Date: Fri, 15 Sep 2017 11:33:58 +0200 From: "Kristof Provost" <kristof@sigsegv.be> To: "Dave Cottlehuber" <dch@skunkwerks.at> Cc: freebsd-net@freebsd.org, freebsd-pf@freebsd.org Subject: Re: NATted outbound traffic sometimes uses backup CARP IP on LACP/LAGG interface Message-ID: <91414E93-FAFF-4EE6-A91D-F10FDA959783@sigsegv.be> In-Reply-To: <1505467875.1199722.1107024744.004A81D1@webmail.messagingengine.com> References: <1505398868.955393.1106053824.42CA3E40@webmail.messagingengine.com> <4250D983-3CE2-4156-85FB-E580F6C592D2@sigsegv.be> <1505467875.1199722.1107024744.004A81D1@webmail.messagingengine.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 15 Sep 2017, at 11:31, Dave Cottlehuber wrote:
> Can you explain what $if:0 resolves to, for example how does it relate
> to to the primary ipv4/6 addresses bound to that interface?
>
> I couldn't find a reference in the usual ifconfig manpages about this
> (ifname:#) format, the BNF grammar for pf.conf doesn't cover it
> either,
> and `pfctl -vnf ...` simply shows (lagg0:0).
>
It tells pf to not use any of the alias addresses. It’s explained in
the pf.conf man page:
Interface names and interface group names can have modifiers
appended:
:network Translates to the network(s) attached to the
interface.
:broadcast Translates to the interface's broadcast
address(es).
:peer Translates to the point-to-point interface's
peer
address(es).
:0 Do not include interface aliases.
Host names may also have the :0 option appended to restrict
the name
resolution to the first of each v4 and v6 address found.
Regards,
Kristof
From owner-freebsd-pf@freebsd.org Fri Sep 15 09:38:08 2017
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
by mailman.ysv.freebsd.org (Postfix) with ESMTP id D5E04E0A1B2;
Fri, 15 Sep 2017 09:38:08 +0000 (UTC)
(envelope-from dch@skunkwerks.at)
Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com
[66.111.4.28])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by mx1.freebsd.org (Postfix) with ESMTPS id A88F91E1;
Fri, 15 Sep 2017 09:38:08 +0000 (UTC)
(envelope-from dch@skunkwerks.at)
Received: from compute7.internal (compute7.nyi.internal [10.202.2.47])
by mailout.nyi.internal (Postfix) with ESMTP id E5BDF20BF0;
Fri, 15 Sep 2017 05:31:15 -0400 (EDT)
Received: from web6 ([10.202.2.216])
by compute7.internal (MEProxy); Fri, 15 Sep 2017 05:31:15 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=skunkwerks.at;
h=cc:content-transfer-encoding:content-type:date:from
:in-reply-to:message-id:mime-version:references:subject:to
:x-me-sender:x-me-sender:x-sasl-enc; s=mesmtp; bh=yiU5RfgLSLPW8M
tdRPyV4gh48fM2XzLKF7KjGExWbiQ=; b=YyRh0X0XcYsO4npP7dzyjIt4L4kdg/
9XSRAaB3k9qTcK8hVkSZ6qUPWj1+zRS90kVunbRLUWblLjCEYJau8hahfQ1c5D+L
4Xv89GnAjOI6It1HRt8sbTNA02MZRPNhZ/7PtJ6c3qPF4aP6L9/8TDKVOuS7HYN7
QLw63VtySHeFc=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
messagingengine.com; h=cc:content-transfer-encoding:content-type
:date:from:in-reply-to:message-id:mime-version:references
:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=yiU5Rf
gLSLPW8MtdRPyV4gh48fM2XzLKF7KjGExWbiQ=; b=fx1PqEyzlUeWDXvQ5NsooL
spS3uydy7WAo6KnDmXZxnSiiGQdqzdGGj2UT4MjGd+DqtrRiT8S3EOZadP0tUBvx
fkrKEbWwN855dTXdAhqJuBXiiTsgRNHgaxwoGQqB8IUPmFexV4OsyqxlIEUfcG9i
GFcaBi6gYPg7Yf23Xiv10PA/1eFILVZjKAtFRY8gsynwtS5W8/qRrJzOMRHsMMdn
DZIXTek3z4vp09AL+e6tIzlw8DzrjFnErqGOW5cixNYrpZkm2VuX4UTKJtmnpHuu
aU/msFyHX8zT12RKSxzvGsWFzIRUPbA2dkzLtJhONXOvlf75st9h478cWxE5nTow
==
X-ME-Sender: <xms:4527WbiHPs2J_xLC83sFXsfC_9OzhguYDa4cWBBD_O7CMALenuPuSw>
Received: by mailuser.nyi.internal (Postfix, from userid 99)
id BC03A48004; Fri, 15 Sep 2017 05:31:15 -0400 (EDT)
Message-Id: <1505467875.1199722.1107024744.004A81D1@webmail.messagingengine.com>
From: Dave Cottlehuber <dch@skunkwerks.at>
To: Kristof Provost <kristof@sigsegv.be>
Cc: freebsd-net@freebsd.org, freebsd-pf@freebsd.org
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"
X-Mailer: MessagingEngine.com Webmail Interface - ajax-64b08692
Subject: Re: NATted outbound traffic sometimes uses backup CARP IP on LACP/LAGG
interface
In-Reply-To: <4250D983-3CE2-4156-85FB-E580F6C592D2@sigsegv.be>
References: <1505398868.955393.1106053824.42CA3E40@webmail.messagingengine.com>
<4250D983-3CE2-4156-85FB-E580F6C592D2@sigsegv.be>
Date: Fri, 15 Sep 2017 11:31:15 +0200
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-pf>,
<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>;
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Sep 2017 09:38:08 -0000
On Thu, 14 Sep 2017, at 23:32, Kristof Provost wrote:
> On 14 Sep 2017, at 16:21, Dave Cottlehuber wrote:
> > Outgoing traffic (from a jail) via PF NAT over a LAGG/LACP sometimes=20
> > has the *backup* CARP IP address assigned to it.
> >
> I think this is your problem. You=E2=80=99re telling pf to nat to the IP=
=20
> address of lagg0, but lagg0 has multiple addresses assigned.
>=20
> =E2=80=98(lagg0:0)=E2=80=99 should work, or just use the IP address.
Thanks Kristof!
($if:0) works perfectly, but I'll need to reboot to test this with the
original carp setup though.
Can you explain what $if:0 resolves to, for example how does it relate
to to the primary ipv4/6 addresses bound to that interface?
I couldn't find a reference in the usual ifconfig manpages about this
(ifname:#) format, the BNF grammar for pf.conf doesn't cover it either,
and `pfctl -vnf ...` simply shows (lagg0:0).
A+
Dave
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?91414E93-FAFF-4EE6-A91D-F10FDA959783>