From owner-freebsd-net@freebsd.org Thu Mar 30 07:46:21 2017 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0E83BD25342 for ; Thu, 30 Mar 2017 07:46:21 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) Received: from relay2.tomsk.ru (mail.sibptus.tomsk.ru [212.73.124.5]) by mx1.freebsd.org (Postfix) with ESMTP id 751C7F27 for ; Thu, 30 Mar 2017 07:46:19 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) X-Virus-Scanned: by clamd daemon 0.98.5_1 for FreeBSD at relay2.tomsk.ru Received: from [212.73.125.240] (HELO admin.sibptus.transneft.ru) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.16) with ESMTPS id 39655453; Thu, 30 Mar 2017 13:41:47 +0600 Received: from admin.sibptus.transneft.ru (sudakov@localhost [127.0.0.1]) by admin.sibptus.transneft.ru (8.14.9/8.14.9) with ESMTP id v2U7kH0Y025192; Thu, 30 Mar 2017 14:46:17 +0700 (KRAT) (envelope-from vas@mpeks.tomsk.su) Received: (from sudakov@localhost) by admin.sibptus.transneft.ru (8.14.9/8.14.9/Submit) id v2U7kF06025191; Thu, 30 Mar 2017 14:46:15 +0700 (KRAT) (envelope-from vas@mpeks.tomsk.su) X-Authentication-Warning: admin.sibptus.transneft.ru: sudakov set sender to vas@mpeks.tomsk.su using -f Date: Thu, 30 Mar 2017 14:46:15 +0700 From: Victor Sudakov To: Andrea Venturoli Cc: freebsd-net@freebsd.org Subject: Re: OpenVPN and policy routing Message-ID: <20170330074615.GA25049@admin.sibptus.transneft.ru> References: <20170330032222.GA18053@admin.sibptus.transneft.ru> <81f24563-1abb-e804-d2a3-7fa772a0c78d@netfence.it> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <81f24563-1abb-e804-d2a3-7fa772a0c78d@netfence.it> Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://www.dreamwidth.org/pubkey?user=victor_sudakov X-PGP-Fingerprint: 10E3 1171 1273 E007 C2E9 3532 0DA4 F259 9B5E C634 User-Agent: Mutt/1.7.1 (2016-10-04) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 07:46:21 -0000 Andrea Venturoli wrote: > > > > Anyone experienced with OpenVPN on FreeBSD? > > > > What would be the best way to policy route a network into OpenVPN? A > > routing decision must be based on the src IP address, not the dst IP > > address. > > > > Imagine an OpenVPN client with 3 interfaces: fxp0 is the outside > > interface towards the OpenVPN server, fxp1 is for LAN1 and fxp2 for > > LAN2. > > > > From LAN1, some private networks are reachable through OpenVPN > > (tun0), this is done via the regular route commands (pulled from the > > OpenVPN server). > > > > From LAN2, *everything* should be reachable only through OpenVPN. > > Which is the best way to accomplish this? > > > > Possibly pf's "route-to" rules: I've used those in the past, but as I've > reported, sometimes pf gets stuck and only stopping and starting it > again unblocks the network. Will "ipfw fwd" do the trick? I could "ipfw fwd" the packets into the tun0 interface, but will OpenVPN understand that? > > Other ideas could be jails or setfib, but I've not thinked those out. > Of course, fxp2 could be placed in a dedicated fib, but I need fxp0 and fxp1 to remain in the main fib, and which fib will tun0 be in ? -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859