CARP and NAT question

[Julien Cigar]

On Wed, Oct 09, 2019 at 01:41:40PM -0500, Matthew Grooms wrote:
> On 10/9/2019 4:10 AM, Julien Cigar wrote:
> > On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote:
> >> On 10/8/2019 10:58 AM, Julien Cigar wrote:
> >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
> >>>> Hi Julien,
> >>> Hi Matthew,
> >>>
> >>>> It's not clear why you are trying to assign multiple carp IP address to
> >>>> two different interfaces from within the same IP subnet. Are you trying
> >>>> to fail over a 2nd carp address or are you trying to improve
> >>>> throughput/redundancy? If you just want to fail over a 2nd carp address,
> >>>> assign a 2nd alias to your first interface. If your trying to improve
> >>>> throughput/redundancy, assign both interfaces to a lagg and build your
> >>>> carp interfaces on top of that instead.
> >>>>
> >>> Currently outbound traffic from $net1 and $net2 (two private networks)
> >>> pass through the same network interface (igb0) (as you can see in (1)
> >>> in my previous post) on the router. I'd like to prevent that
> >>> $net2 saturates the interface and slow down traffic from $net1 (which is
> >>> more important). I could lagg and build CARP on top of that but it
> >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ
> >>> of course, which I'd like to avoid).
> >> Well, I'm not sure how well it will work but I think what you are
> >> looking for is the route-to pf rule option. You can specify that certain
> >> traffic be transmitted via a specific network interface to a specific
> >> next hop. However, I believe you'll need to match traffic as it's
> >> received on the internal interface, ie. before the kernel determines the
> >> egress interface.
> >>
> >> table internal_networks { $net1, $net2 }
> >> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1
> >> to !<internal_networks>
> >> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2
> >> to !<internal_networks>
> > Thanks, I haven't used the route-to yet but if I understand well it's
> > a way to "bypass" the default route/interface?
> 
> Yes. It's essentially pf's way of providing policy based routing in the 
> rule set.

Excellent, it looks exactly what I need

Thanks!

> 
> -Matthew
> 

-- 
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11  6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20191010/d098d455/attachment.sig>