Date: Thu, 11 Nov 2004 14:04:07 +0100 From: Pawel Malachowski <pawmal-posting@freebsd.lublin.pl> To: LD <ldsift-applels@yahoo.com.au> Cc: freebsd-ipfw@freebsd.org Subject: Re: Help: Load Balancing 2 external connections Message-ID: <20041111130407.GC21054@shellma.zin.lublin.pl> In-Reply-To: <BC8EFF48-31CE-11D9-9B7E-0005025E2371@yahoo.com.au> References: <5223CD88-31B6-11D9-838C-0005025E2371@yahoo.com.au> <20041108203616.GA21361@shellma.zin.lublin.pl> <BC8EFF48-31CE-11D9-9B7E-0005025E2371@yahoo.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Nov 09, 2004 at 08:39:58AM +1100, LD wrote: > >fwd rule with keep-state option. > > Is my understanding correct that the following (placed before the fwd > rules) achieves that? > i.e., 'ipfw add check-state' placed prior to '<some fwd rule> setup > keep-state' Something like: // route add default ISP1 ipfw add A check-state ... ipfw add B prob 0.5 fwd ISP2 ip from LAN to any out xmit ISP1 keep-state (Haven't tried.) Still, connections speed and direction may vary so trafic on ISP1 and ISP2 may not be shared equally. It can't be helped. I forgot to note that `fwd' requires yet another option in kernel config, IPFIREWALL_FORWARD. There is another problem here: NAT. Outgoing packets have to be NAT-ed before they match fwd rule. With natd, keep-state and prob should be moved from fwd rule to natd rule, and fwd rule should match packets using their NAT-ed address. (Ouch, there is also problem with prob, it is checked before keep-state is checked. We will try to workaround this.) Incoming packets have to be un-NAT-ed before they touch check-state rule. So, it would be something like this: default gw is ISP1GW on ISP1 link, NAT to ISP1NATIP on ISP2 link, NAT to ISP2NATIP add divert NATD1 ip from any to any in recv ISP1 add divert NATD2 ip from any to any in recv ISP2 // we have private IPs now add check-state // If we have state, packets belongs to fwded flow so jump to count line // only packets without state left here add prob 0.5 skipto X ip from LAN to any out xmit ISP1 // prob matches before keep-state, try to workaround // we have half of new (not belongign to any flow) packets here add count ip from any to any keep-state // our workaround. create state for them, no prob here add divert NATD2 ip from LAN to any out xmit ISP1 // pass outgoing to NATD2 so they will be fwded to ISP2 later add fwd ISP2GW ip from ISP2NATIP to any out xmit ISP1 // redirect ISP2 traffic from ISP1 to ISP2 link // theoretically, what we have here left is: // traffic in recv ISP2, after un-NATing, with state (jumped from check-state) add X divert NATD1 ip from any to any out xmit ISP1 // another 50% of flows is left via ISP1 // traffic to ISP1 goes via default route, so do nothing This is written from scratch, untested and may not work, don't blame me. ;) -- Paweł Małachowski
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041111130407.GC21054>