From owner-freebsd-questions@FreeBSD.ORG  Sat Feb 25 10:15:03 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3BAE216A420
	for <freebsd-questions@freebsd.org>;
	Sat, 25 Feb 2006 10:15:03 +0000 (GMT) (envelope-from leon@trusc.net)
Received: from cluster1.trusc.net (clgw.trusc.net [196.25.95.198])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 98B7643D45
	for <freebsd-questions@freebsd.org>;
	Sat, 25 Feb 2006 10:15:01 +0000 (GMT) (envelope-from leon@trusc.net)
Received: from [192.168.255.25] (helo=[192.168.255.25])
	by cluster1.trusc.net (Exim 4.51 0 (FreeBSD 5.3)) protocol: esmtp
	id 1FCwRo-000NNv-1Q for <freebsd-questions@freebsd.org>
	; Sat, 25 Feb 2006 12:14:49 +0200
Message-ID: <44002E1B.7040201@trusc.net>
Date: Sat, 25 Feb 2006 12:14:51 +0200
From: Leon Botes <leon@trusc.net>
Organization: TruscTechnologies
User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Spam-Score: -1.4 (-)
Subject: pf binat problem
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: leon@trusc.net
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 25 Feb 2006 10:15:03 -0000

# network diagram
#                        __________
#                       |          | <dsl1_if>---<dsl1_rt>
#                       |          |
#   <pri_net>---<pri_if>| freebsd  | <dsl2_if>---<dsl2_rt>
#                       |    pf    |
#   <dmz_srv>---<dmz_if>| firewall | <dig_if>----<dig_rt>
#                       |          |
#   (internal nets)     |__________| (external nets)

Default Gateway is <dig_rt>.
When a connection arrives on one of the dsl_if's it is redirected to the 
correct port on the dms_srv, traced via tcpdump.
The dmz_srv responds but tries to send its reply out the default gateway 
instead of via the interface the connection arrived on.
The dmz server is actually a LVS cluster masqueraded.
All connections coming in via the dig_if get redirected and work fine.

How can i tell pf to return connections out the same interface they 
arrived on and not use the default route out dig_if?

dsl1_if = "rl3"
dsl1_rt = "172.16.3.1"
dsl1_ip = "172.16.3.2"
dsl2_if = "rl1"
dsl2_rt = "172.16.4.1"
dsl2_ip = "172.16.4.2"
dmz_if = "rl0"
dmz_srv = "172.16.2.4"
dmz_if_ip = "172.16.2.3"
pri_if = "rl2"
pri_ip = "192.168.254.1"

binat on $dig_if from $dmz_srv to any -> $dig_ip
binat on $dsl1_if from $dmz_srv to any -> $dsl1_ip
binat on $dsl2_if from $dmz_srv to any -> $dsl2_ip
nat on $dig_if from <pri_net> to any -> $dig_ip
nat on $dsl1_if from <pri_net> to any -> $dsl1_ip
nat on $dsl2_if from <pri_net> to any -> $dsl2_ip

rdr on $dsl1_if inet proto tcp from any to $dsl1_ip port { 25, 80, 110 } 
-> $dmz_srv
rdr on $dsl2_if inet proto tcp from any to $dsl2_ip port { 25, 80, 110 } 
-> $dmz_srv

Thanks
Leon