From owner-freebsd-net@freebsd.org Thu Oct 10 08:41:18 2019 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id AA74814EAA7 for ; Thu, 10 Oct 2019 08:41:18 +0000 (UTC) (envelope-from SRS0=uLRP=YD=perdition.city=julien@bebif.be) Received: from orval.bbpf.belspo.be (orval.bbpf.belspo.be [193.191.208.90]) by mx1.freebsd.org (Postfix) with ESMTP id 46pl192B7Fz4p5X; Thu, 10 Oct 2019 08:41:17 +0000 (UTC) (envelope-from SRS0=uLRP=YD=perdition.city=julien@bebif.be) Received: from home.lan (unknown [77.109.104.59]) by orval.bbpf.belspo.be (Postfix) with ESMTPSA id 374381D4FC2C; Thu, 10 Oct 2019 10:41:16 +0200 (CEST) Date: Thu, 10 Oct 2019 10:41:14 +0200 From: Julien Cigar To: Julian Elischer Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <20191010084114.GY2691@home.lan> References: <20191008134851.GP2691@home.lan> <20191008155813.GS2691@home.lan> <20191009093454.GU2691@home.lan> <2591c7ce-887e-0e38-bb69-01c1e0ba5bd4@freebsd.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="mFM6r0jQWo48NPCK" Content-Disposition: inline In-Reply-To: <2591c7ce-887e-0e38-bb69-01c1e0ba5bd4@freebsd.org> User-Agent: Mutt/1.11.4 (2019-03-13) X-Rspamd-Queue-Id: 46pl192B7Fz4p5X X-Spamd-Bar: ------- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of SRS0=uLRP=YD=perdition.city=julien@bebif.be designates 193.191.208.90 as permitted sender) smtp.mailfrom=SRS0=uLRP=YD=perdition.city=julien@bebif.be X-Spamd-Result: default: False [-7.20 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+mx:c]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.20)[multipart/signed,text/plain]; DMARC_NA(0.00)[perdition.city]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; IP_SCORE(-3.20)[ip: (-9.39), ipnet: 193.191.192.0/19(-4.70), asn: 2611(-1.91), country: BE(-0.01)]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[90.208.191.193.list.dnswl.org : 127.0.10.0]; SIGNED_PGP(-2.00)[]; FORGED_SENDER(0.30)[julien@perdition.city,SRS0=uLRP=YD=perdition.city=julien@bebif.be]; RCVD_NO_TLS_LAST(0.10)[]; RECEIVED_SPAMHAUS_PBL(0.00)[59.104.109.77.khpj7ygk5idzvmvt5x4ziurxhy.zen.dq.spamhaus.net : 127.0.0.11]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; ASN(0.00)[asn:2611, ipnet:193.191.192.0/19, country:BE]; FROM_NEQ_ENVFROM(0.00)[julien@perdition.city,SRS0=uLRP=YD=perdition.city=julien@bebif.be]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Oct 2019 08:41:18 -0000 --mFM6r0jQWo48NPCK Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Oct 09, 2019 at 12:50:49PM -0700, Julian Elischer wrote: > On 10/9/19 2:34 AM, Julien Cigar wrote: > > On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote: > >> On 10/8/19 8:58 AM, Julien Cigar wrote: > >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > >>>> Hi Julien, > >>> Hi Matthew, > >>> > >>>> It's not clear why you are trying to assign multiple carp IP address= to > >>>> two different interfaces from within the same IP subnet. Are you try= ing > >>>> to fail over a 2nd carp address or are you trying to improve > >>>> throughput/redundancy? If you just want to fail over a 2nd carp addr= ess, > >>>> assign a 2nd alias to your first interface. If your trying to improve > >>>> throughput/redundancy, assign both interfaces to a lagg and build yo= ur > >>>> carp interfaces on top of that instead. > >>>> > >>> Currently outbound traffic from $net1 and $net2 (two private networks) > >>> pass through the same network interface (igb0) (as you can see in (1) > >>> in my previous post) on the router. I'd like to prevent that > >>> $net2 saturates the interface and slow down traffic from $net1 (which= is > >>> more important). I could lagg and build CARP on top of that but it > >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin A= LTQ > >>> of course, which I'd like to avoid). > >>> > >>>> -Matthew > >>>> > >>>> On 10/8/2019 8:48 AM, Julien Cigar wrote: > >>>>> Hello, > >>>>> > >>>>> I'd like to NAT outbound traffic from two different private networks > >>>>> through two different interfaces, with CARP on top. I have 4 public= IPS > >>>>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). > >>>>> > >>>>> I have two redundant router/firewall running FreeBSD 12 with CARP a= nd > >>>>> PF with the following: (1) which works well, but all traffic > >>>>> goes through the same interface. > >>>>> > >>>>> So I'd like to switch to something like (2), which will not work (l= ines > >>>>> 5 and 13 are not valid) and I'm wondering if I could use something = like > >>>>> (3) ..? > >>>>> > >>>>> Thank you! > >>>>> Julien > >>>>> > >>>>> (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d2= 92 > >>>>> (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e4= 10 > >>>>> (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537= db > >>>>> > >>>> _______________________________________________ > >>>> freebsd-net@freebsd.org mailing list > >>>> https://lists.freebsd.org/mailman/listinfo/freebsd-net > >>>> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.or= g" > >> can you draw it? > > yes, see https://ibb.co/mv5RPM9 >=20 > so, you have several ways of doing this: >=20 > one is to assign a different routing table to each class of traffic. >=20 > Each table has=C2=A0 a different default route, sending data out to a=20 > different external interface. >=20 > Each interface out is NAT'd so that the return packets will come back=20 > the same way. I haven't played with multiple FIB(s) yet (which still require a custom kernel with options ROUTETABLES, I think?) but I'll take a look. As I can see it's a little bit more more work than the route-to PF route option. >=20 > But you only have a single pipe to the internet, So one wonders how=20 > that helps with redundancy? >=20 Adding a second switch and another redundant link is also planned, but=20 at the moment by "redundancy" I was talking of router1 and router2, and the integration with CARP, especially the "real" addresses on the interfaces as I have only 4 public ones and 3 of them are already used on the first interface. But I think that starting with FreeBSD 11 (?) real and virtual addresses couldn't be in the same subnet, for example I think this should work: ########### # router1 # ########### ifconfig_igb0=3D"inet 193.1.2.89 netmask 255.255.255.224 -tso" ifconfig_igb0_alias0=3D"inet vhid 53 advskew 0 pass xxx alias 193.1.2.90/32" ifconfig_igb1=3D"inet 10.1.2.3 netmask 255.255.255.224 -tso" ifconfig_igb1_alias0=3D"inet vhid 54 advskew 0 pass xxx alias 193.1.2.92/32" ########### # router2 # ########### ifconfig_igb0=3D"inet 193.1.2.91 netmask 255.255.255.224 -tso" ifconfig_igb0_alias0=3D"inet vhid 53 advskew 100 pass xxx alias 193.1.2.90/= 32" ifconfig_igb1=3D"inet 10.1.2.4 netmask 255.255.255.224 -tso" ifconfig_igb1_alias0=3D"inet vhid 54 advskew 100 pass xxx alias 193.1.2.92/= 32" >=20 >=20 thanks for you help :) Julien >=20 > > > >> > >> _______________________________________________ > >> freebsd-net@freebsd.org mailing list > >> https://lists.freebsd.org/mailman/listinfo/freebsd-net > >> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >=20 >=20 --=20 Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. --mFM6r0jQWo48NPCK Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnF27CBNtOraRNmgqCLYqJMpBHmkFAl2e7qYACgkQCLYqJMpB HmlCng//ZiWkBmfTd1NqWinRCA/q5bBI2/zx9Oxn+/almdsbXIfsqWDdZiCtbmDh 9bDQaF1Di5uX54hWPCLzhXoerMtfUZaQ7M5Ws/zkbaW0m5pI25nzuRrcDZp/l1qm 2jSrfSyt/0YHE4CtdopvX5iXJw6Di1iypSlXokqur6GzUOJh0+ZeM1wSew9Rv/3q HHhI1Sl1yLw/THMBXs+blKKOYoFeeaMcN0ccFvsE/5MR0QbYOYMinXs4LK23txVp WQU36gzwHUQNBUTM1kmDSSAyYz6u6Bai1NBM5Imsa2Uy2ht43BT/000Ay6pkve50 +ox/rXSdSnLVzLn5fRFQVt9nAS/iUeNEW1sV+Dc9/jy8vfcCdzfb50McuEcSVbud H4K8DKLQz8gNFmQlWLTebU74+jvEt04oXQKTA/ly6QvBRsLJH2F9e11vjNFtRtGh +tcCAggvbvnHCEzFwToHNGsIH8HJQP1y4VRQME421cVrb+SzKJ89HQ0y6eTvC+vV 0G4NBCNxS2rdnAViFZqo8stqf326ROgMGpCPJjQ/Ow57QMJu/WybF3Rs8JSVC2J+ njw/eLmoLT6igG1Umm6a/Gu/c9kMHDWlssVo521CVn7Mx8bqaaJiEKOsj2ovjhQ2 DGAAes0per1eRG2tAYdzj3KHpvk1+oi00hS/6YytVCUFSrh+/AQ= =HLdY -----END PGP SIGNATURE----- --mFM6r0jQWo48NPCK--