From owner-freebsd-net@freebsd.org Thu Oct 10 08:14:40 2019 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 69EB214DA2C for ; Thu, 10 Oct 2019 08:14:40 +0000 (UTC) (envelope-from SRS0=uLRP=YD=perdition.city=julien@bebif.be) Received: from orval.bbpf.belspo.be (orval.bbpf.belspo.be [193.191.208.90]) by mx1.freebsd.org (Postfix) with ESMTP id 46pkQR1qyBz4m3W for ; Thu, 10 Oct 2019 08:14:38 +0000 (UTC) (envelope-from SRS0=uLRP=YD=perdition.city=julien@bebif.be) Received: from home.lan (unknown [77.109.104.59]) by orval.bbpf.belspo.be (Postfix) with ESMTPSA id 108B71D4FC2C; Thu, 10 Oct 2019 10:14:36 +0200 (CEST) Date: Thu, 10 Oct 2019 10:14:34 +0200 From: Julien Cigar To: Matthew Grooms Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <20191010081434.GX2691@home.lan> References: <20191008134851.GP2691@home.lan> <20191008155813.GS2691@home.lan> <20191009091026.GT2691@home.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="m3EZO/+NOdcYnaJL" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.4 (2019-03-13) X-Rspamd-Queue-Id: 46pkQR1qyBz4m3W X-Spamd-Bar: ------- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of SRS0=uLRP=YD=perdition.city=julien@bebif.be designates 193.191.208.90 as permitted sender) smtp.mailfrom=SRS0=uLRP=YD=perdition.city=julien@bebif.be X-Spamd-Result: default: False [-7.19 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+mx]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.20)[multipart/signed,text/plain]; DMARC_NA(0.00)[perdition.city]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[90.208.191.193.list.dnswl.org : 127.0.10.0]; SIGNED_PGP(-2.00)[]; FORGED_SENDER(0.30)[julien@perdition.city,SRS0=uLRP=YD=perdition.city=julien@bebif.be]; RCVD_NO_TLS_LAST(0.10)[]; RECEIVED_SPAMHAUS_PBL(0.00)[59.104.109.77.khpj7ygk5idzvmvt5x4ziurxhy.zen.dq.spamhaus.net : 127.0.0.11]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; ASN(0.00)[asn:2611, ipnet:193.191.192.0/19, country:BE]; FROM_NEQ_ENVFROM(0.00)[julien@perdition.city,SRS0=uLRP=YD=perdition.city=julien@bebif.be]; IP_SCORE(-3.19)[ip: (-9.37), ipnet: 193.191.192.0/19(-4.69), asn: 2611(-1.87), country: BE(-0.01)]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Oct 2019 08:14:40 -0000 --m3EZO/+NOdcYnaJL Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Oct 09, 2019 at 01:41:40PM -0500, Matthew Grooms wrote: > On 10/9/2019 4:10 AM, Julien Cigar wrote: > > On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote: > >> On 10/8/2019 10:58 AM, Julien Cigar wrote: > >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > >>>> Hi Julien, > >>> Hi Matthew, > >>> > >>>> It's not clear why you are trying to assign multiple carp IP address= to > >>>> two different interfaces from within the same IP subnet. Are you try= ing > >>>> to fail over a 2nd carp address or are you trying to improve > >>>> throughput/redundancy? If you just want to fail over a 2nd carp addr= ess, > >>>> assign a 2nd alias to your first interface. If your trying to improve > >>>> throughput/redundancy, assign both interfaces to a lagg and build yo= ur > >>>> carp interfaces on top of that instead. > >>>> > >>> Currently outbound traffic from $net1 and $net2 (two private networks) > >>> pass through the same network interface (igb0) (as you can see in (1) > >>> in my previous post) on the router. I'd like to prevent that > >>> $net2 saturates the interface and slow down traffic from $net1 (which= is > >>> more important). I could lagg and build CARP on top of that but it > >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin A= LTQ > >>> of course, which I'd like to avoid). > >> Well, I'm not sure how well it will work but I think what you are > >> looking for is the route-to pf rule option. You can specify that certa= in > >> traffic be transmitted via a specific network interface to a specific > >> next hop. However, I believe you'll need to match traffic as it's > >> received on the internal interface, ie. before the kernel determines t= he > >> egress interface. > >> > >> table internal_networks { $net1, $net2 } > >> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1 > >> to ! > >> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2 > >> to ! > > Thanks, I haven't used the route-to yet but if I understand well it's > > a way to "bypass" the default route/interface? >=20 > Yes. It's essentially pf's way of providing policy based routing in the= =20 > rule set. Excellent, it looks exactly what I need Thanks! >=20 > -Matthew >=20 --=20 Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. --m3EZO/+NOdcYnaJL Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnF27CBNtOraRNmgqCLYqJMpBHmkFAl2e6GoACgkQCLYqJMpB HmlM6A/+I8Uipq51nnfcvc/vr8ZHCrQyzMzu+Lr8cq7Oc9t9th95NerIfxDZQr40 ovF9tbjlDc6MgizghrlYilRtBEBLKsf9ZO4PJgBe7Q9vTxSU2p8cR5qD3sMfsYZH PD8+r5CvrwAQPagPRVBLoAzesMWMjTyeRwMDMTZ5/Mr35uLMDbf52oTZesmspoye ZRyhFbfvConqYasaanm101siD3iM69VNoGzbufkO8/Bpdf/RPBRcBbSNZFBXy2Jh YSVxzROehQflDYdgoaGELTcCLRwSv+FtJT98vwLAfNIZxoutFhKuE5MOhA0Exv9r OnCbIO2nqR8puWzES+N1sAtL3kjHnDKuCEU3ht641ITMM5K3Mzk4j5CWqUsI+ux/ tYjOROEVa15x8YqHpOuvEtiLBeM82eWgOgb2Oi6Kl+NvZHAqa0QuWc7US3OUlrFQ ymPkjta+SDy/74o4cvRW1xhRPoDP5NVcZGlYAkjIn0Avd6P/OH3z5mmRuMU0rTaT ErnThter7Q0Pke/lhM+HQ6IOmXaDoldbB5R4pWyXJTOmskG4AsDniamLL6/wmeKa wsx+6dXpYklMBgJXq0pOzr2mL2isAzwVE8dh8+oiYezsX/4S579H5LadzarzC5gb oE7NF3nypBwD84nJGmoWcbMRsP0txsjq9S1f+dakXVk4EGE4SuE= =FXW7 -----END PGP SIGNATURE----- --m3EZO/+NOdcYnaJL--