Date: Wed, 9 Oct 2019 11:34:54 +0200 From: Julien Cigar <julien@perdition.city> To: Julian Elischer <julian@freebsd.org> Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <20191009093454.GU2691@home.lan> In-Reply-To: <b182358f-8ec0-4a71-b201-1736282d847d@freebsd.org> References: <20191008134851.GP2691@home.lan> <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net> <20191008155813.GS2691@home.lan> <b182358f-8ec0-4a71-b201-1736282d847d@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--deIB9lj0KCspTQvI Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote: > On 10/8/19 8:58 AM, Julien Cigar wrote: > > On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > >> Hi Julien, > > Hi Matthew, > > > >> It's not clear why you are trying to assign multiple carp IP address to > >> two different interfaces from within the same IP subnet. Are you trying > >> to fail over a 2nd carp address or are you trying to improve > >> throughput/redundancy? If you just want to fail over a 2nd carp addres= s, > >> assign a 2nd alias to your first interface. If your trying to improve > >> throughput/redundancy, assign both interfaces to a lagg and build your > >> carp interfaces on top of that instead. > >> > > Currently outbound traffic from $net1 and $net2 (two private networks) > > pass through the same network interface (igb0) (as you can see in (1) > > in my previous post) on the router. I'd like to prevent that > > $net2 saturates the interface and slow down traffic from $net1 (which is > > more important). I could lagg and build CARP on top of that but it > > wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ > > of course, which I'd like to avoid). > > > >> -Matthew > >> > >> On 10/8/2019 8:48 AM, Julien Cigar wrote: > >>> Hello, > >>> > >>> I'd like to NAT outbound traffic from two different private networks > >>> through two different interfaces, with CARP on top. I have 4 public I= PS > >>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). > >>> > >>> I have two redundant router/firewall running FreeBSD 12 with CARP and > >>> PF with the following: (1) which works well, but all traffic > >>> goes through the same interface. > >>> > >>> So I'd like to switch to something like (2), which will not work (lin= es > >>> 5 and 13 are not valid) and I'm wondering if I could use something li= ke > >>> (3) ..? > >>> > >>> Thank you! > >>> Julien > >>> > >>> (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 > >>> (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 > >>> (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db > >>> > >> _______________________________________________ > >> freebsd-net@freebsd.org mailing list > >> https://lists.freebsd.org/mailman/listinfo/freebsd-net > >> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >=20 > can you draw it? yes, see https://ibb.co/mv5RPM9 >=20 >=20 > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" --=20 Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. --deIB9lj0KCspTQvI Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEnF27CBNtOraRNmgqCLYqJMpBHmkFAl2dqboACgkQCLYqJMpB HmnhjxAAugOFTfBOx55WBHdsu/5+VpZ7h5xgdMFwFRabUfn+ZlgRNgtZzpUL/Qu3 hrBTVzQbkEvhSnArda4tTx6Gjw01hEi5bPf120ZWpP9vx5UST47gT18YVxFAzQ76 nO0PH4BNwbRgERe7rAEMVsbwFbUyXtI7Y/SuvlkdskmJ+zQVwnBs2DtL0xfBN8wn iNrChNz58JpBrTECq1CUPqnxSe2QoXD7xC3fPZ5+JKLtHjmPoL6+bTshF7fRt5H2 IBln4bPcuD7E8Yg8KR1LS1mrlD2iFARrshh3DWcojIuav+ot9r24tSZWA8H9Zr4N SnzZFud8ww2JZ7Cf2OvQnKUvwSUS28x7sA9BPohYQIB/5EWtFnG233Q+My0SQIHi BnsQU4pC+Vw/W8cTed6J948owULsea24SyBpibuj3aZKK79rRJAv8Y5NKrVgLN4O yn7rqxxZY+7Ros4n9kOiqKwMcyM/ET1l4J4LwOkOgavFDicyV85S+56KEfsEqiUZ eDVmSshJXuVuOuBblv6oZzb/jyBb4A7zvXglmd3klth749N5zwdFFr2lze8FGQpy 4Usu5fomHsPWazZKhjYddHfk66DrWFLbiavXNX3CyPTpDEjf8+gbW6YASgTqEPkL dCUOzdmcZTzPeVytZeCNrKbEV08pUjduW3ZlTmhW27dIY7T5CJM= =gaPV -----END PGP SIGNATURE----- --deIB9lj0KCspTQvI--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20191009093454.GU2691>