Date: Tue, 8 Oct 2019 13:05:37 -0700 From: Julian Elischer <julian@freebsd.org> To: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <b182358f-8ec0-4a71-b201-1736282d847d@freebsd.org> In-Reply-To: <20191008155813.GS2691@home.lan> References: <20191008134851.GP2691@home.lan> <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net> <20191008155813.GS2691@home.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On 10/8/19 8:58 AM, Julien Cigar wrote: > On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: >> Hi Julien, > Hi Matthew, > >> It's not clear why you are trying to assign multiple carp IP address to >> two different interfaces from within the same IP subnet. Are you trying >> to fail over a 2nd carp address or are you trying to improve >> throughput/redundancy? If you just want to fail over a 2nd carp address, >> assign a 2nd alias to your first interface. If your trying to improve >> throughput/redundancy, assign both interfaces to a lagg and build your >> carp interfaces on top of that instead. >> > Currently outbound traffic from $net1 and $net2 (two private networks) > pass through the same network interface (igb0) (as you can see in (1) > in my previous post) on the router. I'd like to prevent that > $net2 saturates the interface and slow down traffic from $net1 (which is > more important). I could lagg and build CARP on top of that but it > wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ > of course, which I'd like to avoid). > >> -Matthew >> >> On 10/8/2019 8:48 AM, Julien Cigar wrote: >>> Hello, >>> >>> I'd like to NAT outbound traffic from two different private networks >>> through two different interfaces, with CARP on top. I have 4 public IPS >>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). >>> >>> I have two redundant router/firewall running FreeBSD 12 with CARP and >>> PF with the following: (1) which works well, but all traffic >>> goes through the same interface. >>> >>> So I'd like to switch to something like (2), which will not work (lines >>> 5 and 13 are not valid) and I'm wondering if I could use something like >>> (3) ..? >>> >>> Thank you! >>> Julien >>> >>> (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 >>> (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 >>> (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db >>> >> _______________________________________________ >> freebsd-net@freebsd.org mailing list >> https://lists.freebsd.org/mailman/listinfo/freebsd-net >> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" can you draw it?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?b182358f-8ec0-4a71-b201-1736282d847d>