Date: Wed, 04 Apr 2001 02:26:38 -0700 From: "Crist J. Clark" <cjclark@alum.mit.edu> To: Matthew Reimer <mreimer@vpop.net> Cc: owensmk@earthlink.net, security@FreeBSD.ORG Subject: Re: Multiple Default Gateways using DIVERT Message-ID: <3ACAE8CE.F9223E28@alum.mit.edu> References: <lists.freebsd.security.0104021648540A.00570@mike.SOMEWHERE> <3ACA3077.BA9CFFCE@vpop.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Matthew Reimer wrote:
>
> Michael Owens wrote:
> >
> > My company has a single DSL line through which I have set up internet access
> > via NAT using IPF.
> >
> > We are getting a second DSL line, and I was wondering what the best way, if
> > any, would be to use NAT and different default gateways so as to divide up
> > the groups by source address across them. I would like 10.10.10.1-128 to go
> > through gateway 1 (say 2.2.2.1) and 10.10.10.129-254 through gateway 2 (say
> > 2.2.2.2). I have searched the mail archives and seen various suggestions, but
> > none seemed to address this specifically.
> >
> > I know this can't be done with IPF,
Hmm...
> > so I am asking if this is something that
> > could be done with IPFW. From what I can tell, it might using divert, but I
> > am not all that clear on divert's use in varying gateways.
>
> This might be a start, though I'm not sure how NAT should fit in. You'll
> need the IPFIREWALL and IPFIREWALL_FORWARD kernel options.
>
> ipfw add 1000 fwd 2.2.2.1 ip from 10.10.10.0/25 to any
> ipfw add 2000 fwd 2.2.2.2 ip from 10.10.10.128/25 to any
Neither of the two responses I saw looked like they would do what the
original
poster wanted. It is a start, but this one will not work as shown with
natd. The search will terminate with the above rules, before being
divert(4)ed.
The trick is going to be doing NAT on a packet, but still having some
way to tell from which half of the 10.10.10.0/24 block it originated.
What I think the best thing to do is run two natd(8) processses. If you
have
two DSL links, I assume you have at least two public IP addresses to
play
with. I will call them, oip1 and oip2. Start two natd(8)s, one of the
public
IPs each,
# natd -a ${oip1} -p 8668
# natd -a ${oip2} -p 8669
Then, for your ipfw(8) rules,
ipfw add 500 divert 8668 ip from 10.10.10.0/25 to any out via
${oif}
ipfw add 600 divert 8669 ip from 10.10.10.128/25 to any out via
${oif}
ipfw add 700 divert 8668 ip from any to ${oip1} in via ${oif}
ipfw add 800 divert 8669 ip from any t0 ${oip2} in via ${oif}
ipfw add 1000 fwd 2.2.2.1 ip from ${oip1} to any out via ${oif}
ipfw add 2000 fwd 2.2.2.2 ip from ${oip2} to any out via ${oif}
At least... I think that should do it. Looks good on the screen.
--
Crist J. Clark cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3ACAE8CE.F9223E28>