Date: Wed, 9 Oct 2019 11:10:27 +0200 From: Julien Cigar <julien@perdition.city> To: Matthew Grooms <mgrooms@shrew.net> Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <20191009091026.GT2691@home.lan> In-Reply-To: <d96a7954-4b2a-db1e-5d00-e6123624367e@shrew.net> References: <20191008134851.GP2691@home.lan> <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net> <20191008155813.GS2691@home.lan> <d96a7954-4b2a-db1e-5d00-e6123624367e@shrew.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--thwsKKN5whlRGe6j
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote:
> On 10/8/2019 10:58 AM, Julien Cigar wrote:
> > On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
> >> Hi Julien,
> > Hi Matthew,
> >
> >> It's not clear why you are trying to assign multiple carp IP address to
> >> two different interfaces from within the same IP subnet. Are you trying
> >> to fail over a 2nd carp address or are you trying to improve
> >> throughput/redundancy? If you just want to fail over a 2nd carp addres=
s,
> >> assign a 2nd alias to your first interface. If your trying to improve
> >> throughput/redundancy, assign both interfaces to a lagg and build your
> >> carp interfaces on top of that instead.
> >>
> > Currently outbound traffic from $net1 and $net2 (two private networks)
> > pass through the same network interface (igb0) (as you can see in (1)
> > in my previous post) on the router. I'd like to prevent that
> > $net2 saturates the interface and slow down traffic from $net1 (which is
> > more important). I could lagg and build CARP on top of that but it
> > wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ
> > of course, which I'd like to avoid).
>=20
> Well, I'm not sure how well it will work but I think what you are=20
> looking for is the route-to pf rule option. You can specify that certain=
=20
> traffic be transmitted via a specific network interface to a specific=20
> next hop. However, I believe you'll need to match traffic as it's=20
> received on the internal interface, ie. before the kernel determines the=
=20
> egress interface.
>=20
> table internal_networks { $net1, $net2 }
> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1=20
> to !<internal_networks>
> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2=20
> to !<internal_networks>
Thanks, I haven't used the route-to yet but if I understand well it's=20
a way to "bypass" the default route/interface?
>=20
> Hope this helps,
>=20
> -Matthew
>=20
--=20
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
--thwsKKN5whlRGe6j
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEnF27CBNtOraRNmgqCLYqJMpBHmkFAl2do/4ACgkQCLYqJMpB
HmmC/w//X8yN6lxXGqxbNQUo/DyxX4uw+My2L/fseeEBSACCqwaBnIsb++hLzgFo
i4jUDFjQnNdncbiPUchyn/H7Km3IaM7HQh6N7KzvSORbSkIunxGnPs+NPCiSuTAc
JbIXUTpyPFpZd9aDMLmYvme4BVAuPaTQhqhb+uJL1C5Ck6tdNmd62rAqsL4yIvi6
TaDmoLV2xcQgPTM7SIDegKb1QX4kZxTPf9jfzX6wKL5uA178Fvq2rJep4L/tZtqr
WcFxnbWMjp+lq39G0ywr9KqfWAbbf5K5ryOjHseQyBANOs6sbG1cUskyhgnks/uI
TSCoTtUegRi2jq45lB0TO2CNbB2lhEa1Yb83bVW5QUoT2FNDrmBRPGPMn5WQBRFL
zLVLTMz0RsQh8ZrwHVJ2GIXnudKWoK2iILMJIBizd4SIV0VEH7Sf4Gw6ZraiU/W9
jomVQTCLJzQTbiJciDTHD+STGxvyv0haG6LZm0DxCwDw367EgBBQNibxR3/Xj+b/
+p5Lu5uKZ986HiunFXy4Dw2H5RDH0zwv6xCQicSpMS2GaGOxGABkHuBUA0VZRByt
oKnmZaP/T2kRmFHxRTA4Nf4VuH0VXLVsa+cy64m3EiwWSFl/KWsQY0qKD3CblQqe
Pt7U0KfZOVxF/lOsZw5T8O9azdbE8Y3M4ic74qh6VKcju+fZYk8=
=4+Oz
-----END PGP SIGNATURE-----
--thwsKKN5whlRGe6j--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20191009091026.GT2691>