Date: Wed, 9 Oct 2019 13:41:40 -0500 From: Matthew Grooms <mgrooms@shrew.net> To: Julien Cigar <julien@perdition.city> Cc: freebsd-net@freebsd.org Subject: Re: CARP and NAT question Message-ID: <b45c14a8-7cf1-e889-f4ab-197c8143b160@shrew.net> In-Reply-To: <20191009091026.GT2691@home.lan> References: <20191008134851.GP2691@home.lan> <a0a3a5c2-1300-b90b-3114-ae80adcf7f4d@shrew.net> <20191008155813.GS2691@home.lan> <d96a7954-4b2a-db1e-5d00-e6123624367e@shrew.net> <20191009091026.GT2691@home.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On 10/9/2019 4:10 AM, Julien Cigar wrote:
> On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote:
>> On 10/8/2019 10:58 AM, Julien Cigar wrote:
>>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
>>>> Hi Julien,
>>> Hi Matthew,
>>>
>>>> It's not clear why you are trying to assign multiple carp IP address to
>>>> two different interfaces from within the same IP subnet. Are you trying
>>>> to fail over a 2nd carp address or are you trying to improve
>>>> throughput/redundancy? If you just want to fail over a 2nd carp address,
>>>> assign a 2nd alias to your first interface. If your trying to improve
>>>> throughput/redundancy, assign both interfaces to a lagg and build your
>>>> carp interfaces on top of that instead.
>>>>
>>> Currently outbound traffic from $net1 and $net2 (two private networks)
>>> pass through the same network interface (igb0) (as you can see in (1)
>>> in my previous post) on the router. I'd like to prevent that
>>> $net2 saturates the interface and slow down traffic from $net1 (which is
>>> more important). I could lagg and build CARP on top of that but it
>>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ
>>> of course, which I'd like to avoid).
>> Well, I'm not sure how well it will work but I think what you are
>> looking for is the route-to pf rule option. You can specify that certain
>> traffic be transmitted via a specific network interface to a specific
>> next hop. However, I believe you'll need to match traffic as it's
>> received on the internal interface, ie. before the kernel determines the
>> egress interface.
>>
>> table internal_networks { $net1, $net2 }
>> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1
>> to !<internal_networks>
>> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2
>> to !<internal_networks>
> Thanks, I haven't used the route-to yet but if I understand well it's
> a way to "bypass" the default route/interface?
Yes. It's essentially pf's way of providing policy based routing in the
rule set.
-Matthew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?b45c14a8-7cf1-e889-f4ab-197c8143b160>