Date: Mon, 17 Jul 2017 20:37:34 +0300 From: brahmann <brahmann@lifec0re.net> To: freebsd-net@freebsd.org Subject: Re: A web server behind two gateways? Message-ID: <BEDB0A86-C08A-4D07-8B74-29D2A3725B94@lifec0re.net> In-Reply-To: <596CF4FB.9070306@grosbein.net> References: <a35370da-531d-6678-4a60-95304bdd919b@gjunka.com> <20170717172642.GF39925@home.opsec.eu> <596CF4FB.9070306@grosbein.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, you can use(if itsobe server with two uplinks) ipfw probe 0,5, two sep= arate flows for two fibs, with some two flowfib script=2E=20 I did that once and work like a charm=2E=20 Wbr, brahmann 17 =D0=BB=D0=B8=D0=BF=D0=BD=D1=8F 2017 =D1=80=2E 20:33:47 GMT+03:00, Eugen= e Grosbein <eugen@grosbein=2Enet> =D0=BD=D0=B0=D0=BF=D0=B8=D1=81=D0=B0=D0= =B2: >18=2E07=2E2017 0:26, Kurt Jaeger wrote: > >> I have a vague idea: >>=20 >> If you set a tag (or a keep-state :flowname) using a ipfw rule that >matches >> the incoming gateway MAC and match that tag/check-state flowname and >> the connection (keep-state) to fwd the answer packet back to that >gateway ? > >In fact, the NAT engine already keeps state track of packet flows >and uses that to correctly translate answers back to public IP address=2E > >All you need is to forward translated outgoing answers to correct >channel >based on translated external source IP address (read: do policy based >forwarding)=2E > > >_______________________________________________ >freebsd-net@freebsd=2Eorg mailing list >https://lists=2Efreebsd=2Eorg/mailman/listinfo/freebsd-net >To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd=2Eorg" > > >!DSPAM:596cf513971106642921193! --=20 =D0=92=D1=96=D0=B4=D0=BF=D1=80=D0=B0=D0=B2=D0=BB=D0=B5=D0=BD=D0=BE =D0=B7 = =D0=BC=D0=BE=D0=B3=D0=BE Android =D0=BF=D1=80=D0=B8=D1=81=D1=82=D1=80=D0=BE= =D1=8E =D0=B7 K-9 Mail=2E =D0=92=D0=B8=D0=B1=D0=B0=D1=87=D1=82=D0=B5 =D0=B7= =D0=B0 =D1=81=D1=82=D0=B8=D1=81=D0=BB=D1=96=D1=81=D1=82=D1=8C=2E From owner-freebsd-net@freebsd.org Mon Jul 17 18:19:19 2017 Return-Path: <owner-freebsd-net@freebsd.org> Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E6465D9CE31; Mon, 17 Jul 2017 18:19:19 +0000 (UTC) (envelope-from eugen@grosbein.net) Received: from hz.grosbein.net (hz.grosbein.net [78.47.246.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hz.grosbein.net", Issuer "hz.grosbein.net" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 7BE706AF37; Mon, 17 Jul 2017 18:19:18 +0000 (UTC) (envelope-from eugen@grosbein.net) Received: from eg.sd.rdtc.ru (root@eg.sd.rdtc.ru [62.231.161.221]) by hz.grosbein.net (8.15.2/8.15.2) with ESMTPS id v6HIJ9XR080790 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 17 Jul 2017 20:19:10 +0200 (CEST) (envelope-from eugen@grosbein.net) X-Envelope-From: eugen@grosbein.net X-Envelope-To: asomers@freebsd.org Received: from [10.58.0.4] ([10.58.0.4]) by eg.sd.rdtc.ru (8.15.2/8.15.2) with ESMTPS id v6HIJ56N073335 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Tue, 18 Jul 2017 01:19:05 +0700 (+07) (envelope-from eugen@grosbein.net) Subject: Re: A web server behind two gateways? To: Alan Somers <asomers@freebsd.org> References: <a35370da-531d-6678-4a60-95304bdd919b@gjunka.com> <596CA093.6020508@grosbein.net> <CAOtMX2h6zBi4aVDSdUP_Po_JwOLbxynanZ624530mGLk16fWbg@mail.gmail.com> <596CF1BA.8050104@grosbein.net> <CAOtMX2g6cwDCWJNabqp8AxX_ojSD9T8M9Ga3+cX7aUysmzLjSg@mail.gmail.com> Cc: FreeBSD Net <freebsd-net@freebsd.org>, freebsd-jail@freebsd.org, Grzegorz Junka <list1@gjunka.com> From: Eugene Grosbein <eugen@grosbein.net> Message-ID: <596CFF94.2090506@grosbein.net> Date: Tue, 18 Jul 2017 01:19:00 +0700 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 In-Reply-To: <CAOtMX2g6cwDCWJNabqp8AxX_ojSD9T8M9Ga3+cX7aUysmzLjSg@mail.gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=0.3 required=5.0 tests=BAYES_00,LOCAL_FROM autolearn=no autolearn_force=no version=3.4.1 X-Spam-Report: * -2.3 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * 2.6 LOCAL_FROM From my domains X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on hz.grosbein.net X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org> List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-net>, <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe> List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>; List-Post: <mailto:freebsd-net@freebsd.org> List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help> List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-net>, <mailto:freebsd-net-request@freebsd.org?subject=subscribe> X-List-Received-Date: Mon, 17 Jul 2017 18:19:20 -0000 18.07.2017 0:48, Alan Somers wrote: > I think what you meant to say is "this will work for a server directly > connected to two external gateways (whether or not NAT is involved), > but won't work if the server is not on the same subnet as the > gateways". That's true. But judging by the OP, I think they're all > on the same subnet. Yes. Anyway, as long as there is NAT involved, one already has stateful engine and simpliest and universal solution for this situation is PBR after NAT for outgoing packets. It works no matter whether gateways are directly connecter or not and does not require multiple routing tables nor complex FIB or VNET configurations: # remove "default" NAT rule ipfw delete 50 # translate incoming traffic and create NAT states ipfw add 40 nat 123 ip from any to any in recv $iface1 ipfw add 50 nat 124 ip from any to any in recv $iface2 # insert normal filtering here ... # translate outgoing replies using existing NAT states ipfw add 50020 nat global ip from $LAN to any out xmit $iface1 ipfw add 50030 nat global ip from $LAN to any out xmit $iface2 # translate new outgoing connections not having a state yet ipfw add 50040 nat 123 ip from any to any out xmit $iface1 ipfw add 50050 nat 124 ip from any to any out xmit $iface2 # perform Policy Based Routing for packets going to "wrong" route ipfw add 50140 fwd $gateway2 ip from $extip2 to any out xmit $iface1 ipfw add 50150 fwd $gateway1 ip from $extip1 to any out xmit $iface2 # that's all, folks! This works no matter where default route points to ($gateway1 or $gateway2). All you need is working default route and net.inet.ip.fw.one_pass=0. This can be extended to any number of external channels/interfaces and optimized with ipfw tables but for two channels I prefer write it so for readability. I use this for many installations and it just works.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BEDB0A86-C08A-4D07-8B74-29D2A3725B94>