From owner-freebsd-net@FreeBSD.ORG Thu Mar 20 14:29:52 2008 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4AA23106564A for ; Thu, 20 Mar 2008 14:29:52 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 01FC68FC12 for ; Thu, 20 Mar 2008 14:29:51 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=one; d=codelabs.ru; h=Received:Date:From:To:Cc:Message-ID:References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To:Sender:X-Spam-Status:Subject; b=iNlaWHHLOTwv5sasyc2gnKaiCqKRMoDyp6jp5eAzC424zCH/9nXPPUI1sOAbCk+E9TBBCI6hnSROEYriO4XmX37vHhUeYyQ2qs7CJeoJ/NY9PnrvgrPKgSFb615DTgyir2L+iU5Fthc42HvbBnEYmzeze3/yfowEHV+1OrPrY4c=; Received: from void.codelabs.ru (void.codelabs.ru [144.206.177.25]) by 0.mx.codelabs.ru with esmtpsa (TLSv1:AES256-SHA:256) id 1JcLm9-000LG2-Gl; Thu, 20 Mar 2008 17:29:49 +0300 Date: Thu, 20 Mar 2008 17:29:48 +0300 From: Eygene Ryabinkin To: Stefan Lambrev Message-ID: References: <47E25F45.8010805@moneybookers.com> <47E26A10.4040305@moneybookers.com> MIME-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <47E26A10.4040305@moneybookers.com> Sender: rea-fbsd@codelabs.ru X-Spam-Status: No, score=-1.7 required=4.0 tests=ALL_TRUSTED,AWL,BAYES_50 Cc: freebsd-net@freebsd.org, Vlad GALU Subject: Re: route-to not working X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Mar 2008 14:29:52 -0000 Stefan, good day. Thu, Mar 20, 2008 at 03:43:44PM +0200, Stefan Lambrev wrote: >>> But here is working example which you can improve off course. >>> >>> #dual home >>> pass in on $ext_if1 reply-to ($ext_if1 $gw1) from any to $external_addr1 >>> keep state >>> pass out on $ext_if2 route-to ($ext_if1 $gw1) from $external_addr1 to any >>> pass in on $ext_if2 reply-to ($ext_if2 $gw2) from any to $external_addr2 >>> keep state >>> pass out on $ext_if1 route-to ($ext_if2 $gw1) from $external_addr2 to any >>> >>> #dual home ssh only >>> pass out on $ext_if2 route-to ($ext_if1 $gw1) from $external_addr1 to any >>> pass out on $ext_if1 route-to ($ext_if2 $gw1) from $external_addr2 to any >>> pass in on $ext_if1 reply-to ($ext_if1 $gw1) proto tcp from any to >>> $external_addr1 port 22 keep state >>> pass in on $ext_if2 reply-to ($ext_if2 $gw2) proto tcp from any to >>> $external_addr2 port 22 keep state [...] > You forget that the first rule to match wins and keep state (which is on by > default in 7.0) will make replies to match the state not the pass out rules. May be I am badly interpreting the last sentence, but in pf, the last rule that matches (or the first rule with the 'quick' keyword) wins. The above rules are just decoupled from each other, because they are differing in the interface/direction. And sure, when the state is created, the subsequent packets are not passed through the ruleset. Am I missing something? Thank you. -- Eygene