From owner-freebsd-net@FreeBSD.ORG Tue Jun 28 16:16:16 2005 Return-Path: X-Original-To: net@freebsd.org Delivered-To: freebsd-net@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D5B7216A41C for ; Tue, 28 Jun 2005 16:16:16 +0000 (GMT) (envelope-from andywhite@gmail.com) Received: from zproxy.gmail.com (zproxy.gmail.com [64.233.162.192]) by mx1.FreeBSD.org (Postfix) with ESMTP id 970C143D48 for ; Tue, 28 Jun 2005 16:16:16 +0000 (GMT) (envelope-from andywhite@gmail.com) Received: by zproxy.gmail.com with SMTP id p8so344303nzb for ; Tue, 28 Jun 2005 09:16:15 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=HQh8SBgd+cGCwEAYoKbTLYzxie+9mzxbVBjEVd793F0jUCANrX3owh6T/4KkykVtWXFbUzCFNa7ViiRbskzq38p6d+FjvqhmFvfIx07zzDffazn6PspfGrC3tzuIEkv46S6/TzzADuJri1qc9tpPrdMYjf2tZvzj6CuYeF75sgg= Received: by 10.36.222.29 with SMTP id u29mr5581782nzg; Tue, 28 Jun 2005 09:15:44 -0700 (PDT) Received: by 10.36.9.19 with HTTP; Tue, 28 Jun 2005 09:15:44 -0700 (PDT) Message-ID: Date: Tue, 28 Jun 2005 17:15:44 +0100 From: Andrew White To: Julian Elischer In-Reply-To: <42C0DB3B.6000606@elischer.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: <42C0DB3B.6000606@elischer.org> Cc: net@freebsd.org Subject: Re: Julian's netowrking challenge 2005 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Andrew White List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jun 2005 16:16:17 -0000 I got FreeBSD to load balance two ISPs in version 4 a while ago, using ipfw FWD rule, it had the same challenges that you are facing so try this out, the routing is done on probability to cause load balance, but you could do it on source ip http://lists.freebsd.org/pipermail/freebsd-ipfw/2003-August/000399.html I did modify rulesets after that post as there was some unneeded rules, but nothing major, the rules in the post work fine... I got a better CPU and the cpu issue went away... tks Andrew On 6/28/05, Julian Elischer wrote: >=20 > So for reasons that i won't go into, I fin dmyself renumberring an entire= company. > howeve I have a particular problem I can't figure out how to fix. >=20 > I have a gateway/firewall machine running 4.x >=20 > it has 3 interfaces >=20 > fxp0 goes to the internal trusted network > fxp1 goes to the internet via a T1 via a cisco box, > but is shared with another section of the company. > the compant web service is advertised as coming from an address > that is on an address advertised as being on this T1. So are > other services. >=20 > fxp2 also goes to the intenet via a cisco box however nothing is using > it at the moment. >=20 > The one shared T1 is being flooded out by users behind this machine > much to the annoyance of the users on the other part of the company. > This is supposed to be their T1. >=20 > For reasons that are beyond the scope of this problem, the advertised > DNS addresses for teh services advertised, can not just be switched > to be via the other t1. >=20 > The network attached to fxp0 needs to be NAT'd to use the Internet > as it is using illegal numbers. >=20 > The challenge: >=20 > figure out a way so that all teh users on the network behind fxp0 > hcan use the internet using the T1 attached to the cisco off fxp1 > while all the advertised services (about 8 of them, few enough to > list by hand in rules etc.) which are also behind fxp0 but acccessed by N= AT'd > addresses from the addresses on fxp1's net are accessed soly via that T1. >=20 >=20 > [ internet ] > | | > T1 T1 > | | > [cisco] [cisco]--------[other part of company] > | | > [fxp1] [fxp2] > [ freebsd 4.x ] > [fxp0] > | > | > -----------------------illegal numbere'd net(s) (e.g. 192.168.x.x)----- > | | | > [server 1 ] [server 2] [lots of users] >=20 > I can get the 'forward' direction easily.. i.e. incoming packets. >=20 > It's the reverse direction that doesn't work for me. > I considerred running 2 NATDs > but I need to run ipfw to identify teh reverse streams to force back via = fxp2 > and the only way I can do that is by using the 'fwd' command. > if I do that I can't divert them and if I divert them to natd first, I ca= n't > 'fwd' them afterwards as the NATing is already done for the other (wrong) > interface. >=20 > I almost want to add a > route add FROM Server 1 via [fxp2 cisco] which I've seen people request > but until now I've never understood why.. >=20 >=20 > for points: > it may be possible by making the bsd box actually 3 boxes > joined by a 10.x.x.x interface. dscribe how.. >=20 > Your friend with less and less hair.. >=20 > julian >=20 >=20 > I sort of need a routing table based > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >