Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 25 Feb 2006 15:52:19 -0500
From:      "fbsd_user" <fbsd_user@a1poweruser.com>
To:        <leon@trusc.net>, <freebsd-questions@freebsd.org>
Subject:   RE: pf binat problem
Message-ID:  <MIEPLLIBMLEEABPDBIEGCEMBHCAA.fbsd_user@a1poweruser.com>
In-Reply-To: <44002E1B.7040201@trusc.net>

next in thread | previous in thread | raw e-mail | index | archive | help
This question was just covered on this list during the last 7 days.
Search the questions archives at http://freebsd.rambler.ru/


-----Original Message-----
From: owner-freebsd-questions@freebsd.org
[mailto:owner-freebsd-questions@freebsd.org]On Behalf Of Leon Botes
Sent: Saturday, February 25, 2006 5:15 AM
To: freebsd-questions@freebsd.org
Subject: pf binat problem


# network diagram
#                        __________
#                       |          | <dsl1_if>---<dsl1_rt>
#                       |          |
#   <pri_net>---<pri_if>| freebsd  | <dsl2_if>---<dsl2_rt>
#                       |    pf    |
#   <dmz_srv>---<dmz_if>| firewall | <dig_if>----<dig_rt>
#                       |          |
#   (internal nets)     |__________| (external nets)

Default Gateway is <dig_rt>.
When a connection arrives on one of the dsl_if's it is redirected to
the
correct port on the dms_srv, traced via tcpdump.
The dmz_srv responds but tries to send its reply out the default
gateway
instead of via the interface the connection arrived on.
The dmz server is actually a LVS cluster masqueraded.
All connections coming in via the dig_if get redirected and work fine.

How can i tell pf to return connections out the same interface they
arrived on and not use the default route out dig_if?

dsl1_if = "rl3"
dsl1_rt = "172.16.3.1"
dsl1_ip = "172.16.3.2"
dsl2_if = "rl1"
dsl2_rt = "172.16.4.1"
dsl2_ip = "172.16.4.2"
dmz_if = "rl0"
dmz_srv = "172.16.2.4"
dmz_if_ip = "172.16.2.3"
pri_if = "rl2"
pri_ip = "192.168.254.1"

binat on $dig_if from $dmz_srv to any -> $dig_ip
binat on $dsl1_if from $dmz_srv to any -> $dsl1_ip
binat on $dsl2_if from $dmz_srv to any -> $dsl2_ip
nat on $dig_if from <pri_net> to any -> $dig_ip
nat on $dsl1_if from <pri_net> to any -> $dsl1_ip
nat on $dsl2_if from <pri_net> to any -> $dsl2_ip

rdr on $dsl1_if inet proto tcp from any to $dsl1_ip port { 25, 80,
110 }
-> $dmz_srv
rdr on $dsl2_if inet proto tcp from any to $dsl2_ip port { 25, 80,
110 }
-> $dmz_srv

Thanks
Leon
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
"freebsd-questions-unsubscribe@freebsd.org"




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?MIEPLLIBMLEEABPDBIEGCEMBHCAA.fbsd_user>