Date: Thu, 10 Oct 2019 10:14:34 +0200 From: Julien Cigar <julien@perdition.city> To: Matthew Grooms <mgrooms@shrew.net> Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <20191010081434.GX2691@home.lan> In-Reply-To: <b45c14a8-7cf1-e889-f4ab-197c8143b160@shrew.net> References: <20191008134851.GP2691@home.lan> <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net> <20191008155813.GS2691@home.lan> <d96a7954-4b2a-db1e-5d00-e6123624367e@shrew.net> <20191009091026.GT2691@home.lan> <b45c14a8-7cf1-e889-f4ab-197c8143b160@shrew.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--m3EZO/+NOdcYnaJL
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Wed, Oct 09, 2019 at 01:41:40PM -0500, Matthew Grooms wrote:
> On 10/9/2019 4:10 AM, Julien Cigar wrote:
> > On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote:
> >> On 10/8/2019 10:58 AM, Julien Cigar wrote:
> >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
> >>>> Hi Julien,
> >>> Hi Matthew,
> >>>
> >>>> It's not clear why you are trying to assign multiple carp IP address=
to
> >>>> two different interfaces from within the same IP subnet. Are you try=
ing
> >>>> to fail over a 2nd carp address or are you trying to improve
> >>>> throughput/redundancy? If you just want to fail over a 2nd carp addr=
ess,
> >>>> assign a 2nd alias to your first interface. If your trying to improve
> >>>> throughput/redundancy, assign both interfaces to a lagg and build yo=
ur
> >>>> carp interfaces on top of that instead.
> >>>>
> >>> Currently outbound traffic from $net1 and $net2 (two private networks)
> >>> pass through the same network interface (igb0) (as you can see in (1)
> >>> in my previous post) on the router. I'd like to prevent that
> >>> $net2 saturates the interface and slow down traffic from $net1 (which=
is
> >>> more important). I could lagg and build CARP on top of that but it
> >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin A=
LTQ
> >>> of course, which I'd like to avoid).
> >> Well, I'm not sure how well it will work but I think what you are
> >> looking for is the route-to pf rule option. You can specify that certa=
in
> >> traffic be transmitted via a specific network interface to a specific
> >> next hop. However, I believe you'll need to match traffic as it's
> >> received on the internal interface, ie. before the kernel determines t=
he
> >> egress interface.
> >>
> >> table internal_networks { $net1, $net2 }
> >> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1
> >> to !<internal_networks>
> >> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2
> >> to !<internal_networks>
> > Thanks, I haven't used the route-to yet but if I understand well it's
> > a way to "bypass" the default route/interface?
>=20
> Yes. It's essentially pf's way of providing policy based routing in the=
=20
> rule set.
Excellent, it looks exactly what I need
Thanks!
>=20
> -Matthew
>=20
--=20
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
--m3EZO/+NOdcYnaJL
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEnF27CBNtOraRNmgqCLYqJMpBHmkFAl2e6GoACgkQCLYqJMpB
HmlM6A/+I8Uipq51nnfcvc/vr8ZHCrQyzMzu+Lr8cq7Oc9t9th95NerIfxDZQr40
ovF9tbjlDc6MgizghrlYilRtBEBLKsf9ZO4PJgBe7Q9vTxSU2p8cR5qD3sMfsYZH
PD8+r5CvrwAQPagPRVBLoAzesMWMjTyeRwMDMTZ5/Mr35uLMDbf52oTZesmspoye
ZRyhFbfvConqYasaanm101siD3iM69VNoGzbufkO8/Bpdf/RPBRcBbSNZFBXy2Jh
YSVxzROehQflDYdgoaGELTcCLRwSv+FtJT98vwLAfNIZxoutFhKuE5MOhA0Exv9r
OnCbIO2nqR8puWzES+N1sAtL3kjHnDKuCEU3ht641ITMM5K3Mzk4j5CWqUsI+ux/
tYjOROEVa15x8YqHpOuvEtiLBeM82eWgOgb2Oi6Kl+NvZHAqa0QuWc7US3OUlrFQ
ymPkjta+SDy/74o4cvRW1xhRPoDP5NVcZGlYAkjIn0Avd6P/OH3z5mmRuMU0rTaT
ErnThter7Q0Pke/lhM+HQ6IOmXaDoldbB5R4pWyXJTOmskG4AsDniamLL6/wmeKa
wsx+6dXpYklMBgJXq0pOzr2mL2isAzwVE8dh8+oiYezsX/4S579H5LadzarzC5gb
oE7NF3nypBwD84nJGmoWcbMRsP0txsjq9S1f+dakXVk4EGE4SuE=
=FXW7
-----END PGP SIGNATURE-----
--m3EZO/+NOdcYnaJL--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20191010081434.GX2691>