Date: Sat, 15 Jul 2006 17:49:10 +0200 From: Nejc Skoberne <nejc@skoberne.net> To: Odhiambo WASHINGTON <odhiambo.raburu@wananchi.com> Cc: freebsd-pf@freebsd.org Subject: Re: Multihoming with route-to Message-ID: <44B90E76.2080808@skoberne.net> In-Reply-To: <20060715084102.GA63164@ns2.wananchi.com> References: <44B75A3D.5060108@skoberne.net> <8eea04080607141609n1270f57dva21efcd2d8eb5789@mail.gmail.com> <44B82950.8050905@skoberne.net> <20060715084102.GA63164@ns2.wananchi.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. --------------040608010606080302020005 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hello, I changed the pf.conf a little, so it fits to my needs (I also need multihoming for a server which is reachable via forwarded port). So TCP and ICMP work correctly now. However, I still have problems with UDP services. For example, I also run a DNS server on this FreeBSD server. If I try to resolve some host using this DNS server by some third party machine like this: $ nslookup host.domain.com A.B.C.D # See the first post for topology description it works smoothly. If I try to use the server's second IP (E.F.G.H), the DNS reply gets stuck in between. After tcpdumping the connection, I realized that even the destination IP in DNS request is E.F.G.H, the source address of DNS reply is A.B.C.D! That is why route-to rule doesn't work any more. If I remember correctly, this is due to the fact, that UDP is connectionless protocol and the DNS server doesn't have to bind to a specific address and port when sending an UDP packet (DNS reply). Therefore it uses the source IP address of the interface via which it tries to send the reply (default route). How could I solve this problem? > May I please see how your final pf.conf now looks like? You can find it here: http://nejc.skoberne.net/pf.conf I incorporated the reply-to rules directly in my filtering definitions. Do not hesitate to ask for further explanation of the rules. Thanks & bye. Nejc --------------040608010606080302020005--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44B90E76.2080808>