Date: Wed, 9 Mar 2016 12:33:26 +0100 From: Jan Bramkamp <crest@rlwinm.de> To: freebsd-net@freebsd.org Subject: Re: Source routing howto Message-ID: <56E00A06.20700@rlwinm.de> In-Reply-To: <alpine.BSF.2.00.1603091119130.3214@farmermaggot.shire.sentor.se> References: <alpine.BSF.2.00.1603091119130.3214@farmermaggot.shire.sentor.se>
next in thread | previous in thread | raw e-mail | index | archive | help
On 09/03/16 11:29, elof2@sentor.se wrote:
> Hi all!
>
> I've been searching the internet but can't find any good
> documentation/examples on how to setup source routing in my FreeBSD.
>
> What I want to do:
>
> Let internet clients connect their OpenVPN to a FreeBSD box. The
> client's internet traffic should be routed to a separate firewall
> dedicated for all client networks (VPN and physical), where all clients
> then leave the network.
>
> The FreeBSD box has its own normal default gateway to speak with the
> internet.
> This route is needed in order to be able to keep the OpenVPN-traffic
> flowing.
>
> How do I source route the tunneled traffic, coming from e.g. 10.10.10.x
> to the "client firewall"?
>
> Are there any good examples out there?
> Do I have to compile a custom kernel?
>
> (the responses back from that firewall use a normal static route,
> pointing 10.10.10.0/24 to the FreeBSD box)
Do I understand you correctly that you have a FreeBSD box acting as
* OpenVPN endpoint
* router
* and firewall
all in one system and you want use the OpenVPN tunnel as default route
for your *other* hosts? In that case what you need is some kind of
*policy* based routing.
One way to go about it with more than one FIB (aka kernel routing
table). The problem is that you have to decide on the routing table to
use before performing the route lookup. For packets forwarded through
your FreeBSD router you have to select a non default FIB during input
filtering e.g.
# simple case
ipfw add setfib 1 all from any to any in via $lan_if
# complex case for multiple interfaces
# ipfw table <table_number> add <interface> <fib_number>
ipfw table 1 add $lan_if1 1
ipfw table 1 add $lan_if2 2
ipfw table 1 add $lan_if3 2
ipfw table 1 add $lan_if3 2
# ...
# lookup routing table number in a table
ipfw add setfib tablearg all from any to any via table(1)
For traffic generated by your FreeBSD router you can't use the firewall
to set the routing table because locally generated traffic only passes
through output filtering by which time the routing decision has already
happend. Instead you can set a processes default routing table with the
setfib(1) utility or use a setsockopt(2) with SO_SETFIB for each socket.
Jails can also set default routing table for sockets created inside the
jail.
Remember that your DNS resolver can leak a lot of information as well if
it uses the default routing table.
I would avoid policies based on IP addresses and prefer to define
policies based on (pseudo-) interfaces e.g. route (and nat?) traffic
from vlan123 through the VPN tunnel.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?56E00A06.20700>