Date: Tue, 8 Oct 2019 17:58:14 +0200 From: Julien Cigar <julien@perdition.city> To: Matthew Grooms <mgrooms@shrew.net> Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <20191008155813.GS2691@home.lan> In-Reply-To: <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net> References: <20191008134851.GP2691@home.lan> <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--geqNt1NAoYRYy2Pr Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > Hi Julien, Hi Matthew, >=20 > It's not clear why you are trying to assign multiple carp IP address to= =20 > two different interfaces from within the same IP subnet. Are you trying= =20 > to fail over a 2nd carp address or are you trying to improve=20 > throughput/redundancy? If you just want to fail over a 2nd carp address,= =20 > assign a 2nd alias to your first interface. If your trying to improve=20 > throughput/redundancy, assign both interfaces to a lagg and build your=20 > carp interfaces on top of that instead. >=20 Currently outbound traffic from $net1 and $net2 (two private networks)=20 pass through the same network interface (igb0) (as you can see in (1)=20 in my previous post) on the router. I'd like to prevent that=20 $net2 saturates the interface and slow down traffic from $net1 (which is more important). I could lagg and build CARP on top of that but it wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ of course, which I'd like to avoid). > -Matthew >=20 > On 10/8/2019 8:48 AM, Julien Cigar wrote: > > Hello, > > > > I'd like to NAT outbound traffic from two different private networks > > through two different interfaces, with CARP on top. I have 4 public IPS > > available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). > > > > I have two redundant router/firewall running FreeBSD 12 with CARP and > > PF with the following: (1) which works well, but all traffic > > goes through the same interface. > > > > So I'd like to switch to something like (2), which will not work (lines > > 5 and 13 are not valid) and I'm wondering if I could use something like > > (3) ..? > > > > Thank you! > > Julien > > > > (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 > > (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 > > (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db > > > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" --=20 Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. --geqNt1NAoYRYy2Pr Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnF27CBNtOraRNmgqCLYqJMpBHmkFAl2cshIACgkQCLYqJMpB Hmm6ixAAtAS2Luf/FFPjr+nCyjjk7IWG21vvE0hV46ViagtFxNpcZKwTsRodMiIQ jWNxuPka3ZFfRLZzJbf4xiZc3V+ttamTrQRLKX70Um/4J0lNTVIIeEFqX3k1sl31 8Lio8rP3kn1f+VqoZv1r/bLdDWKUK/wXsFPJfI8iCiaWx8X63yNXuNfyEk15txzK D7Z9cRvVOIr3jwopqO4u0K44x+W/eGXIu3HofvQPzMMvYkyKWSKNcAzchB2GW0SO u7eSlxX2cRKXYrkv3rPOvXwidIMmmpR2+PYVCP2N/YtwsDVu7HJ49t8R7MtK3V0i UgIARWMOgbLHrqr1ODeDJ9DjwnNIofAYvc24/YJhU0cRTSMMsu8IzZm1jnH/SOey ncepe/Jgb/QdrIJx684C3y4icPXsg9aZhOgo+5FcUaglcTdlCM/X4BiXMC7qdHO0 3rYYf8wtgvyT0ZgXnC+oeYCavUSdwJyU8aElPAE+HbfI3W9sH5Xg51jM+lpKqV8B MmwqtXR92aGZnmK3O2E+jxCV4WsDFPdKwow2GCD4IM+EuvVaOR23mA+P8wHxKcX7 zmpPdwlq1ti/EMIbumXWylKwR3XUq0pXrfarChpOg9piS2v1M+0lI+/uy1oKbBy2 JmrZSPZpkJ3ogRwkR2UxTCNNYPvLbMGp7H/0UJoadojUu7tvJPs= =1SMx -----END PGP SIGNATURE----- --geqNt1NAoYRYy2Pr--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20191008155813.GS2691>