From owner-freebsd-net@freebsd.org Wed Oct 9 21:15:50 2019 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 0AE9E12F99D for ; Wed, 9 Oct 2019 21:15:50 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 46pRpF6WY4z42Lg for ; Wed, 9 Oct 2019 21:15:49 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (c-73-225-95-104.hsd1.wa.comcast.net [73.225.95.104]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id x99LFj2k007403 (version=TLSv1.2 cipher=AES128-SHA bits=128 verify=NO); Wed, 9 Oct 2019 14:15:47 -0700 (PDT) (envelope-from julian@freebsd.org) Subject: Re: CARP and NAT question To: Matthew Grooms , freebsd-net@freebsd.org References: <20191008134851.GP2691@home.lan> <20191008155813.GS2691@home.lan> <20191009093454.GU2691@home.lan> <2591c7ce-887e-0e38-bb69-01c1e0ba5bd4@freebsd.org> From: Julian Elischer Message-ID: <643e0dc3-b28a-9d43-5bbc-797c22670224@freebsd.org> Date: Wed, 9 Oct 2019 14:15:39 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-Rspamd-Queue-Id: 46pRpF6WY4z42Lg X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-1.92 / 15.00]; local_wl_from(0.00)[freebsd.org]; NEURAL_HAM_MEDIUM(-0.93)[-0.926,0]; NEURAL_HAM_LONG(-1.00)[-0.999,0]; ASN(0.00)[asn:36236, ipnet:204.109.60.0/22, country:US] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Oct 2019 21:15:50 -0000 On 10/9/19 12:57 PM, Matthew Grooms wrote: > On 10/9/2019 2:50 PM, Julian Elischer wrote: >> On 10/9/19 2:34 AM, Julien Cigar wrote: >>> On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote: >>>> On 10/8/19 8:58 AM, Julien Cigar wrote: >>>>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: >>>>>> Hi Julien, >>>>> Hi Matthew, >>>>> >>>>>> It's not clear why you are trying to assign multiple carp IP >>>>>> address to >>>>>> two different interfaces from within the same IP subnet. Are >>>>>> you trying >>>>>> to fail over a 2nd carp address or are you trying to improve >>>>>> throughput/redundancy? If you just want to fail over a 2nd carp >>>>>> address, >>>>>> assign a 2nd alias to your first interface. If your trying to >>>>>> improve >>>>>> throughput/redundancy, assign both interfaces to a lagg and >>>>>> build your >>>>>> carp interfaces on top of that instead. >>>>>> >>>>> Currently outbound traffic from $net1 and $net2 (two private >>>>> networks) >>>>> pass through the same network interface (igb0) (as you can see >>>>> in (1) >>>>> in my previous post) on the router. I'd like to prevent that >>>>> $net2 saturates the interface and slow down traffic from $net1 >>>>> (which is >>>>> more important). I could lagg and build CARP on top of that but it >>>>> wouldn't prevent $net2 to saturate the interface (unless I'm >>>>> plugin ALTQ >>>>> of course, which I'd like to avoid). >>>>> >>>>>> -Matthew >>>>>> >>>>>> On 10/8/2019 8:48 AM, Julien Cigar wrote: >>>>>>> Hello, >>>>>>> >>>>>>> I'd like to NAT outbound traffic from two different private >>>>>>> networks >>>>>>> through two different interfaces, with CARP on top. I have 4 >>>>>>> public IPS >>>>>>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). >>>>>>> >>>>>>> I have two redundant router/firewall running FreeBSD 12 with >>>>>>> CARP and >>>>>>> PF with the following: (1) which works well, but all traffic >>>>>>> goes through the same interface. >>>>>>> >>>>>>> So I'd like to switch to something like (2), which will not >>>>>>> work (lines >>>>>>> 5 and 13 are not valid) and I'm wondering if I could use >>>>>>> something like >>>>>>> (3) ..? >>>>>>> >>>>>>> Thank you! >>>>>>> Julien >>>>>>> >>>>>>> (1) >>>>>>> https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 >>>>>>> (2) >>>>>>> https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 >>>>>>> (3) >>>>>>> https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db >>>>>>> >>>>>> _______________________________________________ >>>>>> freebsd-net@freebsd.org mailing list >>>>>> https://lists.freebsd.org/mailman/listinfo/freebsd-net >>>>>> To unsubscribe, send any mail to >>>>>> "freebsd-net-unsubscribe@freebsd.org" >>>> can you draw it? >>> yes, see https://ibb.co/mv5RPM9 >> >> so, you have several ways of doing this: >> >> one is to assign a different routing table to each class of traffic. >> >> Each table has  a different default route, sending data out to a >> different external interface. >> >> Each interface out is NAT'd so that the return packets will come >> back the same way. >> > How do you classify the traffic based on the source address when > using multiple route tables? use ipfw to set the fib number based on some bits in the address of the internal machine. e.g. ipfw setfib 1 tcp from (some internal pattern) to (the outside) in recv (internal interface) keep_state There are several ways to do this.. this is just one... The above will assign a dynamic rule for all packets between the  two machines and the table in question will be always used. for that tupple. > >> But you only have a single pipe to the internet, So one wonders how >> that helps with redundancy? >> > I asked a similar question. He believe he mentioned that he was > trying to get around the 1Gbit limit of each interface. WRT > redundancy, he probably means the use of a backup firewall, carp and > probably pfsync. > > -Matthew > > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" > >