OpenVPN and policy routing

[Victor Sudakov]

Michael Sierchio wrote:
> I use different FIBs in the ipfw ruleset to accomplish policy based
> routing, including via a tun interface.

I've just found out that even when tun0 is in fib 0, you can use it as
a gateway from a different fib, and it works:

root at km:~ # netstat -rn -4 -F1
Routing tables (fib: 1)

Internet:
Destination        Gateway            Flags      Netif Expire
default            192.168.154.5      UGS        tun0
95.170.158.128/27  link#2             U           rl1
127.0.0.1          link#4             UH          lo0
192.168.11.0/24    link#3             U          ste0
192.168.14.0/24    link#1             U           rl0
192.168.154.5      link#5             UH         tun0
root at km:~ #
root at km:~ # ifconfig tun0
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        options=80000<LINKSTATE>
        inet6 fe80::2e0:4cff:feb0:6dd4%tun0 prefixlen 64 scopeid 0x5
        inet 192.168.154.6 --> 192.168.154.5 netmask 0xffffffff
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 717
root at km:~ #

I.e. all directly connected networks are available from all fibs, not just the default one.
It probably depends on the net.add_addr_allfibs systcl setting.

So, my task would be best solved by "ifconfig fxp2 fib 1". Thanks to all
who replied.

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
AS43859