to get it working under FreeBSD. Using the setfib >> > command, I'm able to manually go out through either interface, but for >> > incoming packets to a webserver that listens to both interfaces, no >> > dice. :( >> > >> > Patrick >> > _______________________________________________ >> > freebsd-questions@freebsd.org mailing list >> > http://lists.freebsd.org/mailman/listinfo/freebsd-questions >> > To unsubscribe, send any mail to " >> freebsd-questions-unsubscribe@freebsd.org" >> _______________________________________________ >> freebsd-questions@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-questions >> To unsubscribe, send any mail to " >> freebsd-questions-unsubscribe@freebsd.org" >> > >